hxxps://fbcratcliff[.]org/sharepoint

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fbcratcliff.org/sharepoint
Sample260824-3hlmhazzct

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320878627511438"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F56F8628-B715-4F39-86F8-8C2272182974}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2668	2732	msedge.exe	87
PID 2732 wrote to memory of 4132	2732	msedge.exe	89
PID 2732 wrote to memory of 5032	2732	msedge.exe	90
PID 2732 wrote to memory of 5032	2732	msedge.exe	90
PID 2732 wrote to memory of 5032	2732	msedge.exe	90
PID 2732 wrote to memory of 5108	2732	msedge.exe	91
PID 2732 wrote to memory of 5108	2732	msedge.exe	91
PID 2732 wrote to memory of 2448	2732	msedge.exe	92
PID 2732 wrote to memory of 2448	2732	msedge.exe	92
PID 2732 wrote to memory of 2448	2732	msedge.exe	92
PID 2732 wrote to memory of 3952	2732	msedge.exe	93
PID 2732 wrote to memory of 3952	2732	msedge.exe	93
PID 2732 wrote to memory of 3952	2732	msedge.exe	93
PID 2732 wrote to memory of 4640	2732	msedge.exe	94
PID 2732 wrote to memory of 4000	2732	msedge.exe	95
PID 2732 wrote to memory of 4640	2732	msedge.exe	94
PID 2732 wrote to memory of 4640	2732	msedge.exe	94
PID 2732 wrote to memory of 4000	2732	msedge.exe	95
PID 2732 wrote to memory of 4000	2732	msedge.exe	95
PID 2732 wrote to memory of 4300	2732	msedge.exe	98
PID 2732 wrote to memory of 60	2732	msedge.exe	99
PID 2732 wrote to memory of 4300	2732	msedge.exe	98
PID 2732 wrote to memory of 60	2732	msedge.exe	99
PID 2732 wrote to memory of 5012	2732	msedge.exe	101
PID 2732 wrote to memory of 1704	2732	msedge.exe	102
PID 2732 wrote to memory of 1704	2732	msedge.exe	102
PID 2732 wrote to memory of 1704	2732	msedge.exe	102
PID 2732 wrote to memory of 1672	2732	msedge.exe	111
PID 2732 wrote to memory of 2432	2732	msedge.exe	112
PID 2732 wrote to memory of 4772	2732	msedge.exe	113
PID 2732 wrote to memory of 2292	2732	msedge.exe	115
PID 2732 wrote to memory of 2292	2732	msedge.exe	115
PID 2732 wrote to memory of 2292	2732	msedge.exe	115
PID 2732 wrote to memory of 2100	2732	msedge.exe	116
PID 2732 wrote to memory of 2100	2732	msedge.exe	116
PID 2732 wrote to memory of 2100	2732	msedge.exe	116
PID 2732 wrote to memory of 3904	2732	msedge.exe	117
PID 2732 wrote to memory of 3904	2732	msedge.exe	117
PID 2732 wrote to memory of 2320	2732	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fbcratcliff.org/sharepoint
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14528542465904517881,13945818028689762562,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,2150267619318868347,15663811459166716725,262144 