dd57cfdca125b1af0abf40c8101dd418f5c4459a9239f8256856335489facbdc

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project_documents.html
Size 74KB
Sample260831-h66mcseq41
SHA256 dd57cfdca125b1af0abf40c8101dd418f5c4459a9239f8256856335489facbdc
MD5 dbe9cb3f93f67e1bd6fda16419b6f288
SHA1 2e3e4d98b5ca81f3040362c3fd457e21f1e57896
SHA512 ddc4fd3f9481939dcad1141cea1ec3c47df05a5492656e1471f56dc9ccb3ed7cdb28972f997747d96547ffba6fbca22b6d983f96ab2ffd8a6151a48e22670133
SSDEEP 1536:tWCE0EqqXT3q7HMqgZq1N66EakYhMsaBiKSurMRo6p+ZdvCYtu9hL:kCE4g6D1u6NhhgQKFr96Y2YY9hL
TLSH
T1677302FB52347EA482F1872B221FFD3A98853CE108C3EE5E10FE08584FA5354666EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
78	ipapi.co
79	ipapi.co
81	ipapi.co
85	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326345231241907"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DDCAB76A-EA4A-4F43-ACE7-CE1877CDDEF4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5116	4108	msedge.exe	87
PID 4108 wrote to memory of 2220	4108	msedge.exe	89
PID 4108 wrote to memory of 2452	4108	msedge.exe	90
PID 4108 wrote to memory of 2220	4108	msedge.exe	89
PID 4108 wrote to memory of 2220	4108	msedge.exe	89
PID 4108 wrote to memory of 996	4108	msedge.exe	91
PID 4108 wrote to memory of 996	4108	msedge.exe	91
PID 4108 wrote to memory of 3944	4108	msedge.exe	92
PID 4108 wrote to memory of 3944	4108	msedge.exe	92
PID 4108 wrote to memory of 3944	4108	msedge.exe	92
PID 4108 wrote to memory of 4072	4108	msedge.exe	93
PID 4108 wrote to memory of 4072	4108	msedge.exe	93
PID 4108 wrote to memory of 4072	4108	msedge.exe	93
PID 4108 wrote to memory of 832	4108	msedge.exe	94
PID 4108 wrote to memory of 960	4108	msedge.exe	95
PID 4108 wrote to memory of 832	4108	msedge.exe	94
PID 4108 wrote to memory of 832	4108	msedge.exe	94
PID 4108 wrote to memory of 960	4108	msedge.exe	95
PID 4108 wrote to memory of 960	4108	msedge.exe	95
PID 4108 wrote to memory of 3120	4108	msedge.exe	99
PID 4108 wrote to memory of 4056	4108	msedge.exe	100
PID 4108 wrote to memory of 3120	4108	msedge.exe	99
PID 4108 wrote to memory of 4056	4108	msedge.exe	100
PID 4108 wrote to memory of 4776	4108	msedge.exe	102
PID 4108 wrote to memory of 1188	4108	msedge.exe	110
PID 4108 wrote to memory of 4856	4108	msedge.exe	111
PID 4108 wrote to memory of 4076	4108	msedge.exe	112
PID 4108 wrote to memory of 2028	4108	msedge.exe	117
PID 4108 wrote to memory of 2028	4108	msedge.exe	117
PID 4108 wrote to memory of 3024	4108	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Project_documents.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x338,0x7fffe1c8c188,0x7fffe1c8c194,0x7fffe1c8c1a0
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,4531040140433907769,18010667517077164916,262144 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,17747838545093156419,16155223574061873871,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,8962479250991360331,16560789747519949940,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2838745387371433432,14563080779337126053,2097152 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,10723818362419208832,363081137484589582,2097152 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,3368060290335277938,5873512663071047020,2097152 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,16599243733744972036,12786293526907191636,2097152 