hxxp://enilive[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/05/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://enilive.com
Sample260528-atdrtabz7q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3720_613735116\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3720_613735116\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3720_373003513\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3720_373003513\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244018387805475"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{1575EEBE-586B-4946-8477-555154817C92}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4684	3720	msedge.exe	84
PID 3720 wrote to memory of 5076	3720	msedge.exe	85
PID 3720 wrote to memory of 1912	3720	msedge.exe	86
PID 3720 wrote to memory of 1912	3720	msedge.exe	86
PID 3720 wrote to memory of 1912	3720	msedge.exe	86
PID 3720 wrote to memory of 4836	3720	msedge.exe	87
PID 3720 wrote to memory of 4836	3720	msedge.exe	87
PID 3720 wrote to memory of 3160	3720	msedge.exe	88
PID 3720 wrote to memory of 4936	3720	msedge.exe	89
PID 3720 wrote to memory of 3160	3720	msedge.exe	88
PID 3720 wrote to memory of 3160	3720	msedge.exe	88
PID 3720 wrote to memory of 4936	3720	msedge.exe	89
PID 3720 wrote to memory of 4936	3720	msedge.exe	89
PID 3720 wrote to memory of 4740	3720	msedge.exe	93
PID 3720 wrote to memory of 4740	3720	msedge.exe	93
PID 3720 wrote to memory of 4740	3720	msedge.exe	93
PID 3720 wrote to memory of 5168	3720	msedge.exe	101
PID 3720 wrote to memory of 6052	3720	msedge.exe	102
PID 3720 wrote to memory of 5168	3720	msedge.exe	101
PID 3720 wrote to memory of 6052	3720	msedge.exe	102
PID 3720 wrote to memory of 5200	3720	msedge.exe	104
PID 3720 wrote to memory of 5148	3720	msedge.exe	108
PID 3720 wrote to memory of 3640	3720	msedge.exe	109
PID 3720 wrote to memory of 4500	3720	msedge.exe	110
PID 3720 wrote to memory of 5092	3720	msedge.exe	111
PID 3720 wrote to memory of 5092	3720	msedge.exe	111
PID 3720 wrote to memory of 5964	3720	msedge.exe	113
PID 3720 wrote to memory of 5964	3720	msedge.exe	113
PID 3720 wrote to memory of 2064	3720	msedge.exe	114
PID 3720 wrote to memory of 4168	3720	msedge.exe	115
PID 3720 wrote to memory of 4168	3720	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://enilive.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffea17bc188,0x7ffea17bc194,0x7ffea17bc1a0
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,968589703286893682,15954362850080733473,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,7477266440329233130,12026655005548704526,262144 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15783997934892258242,3415881429359736786,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,18217257671817076500,5090024289162588935,2097152 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,4926082600624313746,14058892940882039410,2097152 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,781325094395216830,16363311318659135518,2097152 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,12093801574846786307,11721077094342723606,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,1063044507073014242,17185868310587199795,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2746083969345582344,15156741739626694758,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2746083969345582344,15156741739626694758,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,10136884629354668293,11078555181329138987,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,17192808109406223950,14925057318898116907,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9237747135034867756,11910007187954413547,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,3081293585374036945,6729939826832526411,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9859317998611247167,62028779378814157,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5960,i,2335966496983541720,7784120147027532144,262144 