hxxps://www[.]signonlinepro[.]com/?utm_source=cal

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.signonlinepro.com/?utm_source=cal
Sample260801-q94aeabe69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300663266680082"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{526D9E9E-13C5-4EF6-9A0B-54E2A57A89A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4680	1036	msedge.exe	85
PID 1036 wrote to memory of 2732	1036	msedge.exe	86
PID 1036 wrote to memory of 4316	1036	msedge.exe	87
PID 1036 wrote to memory of 4316	1036	msedge.exe	87
PID 1036 wrote to memory of 4316	1036	msedge.exe	87
PID 1036 wrote to memory of 3540	1036	msedge.exe	89
PID 1036 wrote to memory of 3540	1036	msedge.exe	89
PID 1036 wrote to memory of 1076	1036	msedge.exe	90
PID 1036 wrote to memory of 2236	1036	msedge.exe	91
PID 1036 wrote to memory of 1076	1036	msedge.exe	90
PID 1036 wrote to memory of 1076	1036	msedge.exe	90
PID 1036 wrote to memory of 2236	1036	msedge.exe	91
PID 1036 wrote to memory of 2236	1036	msedge.exe	91
PID 1036 wrote to memory of 2004	1036	msedge.exe	92
PID 1036 wrote to memory of 2252	1036	msedge.exe	93
PID 1036 wrote to memory of 2004	1036	msedge.exe	92
PID 1036 wrote to memory of 2004	1036	msedge.exe	92
PID 1036 wrote to memory of 2252	1036	msedge.exe	93
PID 1036 wrote to memory of 2252	1036	msedge.exe	93
PID 1036 wrote to memory of 4708	1036	msedge.exe	97
PID 1036 wrote to memory of 4708	1036	msedge.exe	97
PID 1036 wrote to memory of 3536	1036	msedge.exe	98
PID 1036 wrote to memory of 3536	1036	msedge.exe	98
PID 1036 wrote to memory of 3720	1036	msedge.exe	101
PID 1036 wrote to memory of 3732	1036	msedge.exe	104
PID 1036 wrote to memory of 4056	1036	msedge.exe	105
PID 1036 wrote to memory of 4616	1036	msedge.exe	106
PID 1036 wrote to memory of 2292	1036	msedge.exe	107
PID 1036 wrote to memory of 2292	1036	msedge.exe	107
PID 1036 wrote to memory of 2420	1036	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.signonlinepro.com/?utm_source=cal
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17469494653129826760,9290541934145721950,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7989266292614583420,12427328414303709528,262144 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,10451983635380310075,12755999364802956714,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6753424496517586036,2261535197378228563,2097152 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2685865062503232346,14228431672870362657,2097152 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10839643154423091242,5130076167395005320,2097152 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,11169096836576342254,7908339311586675516,2097152 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,10517958775496718481,8013774116170357681,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,10727913439575764318,15847212365781369998,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4971744331623854635,6505235955867803891,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4971744331623854635,6505235955867803891,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7699380339614729877,7808669998939676846,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5802996599743851549,16693795322015430818,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,8644923292329638661,17152113298836692638,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13540625880462344279,16226363538146146449,524288 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5532,i,14686025021051000812,17039949164066156038,262144 --field-trial-handle=2276,i,7581526980064192815,3569577795325704966,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ba999090b355130a275670d87c42e217152b2f8ff9644d62a8689f90b0a37f6