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,17626492525726209986,8753734804161814328,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8760969625897438101,6798375464754119378,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,12167127294815700157,2811353729254554622,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,12167127294815700157,2811353729254554622,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,10436169837108804957,14149354220771227837,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,3201553008342582325,17770496405892914333,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,16836230702951440849,9762915703864962445,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,17778978619303360436,6015202068708042371,524288 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,13931745251835110891,7181711071789411579,262144 --field-trial-handle=2932,i,4553967305721112411,10307926772402442740,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5895a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5895a4.TMP
Size 3KB
SHA256 562795b19aed985daab523e8faf10c939504a0b318298479717f714efcdf8c7e
MD5 0b92711a9da4a5a87003c8d436e1c1fe
SHA1 5002fb4105c3ea776abef94bf2492cee15edb57d
SHA512 6637b016c2717bef29e0c4ab7aed9a6468590da68b42824ac5a93314828ec71eebdb4fb934cbff543bc553670f9cbf95ac32eddd7cfd959b5ccd755b86a098a3
TLSH
T1EA6170380F8605A4FB62037197D1C252B47D86E7FC93DE56E3B009F44BF57228A5978A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 da95bc9bf66ec107cccbb6f0eee6aa496201afa1a07c853a8471d0d1b0fb00c9
MD5 46814be92b9271ce749c7a8b3d2e1e04
SHA1 47b3b1955ffa51941f5490dab622b6a99a256fe1
SHA512 29dde531d3283591c24def14ebde115f32a7cd23f5ad96cf1a15cfecc7de1f46162413465019454d3d51dd192c51c524bad5387625bf8e72d48708492e797ec6
TLSH
T1F53189B6C3D883BE891152F0AA256E2BDD1D051B42283C56CDF9AF5F63F24B0D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c2d3c47338ab7c0e41a524f43fbf236022bd9bf348ad56e95f8139974f51ecba
MD5 e3bacb0df109abc83e9f6872eede50ff
SHA1 e6f5d50d26512c0d48a81eb21ec8f549b9ebd03c
SHA512 eba29c46585fd97d84b3d0eb75dfacd0f3d4eab663ab725b8e89ba4c4e9a49c7f0e031eee54cef7abf7a195cab3da232b3ec4a1d6db91b95f6c43a192335694a
SSDEEP 192:sxZR/yM/jK1Ml8Mkc/fGsGqMMATIdpd5SHW6+WNGYzQ8h+9IgrJ:sxZR7Mc/fGsGqMMrWHbGeS9
TLSH
T13842F812AA34A977CCCBD209FA457F53D6F54572A2900E44A9FCCA1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0297bda2072dedfc07eb72f7661befdc2efe3137b3da2c5efc0445ef8db7693d
MD5 423c26bbfd503f60f759654ebec31551
SHA1 eb07f3be1237d32856ace15611c5562eff64b7ab
SHA512 2f28f13db4dd3ad43f0463a550d15189c2ffb8c24a10e41c732e24cb40d970c72b8b0fb6756b8d9e4ee90ebe5286b06e2bba67f1b7a7abc2e460a652d7c64665
SSDEEP 192:sxZR/yM/jK1Ml8UQbkc/fGsEqLMATIdpH5SHW6+WNGYzUfh+9Ig5GJ:sxZR7qwc/fGsEqLMroHbGPSU
TLSH
T13552F812AA346977CCDBD209FA457F93D6F55472A2900E44A9FCCA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7af6f9948f437f42d6c42a3049b602cc52c63d2768ee9abf577ac7146cb0889a
MD5 6ef911ae0c95c03d4c7cd9e1619a98c6
SHA1 7301cdac724a14ec3260d4286d21c47cd7c7fb95
SHA512 40ba8708146bbee43e98ba11ea935303ae5f1b0df7c2190358344a743a1a04233ed91b86aeef672893a83d95317868b65f8486645d6cd0f4a92dfedea69cb98c
SSDEEP 768:ehW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjBroIriYYi:ehW7kf0Wvqidau1jaa5LA3j6ti
TLSH
T13AD20B3B680CCB7E4F840E5CEC266F976ED801CB66988D544BFA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6217a30b059e97c281c46d93ca4dc4e10905df249520f8966f41c4c5ecde9ece
MD5 685e292420e04050448b5427c49a22ed
SHA1 e30ea87626e03c0b587d52211c075733f18151fa
SHA512 b45d850b081641fea03d946c302ddd2c4cbbeb741b61ef8749e09626ba685a9339196e883dc02ec2de1b66a569511a70aebdf51345d491047bce538aeda22847