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,6806464209080881787,17688654658867796128,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16422630095634911671,2888553103625441813,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5887881415546517512,13090742722042130312,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,7815329623605671828,14020987937691246087,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,13009122663116613763,10423749554331500424,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,1295190710068281040,15891531295446881772,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11731865456585275663,12350549224864320885,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,16928282350086333512,17426879183232786295,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,16928282350086333512,17426879183232786295,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6180,i,17936540971730046539,603713672993338799,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,11312817007310343907,12021330319707681372,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,13678435099209876339,17306038990051928457,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,8251574556526428665,10651432713766513419,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6524,i,521269368466919290,17229271984203625673,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4268,i,10242223611345610434,9672931764086581143,2097152 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,12713725342036236094,9325994014963360758,524288 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5460,i,10225403900923300516,12727527781716901227,262144 --field-trial-handle=2888,i,6963165766787102018,5081969018395551288,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5ce5c4e9f096b0a60e9d73a21e065d9a950291342740ebb9bd49438307acdfea
MD5 0a0d2f344a8ca5a98526c9861da7782d
SHA1 ac0a240405580b65d845b7ad69fb3528f69d53ba
SHA512 ae8c1c318961c61752cb84454fd104c2fb4cbf13c9902465927166ac792244760be69205b4d9a6db971cce039c7b42ba6c80563a53a673ff4b5a39c5c3d63f0b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7F:fwUQC5VwBIiElEd2K57P7F
TLSH
T100B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f3e07ab19325fd7082bce9bdd5c79abbbd40dd0cbbd46b06088daac0fa8fcbf0
MD5 668c2e4d62e3ff9f426b1acd164a3bd6
SHA1 22f4a38d705ee929ec153efbd2f1e5e923a79369
SHA512 5148389e3b7d119c0dafdef56788cd31e32cfb3065d6c2e5d8808cfb9355635ef0b462a6c555f718f5f2e48999e4b3b21a9a1b587f7208c68812eb3474292ade
TLSH
T1A371A20D05D20496F7E51E31F8C336D7393285B84A0B1EB21280A7BEAE16F2D1CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9228b687494af4cf96d95eb41ae7e2cad45311af6adf7fc680b2fdc53be0dfdd
MD5 ef525b1d937214d9942eb14a8663c912
SHA1 f664094236d07efc850ccd14d75c73145ab4cc18
SHA512 4211b1d7ea178a420539b79d04f3d14d035c6b821113e9b494c6dfa5c88dbe09bbab1f305f917b9507f8b2110e38fd0c7c94f69170261ef5e0170932236825e1
TLSH
T16871804D09D20492F3E51E31F8D336D7797284B84A5B0E7616809BBDAE16F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b467.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b467.TMP
Size 3KB
SHA256 b762e1304c263a97432e680db616e2bebd85566a25ba936906ec5d1718d5c9a4
MD5 c9ed273e2ae43e713f427f0cc691bf96
SHA1 b41a29a6f4a773b214d8b5f0802f4278230d4865
SHA512 1ffc74d8b7e89a9fc82b9e76795f86e0f937d9bc74bd2cb968d557af589ab97fe9ab728a42a6c6a26f497cd6446c2365df3553d0612f668755c9ed6d1db75e76
TLSH
T15171801D09D20592F3E51E31F8D236D7793280B95A470E7206809BBDAE26F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5f811ca49c73224141b0b42ef1bcb695bf4d269c713dc43cf3d922398909c70d