MD5 d99b4dee1d6b9e06bd6f5f1056f352f1
SHA1 202ac705f379dc91abe3d15b567ed8893851bb48
SHA512 5543329104b3d93790af121b6f4a9e7296295be7120b18476fd20112194cc21037ca78d23a1437ff5065c49167a043a67c8f60565490e4558f7bb8dab487110c
TLSH
T1DB71070C0012CCD1E3E256F1C0F2F245B8B0B26F3B779AA12274C5BC6619F72676AC0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d116.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d116.TMP
Size 3KB
SHA256 2042ae147f8032d453e025c5bf59a412dc54943b9a7731da83b37c50ec290008
MD5 ace9f7173d3fce78b39dd25d416a9f8d
SHA1 ca715654beaf7d6e97e930768b4e107c7225f93c
SHA512 8d9ca54535331dd9af9cd4485021b63bdd21c2cd8552cbfd6a1de688b30adf7b45c64fae2f28ed338df66be6f4348f982e00f44ec39a233580e8350da4d97e14
TLSH
T1F171270C0112CCD1E3E256F1C0F2F245B4B4B2AF3B779AA12274C5BC6519F7267A9C0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fc69879ef0abcfeb6baa037c50eae8994e844ea534151d7f21e51d581292f2a9
MD5 6fc1d192da7747b464e6fc3acfcf5c97
SHA1 5f3ae5f14de2412b85b6f4517512435566f353d7
SHA512 1028d4ef27ae3080eefd4731abfb364914ace5e1022a2fd0503fdc846d2fc38419d9798cec223903e524e5c90d9e1c3dd829186ef106acddf134e31c97f72198
TLSH
T12C719EB3C2E4875DCD4256F0D6186E17CE2D096443A93C59C9E8EF4FA3F16B1D24264D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 72a23b9c9fcc8af985c411f94f7486ea845189d44d7d5481d1cacee54a57df11
MD5 86d82450c751efa279c6d32c99c765cc
SHA1 6c75f413164b5f1d3e5a9c190958a54562372d37
SHA512 74a9b757768a2457d5bdca73600535a9308ed22fd5b4bb02f9e84edd106ba304c1ed7e5a707fbee1b27687ae4c8b0976d58f1d449d6541de0301c9862d122c81
SSDEEP 192:sxZtRrFyM/jK1Ml8Mk2/fKsl16IdpBKHW6+WNffU/YL6NGmpAIgrJ:sxZtHM2/fKsl1TYHb0/Tp89
TLSH
T10B52E7116A34A977CCDBD209BA55BF53E6F90472A2900E54A9FC9A1C00E6BED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 88a13e5769d1145fa7c58d03c165613dfd0e04eda5a292feaceea1dadf29086e
MD5 c69b7f132498346bd1fba1fff9e2e31c
SHA1 7db2e279496a65ae851b78f56deab63f6ac67580
SHA512 158d9f958474ab93d5ae844f7b90eed1842a756e4359bc159cf5ecc9acc48f683cc870b1bc2f48fee375b264d3d2ca3efbc61b99402e80c01b3aff9b354661d7
SSDEEP 192:sxZtRrFyM/jK1Ml8UQvk2/fKs/F6IdprKHW6+WNffU/YLkUnmpAIg5tJ:sxZtHqc2/fKs/FTmHb0/Pp85
TLSH
T17452D7116A34AD77CCDBD209BA55BF93E6F9047291900E54A9FCDA1C00E6AED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3b2b646b5e5bce882a6af587f94773212146c880361f808c2bfa8cc5d6c0be5a
MD5 22e716afd9be19efd80cb618dd5b8f8a
SHA1 7ba2ea57c54de362e869bdf96a19d0b428114b5e
SHA512 416cbec3e5afbdbfc31dbcf55dea3c5c1a749c1bb3f8fc30a93d73ef597a178c3162afcaea2384376480c2e6094fa8fc6c13a55ee97848d4fae72fa9697b9eba
SSDEEP 768:iYs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN/ro1V1:iYs6pD1WvxzWju1jahILIsNs1V1
TLSH
T1DFD2FA3B680CCB7E4F840E5CEC2A6F967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 458cd7bddf225b4729b08dd47518bceb9d39930f75363576db90f7f394522198
MD5 4e6d3cdf15b806918da376687d8d8379
SHA1 0928f3adf57b2b464c5deef6550bb7fd39a20a6d
SHA512 e907b1041520bbe2d8e251de3859665c34e4d7906efe18d4fde3825fed0cbf6e05e620d0eee389b1798a6efdf4e35a580f0d3492f48282009f7bd639c4de8aa2
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCki:ii9J3aJx7
TLSH
T1D9E1E11232BB02523D3E691C935987676F427AA33418E42B3BAC10761E66E344DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5968c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5968c2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7ab0b58e767322eef12afe92613b9b68945e1d15c98695fa9366f4e29ea14e44