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzk0:s2F6JR
TLSH
T1C0D1210BB0364601387D3899B2A78A365F4675A3751CA4EF7FB900A60E67E210DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b9449c7-dde9-4d21-8904-3e68d40b51bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2b9449c7-dde9-4d21-8904-3e68d40b51bf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e60d7252164acc6c84c756eb7b0edca51e17dccaf9fe34c3687bb1f88a895f41
MD5 cf9ade6bdefeb2fca4390f95dba3556a
SHA1 3a924708766f7fb06208e1a76e1a12e77b371f75
SHA512 f68b39c44c9b8eb9b09fb7cd5cd694a18ec1436896f2c122cd684977c764a17bd8d898182cc83ed1faf3c9a240253688fd7abb5b302ffc5e8a39f76f842f40a6
SSDEEP 192:uALsNtU6QP1bVrBbh8QmiU1Ot04aGBPKlt+FdG8PohrGFC1SJridN6qkk3Y:tsNtU6OHVb6YL7dEh+CEJrIck3Y
TLSH
T190422B31AC355C379EB2A541F44736139EB84167E6C46E54ABEDAB0C01EF7AC231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d8c042903ac35f4ce17a8f541edcf682268bfbb070af162814310f741fb28793
MD5 80fb4b48393cb7be886f99a3855613b1
SHA1 053559955d15bcdb694332b7fcf0e6df9edda04c
SHA512 425ab35d985a8d75a7d62717cec3853cbc94bf8682562c5b34d1cb6a363dca4965c397af62099e25b1e8b8c73c0cb5faa07d9b27ec9859f3a6fe8f97b378b589
SSDEEP 384:FiFiZcISsNe8TUNTUlIleOHVb6YL7dEh+CEJrfck3Ko2:MFQS7wgZHVbPWuhfck3K1
TLSH
T1B5925D738C648D7BADB6AA41F58A36139EF44077D5C4EA50F7EDAB0C01AB29C130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 03dcad77376bfec444508af300c8bf4f6d77abeaa92cacc995e6bbaec9acb4d9
MD5 e3189af1997081d9ab6ed044eec722ce
SHA1 1a3ce43794d822d73ef838234b4d5aa49cef3fa2
SHA512 6f4889218a4b8a9d9b0acab4aa7fd41316c08edde62937c8f5bc6bb5bdf7c3e432652f7d6768cf8211cb290a9701c5b7d121d77f2d04824ef85afad0151b0233
SSDEEP 192:MON/64BAQmiUyu1XW5GBPKlt+FdG8PohIaDqqU6:MON/6eAZRWAdEhxdU6
TLSH
T19F02F8346C796C6B9EB2AE45F48737175FE8103BE6846B44EAE85B0C00A775C230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 f159bee7a27d19bfdd0a2a2fa59bfcbd0ecf9f9b825444351f1ddf52376d7acf
MD5 c104275c83b1bc7e9a1b4e8a0665436f
SHA1 90ebf8437ad77f0387134ea14780b1067deca313
SHA512 6143709c86a146a003521073aa2b6337a32d57dd801ebbb2f9255fe9355615f73fa48a959e080c44bdc1242fae143cc4c8f1a3efdc260ad803833e7cf39f614e
SSDEEP 384:RZcIhsNtUeOHVb6YL7dEh+CEJrIck3Ko2:5hNHVbPWuhIck3K1
TLSH
T159726C729C355C776DB6A142F4863A139EB88077E6C46E40AAFDA70D01EF7A8131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0e9ffab016e82f38468ed7d3fc78027e7768953767fac7a5bc0503606f9e3786
MD5 6c957e1ada35fa02fd85cbec11ae2335
SHA1 abc2465e61460ffbab69a2e2817016f0cbddffc9
SHA512 e5465cb356ab328b9e4ea2db223b2954bed44d959f02408e7064775f110f200ca153b5439dc059d13f2add995fc3c818dfd3726e497ee292e0f351675e06d603
SSDEEP 192:aONn64BhQmiUyVXJ5GBPKlt+FdG8PohrGFC1SJriWw6qkU6:aONn6e/8JAdEh+CEJrAcU6
TLSH
T1A0123C35AC756C2B5EA2B541F48736139EE8413BEA857F40F6EC6B0C01EF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

029054f5-1c74-456f-bc4f-ffbd8fd83cae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\029054f5-1c74-456f-bc4f-ffbd8fd83cae.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e740c97c182d0a86ce327059b8f2ed4cbb95cf0688dca87d23924668291a58e
MD5 bcc6db479978227a67d3979c98acaeca
SHA1 727416c1cceebb16991a09dc4a5cfa17df386f26
SHA512 b92cd14dc51d399369b40913b5fb170d1362a1ea39b3fca1cee532447ea657fb783388f0913a18ee07ba0d8e7d90f7913cee121050519115bd4f1f366b0a700d
TLSH
T1B341299CBAEA1148B3B76E1AABF6A96E447EB9331F46D05D10110E4F0623A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download