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,919833548036721982,10809642697838959307,524288 --field-trial-handle=2264,i,7548441529311224944,6825406792540268403,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5b32264c2bd65f083ce1bd6a0f3a9f7595ebaa50a34830a0141e358eac32bdc4
MD5 95b643c65a63d766bfccf53d01fd5473
SHA1 2285b92199da7008da70b13295255c24eab42d73
SHA512 63418bf7825e42a028a5c97068578ce171050f426723ec6c8f197e94a531203cffd962b20c8cbd926a2f0bcae73d782d5c6239af87d26852cea237030de3f30a
TLSH
T108F0F9BACD21AC2718FD0B5820940B06E75413672B40C55B7B3D430D4FB553B469685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59982cb4fe8aa611796ba90d7fed75ea56d68f2984d45198b7a017bcaa406304
MD5 5f99908f9fee1ebd96756fd1e49fd56e
SHA1 1768f3833430b6465679ba3c717f02ce9798d8fa
SHA512 2769532a6ef4345baa56c7d274501ad54b71234fa414239dd923e31d86af525aaf8e99c36fdcf56c2466f6625670eb3a53cdebca476d5d9cf457a3b92e0e9eba
TLSH
T1C541ADF7C3E8866D890196F0BA187E1FCE2D0914432C3D9AC9E4AF1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c8ad6d64f4d2a5e5575b726aaa9ab190484a56a851029b2e735cd1c26bc59299
MD5 1cfb4e2d35e5ac8ef486c9f03f07420c
SHA1 423485f2851d7a9336cca09b1ab6006298831eee
SHA512 4ea801dea816b4c379c9f0979864aadafcbc6e39b93430080a5b6bc0eed068d86e9961148e55e210cbadf26eade3184382e18fc05e65de609b34b0be5f2741bb
SSDEEP 192:sxZVcR3yMqZjK1Ml8Mk1/f3sDqcJ2CZtJpzodpJbHbXj6+WNIgaR/Yq/SOIg5yyS:sxZ28M1/f3s3J2EtJCBH0C/Lx0B
TLSH
T12D72E816AA38597B8CDBD219BA457B53D3F9556392904E449AFCCB0C04E7BEC321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8a575940e80e2915408f5421e7f90026cf76299aa90659aa8f0dfa121ebdd150
MD5 10d54c75e94506b3a8840ef5003fbe7f
SHA1 1ffabe23c0a1a6d9a18e718e89e5628abe719f1b
SHA512 4fd9e47ace429969c1881dd6bf9a720699c508662398db075582be2f23230d106532cc2b7fc0b782a1480efd86ef5a9ef08d68203cc01e7a9ac4678735045942
SSDEEP 192:sxZVER3yMqZjK1Ml8Mk1/f3smWqcJCCZtJpzodpJbHbXj6+WNIgaR/YqWQOIgly+:sxZKcM1/f3smQJCEtJCBH0C/4koB
TLSH
T15762D716AA38597BCCDBD209BA457F53D7F9556392804E449AFCCB0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e86dd3ddeeee4a8a61e5cedacdcc7fcdfe4745a5850073229b23ec0b7dd988ff
MD5 33d9db9c0cac8f99fb81d71cfeb020e4
SHA1 664bf616fe60cc6233bc420229f27011e81d19b7
SHA512 5d76ee063ad9456af4b2d3b2b77fb99b0a1487e21868515998cdca0981cad211cde94e1af72ef0ad308951d8762ed6faf1bbf368690887d8de0bc5d1518a2956
SSDEEP 192:sxZVcR3yMqZjK1Ml8UQ5k1/f3sDqcJ2CZtJpzodpJbHbXj6+WNIgaR/Yq/SOIg5e:sxZ28q61/f3s3J2EtJCBH0C/Lx0B
TLSH
T14772E816AA3889778CDBD219FA457B53D3F9556292904E449AFCCB0C04E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 54c0d2908abc4f801b85b15ee8bae010f11a8de4cdf1b0543cf08b176dc281b6
MD5 d3f15e771fa2b7ee6da101fd50f53aaa
SHA1 f4dd6abeb047243724c34e7af3a92d56c175d79c
SHA512 6443f2bae428fc28edca3e5f5ad2341b1f8b05c62bec17d256e37d400a9935c3cc50b0499d165622179a10cdbc90d95f7a2539e381fc4b0d6f7b1a148005194b
SSDEEP 768:+IM2tRw7pLuLnF5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyf1sLl2cNV9roF:+IM2tR8EnF5WvF32/u1jajf1sLUcV2lX
TLSH
T116F20B3B6C0CCB7A4F844E9CDD2A6E8A6DE8018FA6D8895487F9484C03C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 58061a4a9cc349cb54df01eec72ecad3fe82f75cf577656b95b59d5a67dadb25
MD5 030e886f21120279d2103889cd5cb583
SHA1 2cd61283eac8220e146014efcb5b76b73b8f69cf