MD5 21fe68f01501bbc545c5d2ec6f4a9372
SHA1 d8816b9a7e95204822a3f641d94178b24a7eb3a4
SHA512 2c146d6626ced1f802601a874b7f239c813104f56f4d503fdc697ca685ad7da0b819ad4713023f9b51717b046eac1bac17854a497bb281a0a6c26dc21772d58c
SSDEEP 192:YLsN7bQ7anOKj7+3vEaQmiU1Zc/+B4atb0h+FdPoYRh2viRLMbrqmqLqygR:esN7bxIHbC+ua9ndQcMKGmXgR
TLSH
T1F8424B356C78AC775DE3A142F55736039FF84067DA8A3E94D6ED9B0D00DB29C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a9d088946d157661bf1e27905844d1a95eef3c151efc897fb414052d37e2a5b
MD5 547749c86d67adc94a6be2dc6050f05d
SHA1 4acb4ebb1edf31f4c5b8e233c0397bb977c81b6e
SHA512 3d87ece35dd3db01a8a2709ae9df5728087005b9142010a11e48b3f7c3803605d4bbd4ace73dd2c383c6b2a4255ee00306769632eaec615e15cd2a3dd8d1c127
SSDEEP 192:qONa6O7+3hQmiUyJLGttb0h+FdPougGsCU6:qONa61eGt9ndQwPU6
TLSH
T17C02C8356C686CB78EF2AD46F5872A175FA8117BE9962F40D6F85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff5d102d2ff71a1d784c8653f5e5e708ecc89eb6c9713fd090d3c2db76ea2489
MD5 2605ba381172bdf6388b91fcbf3be93c
SHA1 4091e16ab0fe440cac356972fe8754faedacafe1
SHA512 c342b9d80561fe9fdc2fd89cf2841932acf2f46987aee481ed419b2057ca76da279a7fbe2f3c48a417bd5f3694a3992faf3cf9f570c312558bd56cdc7642607b
SSDEEP 192:2ONm6O7+3BQmiUyvbLRttb0h+FdPoYRh2viYcNbrqmqU6:2ONm6dcnRt9ndQcMKJmU6
TLSH
T1DA1209356868BC675EE3A545F58735178FE84127DE8A3F90D6EC5E0C00EF6AC234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5c6ae872ec2c3547b424c0b96b936a634ff27b64edc532661bd4fbcb4d0de9db
MD5 6729f9506e65ecf2de479ccef0708ede
SHA1 c694f1f769bf2c46e0c5b5bbcf2655c938d5ad33
SHA512 c9dcfb8a253e728154803c156036a22fcbc67ab59b3739903731da1630229f010b416413167759237d26d9d279131fd4efafabde3f276653a854bbb94fab48dd
SSDEEP 192:OLsN7CQ7anOKj7+3vEaQmiU1Zc/+B4atb0h+FdPoYRh2viRLMbrqmqLqygR:EsN7CxIHbC+ua9ndQcMKGmXgR
TLSH
T1FF424B356C38AC775DE3A142F5573A039FF84067DA8A3E94D6EC9B0D00DB69C230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 64f12c7743c49f87eb24bb9436b573fbed00c56e260b5207d946d38aec188bd1
MD5 b6e4a469b5fcc43465fdf40c1bf32988
SHA1 cc0ae281beac7dc50f4adc8e3b988e8dca8516e7
SHA512 5b40e46f8a3634504e79829ae712d8a9877265c1a584e2ce5fce8a5f3e9dcc83baf9dadf7f7bd35bce002e8035b85a4376d178119761130abd68816b3170f1a9
SSDEEP 384:hZcIhsN72xIHbC+ua9ndQcMKGmnTKwBODNZOCxKDt:ph1mRG3mnewBKZOum
TLSH
T199927C706C386C775EE2E145F94735078FF88077EAC92E54D6EDAB1D00EA6982307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a1dc999ab6468551e8f0f99ae0738dad6227d7f7993fcae58836578cf282f2e4
MD5 b7d7bf199580903c4ca700b6a6c35905
SHA1 bd09d64f804f4f64c286ed629912167387bc4d37
SHA512 5fdd12c0e4f1b59d8c398f9824fa9587bd053f572b5727a45eaf4c9b289c4d1e6605ecd54ed0093e3123c741761352ba58ee713a3f4f8578ed39cf26192d36b3
SSDEEP 384:tiFiZcItzsNF8TUNTUlIl2xIHbq+ua9ndQcMKRmnTKwBODNZOCxKDt:kFQVYwgimRG+mnewBKZOum
TLSH
T18FD229F148EB9836DEAE9743A77E2D078EBCC063F4856950B3985A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e695a65-6b80-4253-ae12-60454b55d298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2e695a65-6b80-4253-ae12-60454b55d298.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 097c5d04bf5d698af08d6211d828278270be0cfd97947f105031830bf9f09374
MD5 9aa22f35ea373f59fce459ccb7c92846
SHA1 4d26b11b9e0362470aa00c686873e94f99c6f274
SHA512 4825dc0aa5a88c219357617f78616d15271389e0368890d3921044ef1ac2673f1fdf02c29e57c1cdd8f3eccb267958e54c2724a2296f68d44f171498cf3406ed
TLSH
T166412B58B6E91148B3B36F5A9BF6A85E487EB9773F0AD45D10010E4F0A62F40C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download