MD5 6d3415ae6d446a9204a695dbb33b2b03
SHA1 dc66cfb4ee5cbceeec44cef4e2486c3a59038571
SHA512 9f1660391df87165d7d24280ba3591d01baaf942def5eac406fbf7c80303439294761c6420df11dbc6220e8f48f1459c80e0b3a7fd2c79d8ca75e655368706f2
TLSH
T1D2318CF383B0856ECE1196F09A18DF2BCE1C0612435C786986D4EE27D3F30B5E006A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 255ff7043416f38c5564d7840ea7f1580e00241b9889beed82d3f5db9ae482f6
MD5 c8cba1caa33d866aabc28a018b1ebada
SHA1 d304517e5fae8fad187ce794c4f153a370b60a53
SHA512 8a574dce3e7ebc70916dff2463bf9045a9bf5f67dff3ba5abec83358846d1ad6a6da301da1b74b7d5bbb3014cb1257c63314f20704659a73265d7b874697b51a
SSDEEP 192:sxZnRMyM/jK1Ml8Mkd/fcsKg9Idp3SD5HW6+WNYSZ6cw/YwYzx9IgrJ:sxZnuMd/fcsKg+IHbfW/S9
TLSH
T1BB52FA15AA3469B7CCDBD309FA45BF53D6F9057292900E44AAFCCA1C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 00e72ea75ef517e5fc0ce481f109457bde9ececb767f9677ce48bf721e861d9e
MD5 198904cb04dd1014ceb35ba036971768
SHA1 3e0c252a543b88c71f5fe5887b819acca7103388
SHA512 3414ecb5226b00e57c0b9b79450ffbfa5a64e9832dc235311841e56bd5dc02cf36dc1a7ea8dc14bf2484ad254243546b179dbe5e2b1effda24989d8a9ea31a98
SSDEEP 192:sxZnRMyM/jK1Ml8UQSXd/fcsyNdIdplSDRhHW6+WNYSZYoZhcw/Ywfex9Ig5KJ:sxZnuqgd/fcsyNeaHbfpV/CE
TLSH
T192520B16AA3469B7CCDBD209F945BF63D6F5457392900E44AAFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 577122db667cb9071b8c320e1e745f8e811f83ef6afd8ed50ad62113642d318c
MD5 bcd31497462cea6ba91c8a75027e9b7a
SHA1 14f88a648e1f38ed4556c99088d219c5a3e0824b
SHA512 e5e4360ccb54099fb401cde8446b7abefeae99a100076ed976f26dd729e6ed267dfb715651ec7d7fc4d28667952018e4a8ff1860f48b3c1e50473d3ba9b140c0
SSDEEP 192:sxZnRMyM/jK1Ml8MXd/fcsyNdIdp3SDRhHW6+WNYSZYoZhcw/Ywhpx9Ig5KJ:sxZnuPd/fcsyNeoHbfpV/1E
TLSH
T1F5520B15AA3469B7CCDBD209FA44BF63D6F5457392900E44AAFCCA1C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d1d74e4ffb53f1c4bb9ed7b6d93ddddc362fe586ef306a40914a383350565f2a
MD5 5a1d08964c763876d45a2195f795cb0b
SHA1 c5fc543341204d83ba5cfc7fce1619700daa8e70
SHA512 70f883b523bced21b75a8bc412103fcf54dfbdfc513246aa9ce031029f6343f6ae2ff756df8c410a54cc90c070cd0bc6fae9397c061132faeb113b7c0e4e21e8
SSDEEP 768:xW4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dSrohLlaCn:xW4jeXmWvmKxEu1jacPLZQdJ5
TLSH
T127E20A3B280CCB7E4F844E5CED26AE976ED802CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7012d1579668ffbc83761146bfa1e4edff37bfe4bbe81a3035b86567887acb3d
MD5 feda0b3537af4b575f9da23fc7f4b66a
SHA1 a3bac08d5532f342a266a2ad1a98d50f667e8cc6
SHA512 c8958aeb878dc7cbb2bfd9cb5687f6acf7023048bf9443f19f42989a879d352068f3edc7c7cfa8038aa506b769d014b5a9b87b43b06d255bf291e654e88aaa1d
SSDEEP 24:Kd9f4LiandPrD4bf+yIj3DKiMhaZD1ElTSmtMI8LAyXY0fbwRaudmWy4uK+BIjcU:KsiIfKnKQDyN1IRK+0M+YI7KRCMfyK
TLSH
T11C91525AB0BB06013D7F6E1CA154972A5A41B1B3315CE82F37E944A18F6AF260CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7379e45f-42e3-4b7d-8684-cfe58f0cdb87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7379e45f-42e3-4b7d-8684-cfe58f0cdb87.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e3c7eb504dac8ab16485e9bfaed7096b905056f0bc9f7acac80b0ba80a72c9ab