SHA512 37eff76202ee84aef7a3723f0f7d28a9fc2eaee87396f194ce70f36588b6c69fa8a683d4f90ae3076a2328f0990b2f6f7a01a55c44a0f1d81675ea9fe3480a0b
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJS4:KrFjPXY9/gfrWThFLh/DNTVlff5y
TLSH
T18CB26E16303B12523CFD6808A7E6D6778E8231B33119E66F7BA804664E67E125DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6d58c34da2becb2dbfa551325a34e113ed45fc19b7c51b45b5ff2edcd33c31f0
MD5 d639ccd5fc7b8aff5939ca9593bcd442
SHA1 0eacc6ccac06c25955ebd9a9ddf026034cf08acc
SHA512 bd8db0853f9221bba20e560fa3d06f45d7f71ff8d547c160dc5847eaf60bb2730ccbeb3b4d6ab308310f37061e7e5c05629582d35bbb0f7eabe7d986c55f272c
SSDEEP 384:n4iF9CcmyWCs3sNZ8TUNTUlImkrn7fWm3miBf+UGCc1v2PHdF2e4KV8p0aLwty/o:DFccps3GwgZFGL1eF2I8p0aLa
TLSH
T1A9B24C36EC59CAA7FDE74F99B74A3A03EEE0116785CC9AE8DAD85D0D00971DD0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1b2a6efaebeb89a6e83c8059d3693ba60626d3a6babe6932f621a8b816894d12
MD5 6c7995eb36b8959cb7cb3b675582e5f5
SHA1 257f2df4adaaefc303b385b7b3d244866ec8c3c0
SHA512 1fb7c7950d088f4c0fb2fbdfe298822e9c685624cbd08af37e01e4ff789107b905a4af5a02ad85701bdcf158092d2ff534b5717e5ed3bd6cd5c33632d3b7537d
SSDEEP 384:n1iF1tNnNnb9w3sNg8TUNTUlI4kon7fWjwViBf+UGCc1v2PHf+j52BSTK3RlUVHB:8F1jZb23TwgSAGL1YM52BST+R2d6U
TLSH
T13FD24B32EC65DA6BFDE74F95B74E3A03EFE4026788885AD4DAD85E0D00C729D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0541717e22d27cd3ab1e7b741c7d0b564aa42dfaed0641c3ebe75d375cd6c2ee
MD5 bb94a3b2e3f5bdc705827a6a7892dfca
SHA1 a0eb94e50751c9ff45cc845a46d4143ecdd8628f
SHA512 f9773f700c0dc4d41c0af3c455e02311ee32bb4e38ea2c330a4b2461713cbe320da75a1050b21362ccbc9fe289e5ea9cc462f620a87767669c42fd58beec2173
SSDEEP 384:nziF1tNnNnb96T3sNg8TUNTUlI4kon7fWjwVAiHdfEBY0bCc1v2PHf+jN2BSTK3y:eF1jZbi3TwgS33IL1YMN2BST+R2d6U
TLSH
T1EAD24B32EC64C96BEDEB4E95B64F3A03EFF4026798C85AD4EAD85D0D01C729D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f5c85adc8116802871aba990b46b92d09ea570f4b90d92f0e3141b1d12864275
MD5 4bca8634c87ebff5b77d684731534bb1
SHA1 0f8f7e2e5cf9b301df7861abae09e6acee6ead74
SHA512 6a57d81072813540f14541b200753a606aad9e5c6b11d58c9d0633cf86604e7812e251662acfd1852922644142cb9388952cf2c0e18560adfe63ba743b3d976d
SSDEEP 384:nxiF9CcmyWCl3sNg8TUNTUlI4kqn7fWswViBf+UGCc1v2PHf+jv2GuRty/7Igl:YFccpl3TwgdAGL1YMv23G
TLSH
T1A4B22A36EC69CAABEDEB4F99B75A3A03DEE4016785CC9AD4DAD94D0C008719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3544bd5ad07500f6514ba7e83f7c6a803eb8cde4abe79187aa33ee7b11294ae9
MD5 a8f3f8b9d1606c40dcc786d5e1dc1486
SHA1 1f4cd30b3bbcf79f12573f1ce8a89bf01908f60d
SHA512 55331eeb6fe108b006ed2969e09a24fd11d73f9160f94cd69df9c20c14ca8ddfa3b99ae8aea448095cf0f919242ebd86c44973c44a5de00c5764434226d962db
TLSH
T1F53161E04C3C26D1D0BE0ABF308B34FC90E8C32AF4A8303D2858DA88063955E658043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1abaa9fe94a8bcf62fbfaf39f41f8632a696dc6f75ee9927cd31707f20fa0e6a
MD5 cf5215d00230d0c63cadb75a7ee617c1
SHA1 c9db762eaba63e782e2d88c6460c6bdc1a77ed68
SHA512 d376d54a4be32a15b59c87d676e27988e6242681bb58bf4a0e4eb74ea19e86120be487d4169f75a2d8aaf67a01ec4dab41dfe18659c2a57ce7794cdbacee477a
TLSH
T1113161E08C3C2AD0D4BE0EBF348B34FC81D8C32AF5A8313D6818EA98063910D658043F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c7a3350744e36bc03317693520a568bf525b2b239c2c043c2a719136af8cb625
MD5 26ef098754c48c88d8f7a269e9373518
SHA1 9675b556d8f3ba746321d7a7ded77b2ac211e16e
SHA512 ed38a6ce5b0dc088ae47a1b31e1fc3305a71c6e280bfa099a40fcbb0e5d207f4949112185e451ef361289818754c922f77d64c40fbb795dbcd2b2c351a01cc19
TLSH
T1D341FB58A6FD1148F3B67E1AABF6A46E483FB9772E46949E10110F4F4622E40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5200-190-0x000001A0E69F0000-0x000001A0E79F0000-memory.dmp

Download