MD5 9e1c10691e7c56a30e5e8cc09779dac2
SHA1 eb1fada7f5c4cd583850c04b378849b0c76d4202
SHA512 127b423f4ea0533da336d5e4338337e12a3c1ba88e29735642cf549b8a03de321cbfcfa79526abdff6f0c20e08ff315de5de63d50d0c1d4894c716e7304d1964
SSDEEP 384:f3yFaeO8WsNdSCsBomCf+xOE1hpxJrpFrm1crF2q0I+0:f3IzhWttKYOshLhDrscrF2q0y
TLSH
T109827C36A8B8AC77CD92A591F0473653EFB85267EAC46F84E1ED7F1D04CA29D130B805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 16e2531022d9e1927a353762cff30db01db67f78643581b3ea4ecf6ea5b4ac6c
MD5 60e7ee012447a563c150f7bde2b828f3
SHA1 0d2a430b9dbb73f6b30451028835b7f88d5cd71f
SHA512 3bb563f21dd4b4036aee187244ddd64df9c32d209e22eec1b10b970019d59274b6ede36fff798f80e9868dc0814fb2934306a00aef1714eb0ad5795569e08fdd
SSDEEP 384:9iFZ3yFaeO8LsNn8TUNTUlIllCsBaqYf+xOE1hpxJrrFrm1crF2q0I+0:0FZ3IzhLSwgJFAYOshLhZrscrF2q0y
TLSH
T199C219F258D79837D99D5743E33E2E139EBCC167B880AA54B3995A1DCC861BFD30A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ce6a65f2b28343680a18947e69bf2653b0261ec9f30f367c1f1961cfbb4996ed
MD5 d6a5322a4cdbe84aac028f3d8e4bbe7e
SHA1 0243846f496d77af46bbe68b2ee996c2ab607d6b
SHA512 11a1d6ba5b665cb24815a8b23e8cf88023087376556fb9a5042c7999193d194d2b37ce87da320df3fe51975a6dc1b8676be78ff8f95c3d5b69dcc1b81d5f87a3
SSDEEP 192:EONa6hZ0QmiUy8Kpc/+jVnO1u1m5wOZr/5fvU6:EONa6ompu+xOE1F2rxfvU6
TLSH
T18F02E93568686C778EE2AF45F48727235FE4213BE9956F84D5E82B1D00C775C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bc9596281e21c170f9ac8f8b3181e9ab8d3b02f2b4ea6b8bdab87ed3f9581a2d
MD5 fc13fdc4073cec6534e74f29c85e2e9b
SHA1 ed29a554f70c0e1ccf6f568c2bfac12006792619
SHA512 37cc6ae8fa44216697623422eaa81efff7160ce1b9ca166c4602f41f9eff53e97efe3b68ec0ab27060231a578d55a1b1e35fcb9ea4e362358547b1506c96e947
SSDEEP 384:V3yFaeO8/sNdlCsBaHYf+xOE1hpxJrpFrm1crF2q0I+0:V3Izh/+SAYOshLhDrscrF2q0y
TLSH
T128827D36A8B8AC77CDA2A591F0473653EFF85267DAC46F94E1ED6F1D04C629C230B805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e5a73a65dd5bd98d41dbff4f076c2db4cb3338dfd91f799093c6872feb341ff8
MD5 18ab1a9d1e219b79ea1958c50a730fb5
SHA1 c80918c1ee724dd8ab4954f31d157f3401f27a91
SHA512 ac7a75055262c3a733e2333dc43603c7fd37d3076148e99ba9e0d92fa479e5ab2c2ac920c5f08d6268502030ef42c42a67987e368ccf9963deeb7e19b8aa35a8
SSDEEP 192:0ONQ6hZdQmiUy+Kec/+jVnO1u1hjFuSJrd5cOqrDq91U6:0ONQ6Xueu+xOE1hpxJro9rm1U6
TLSH
T16012E9356868AC779DD2A691F48736139EE51227EA857FC4E1EC3F1C04DBB6C234AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

209030ec-663b-46db-b08f-cfe59fc1250c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\209030ec-663b-46db-b08f-cfe59fc1250c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d22b182ee100daf74d2bc94204573afad0be895bf03e3dcd3191f0ffc4168248
MD5 00300563cd806e107a2d732377c936da
SHA1 13274a644261112b10646193efbce2bb28de816e
SHA512 e1c4a62503ddbf13c400ad6594343355a79a8b973f0cfda2465e9b03bde545b57d6b8e1f9a6715a88ee75706d5da243b07bfaefa0ca6a674c16ce3a2f49dfb43
TLSH
T1E3410658B6ED1148B3B76E5AABF664AE483EBC772E0AD49D00110D4E0A63F41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download