hxxp://click[.]mail[.]salesforce[.]com/?qs=ABp7ImQiOjQ5NjQsInQiOjExMzQyLCJzIjo4fQAIAAAAAAAHHzvDmTi2SwZgLMj3II2t9Vg-S1UK7Gu2iYqjBwq4hDZ9rCKhO8CdIiRCiefdElHEgFejXTByJElu6esWnnNjfCjCxY_qBcnUSmwXUwU

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://click.mail.salesforce.com/?qs=ABp7ImQiOjQ5NjQsInQiOjExMzQyLCJzIjo4fQAIAAAAAAAHHzvDmTi2SwZgLMj3II2t9Vg-S1UK7Gu2iYqjBwq4hDZ9rCKhO8CdIiRCiefdElHEgFejXTByJElu6esWnnNjfCjCxY_qBcnUSmwXUwU
Sample260810-srx2saxtfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308489435341370"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{3265A7F5-4662-4395-941D-BDE5AB8FF437}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3464	4644	msedge.exe	86
PID 4644 wrote to memory of 1460	4644	msedge.exe	87
PID 4644 wrote to memory of 4540	4644	msedge.exe	88
PID 4644 wrote to memory of 4540	4644	msedge.exe	88
PID 4644 wrote to memory of 4540	4644	msedge.exe	88
PID 4644 wrote to memory of 1988	4644	msedge.exe	89
PID 4644 wrote to memory of 1988	4644	msedge.exe	89
PID 4644 wrote to memory of 2772	4644	msedge.exe	90
PID 4644 wrote to memory of 1272	4644	msedge.exe	91
PID 4644 wrote to memory of 2772	4644	msedge.exe	90
PID 4644 wrote to memory of 2772	4644	msedge.exe	90
PID 4644 wrote to memory of 1272	4644	msedge.exe	91
PID 4644 wrote to memory of 1272	4644	msedge.exe	91
PID 4644 wrote to memory of 4692	4644	msedge.exe	92
PID 4644 wrote to memory of 1348	4644	msedge.exe	93
PID 4644 wrote to memory of 4692	4644	msedge.exe	92
PID 4644 wrote to memory of 4692	4644	msedge.exe	92
PID 4644 wrote to memory of 1348	4644	msedge.exe	93
PID 4644 wrote to memory of 1348	4644	msedge.exe	93
PID 4644 wrote to memory of 2348	4644	msedge.exe	98
PID 4644 wrote to memory of 2348	4644	msedge.exe	98
PID 4644 wrote to memory of 2348	4644	msedge.exe	98
PID 4644 wrote to memory of 2080	4644	msedge.exe	99
PID 4644 wrote to memory of 2080	4644	msedge.exe	99
PID 4644 wrote to memory of 2632	4644	msedge.exe	100
PID 4644 wrote to memory of 2632	4644	msedge.exe	100
PID 4644 wrote to memory of 3372	4644	msedge.exe	101
PID 4644 wrote to memory of 3372	4644	msedge.exe	101
PID 4644 wrote to memory of 3788	4644	msedge.exe	103
PID 4644 wrote to memory of 816	4644	msedge.exe	108
PID 4644 wrote to memory of 1536	4644	msedge.exe	109
PID 4644 wrote to memory of 1612	4644	msedge.exe	110
PID 4644 wrote to memory of 4572	4644	msedge.exe	111
PID 4644 wrote to memory of 4572	4644	msedge.exe	111
PID 4644 wrote to memory of 1508	4644	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://click.mail.salesforce.com/?qs=ABp7ImQiOjQ5NjQsInQiOjExMzQyLCJzIjo4fQAIAAAAAAAHHzvDmTi2SwZgLMj3II2t9Vg-S1UK7Gu2iYqjBwq4hDZ9rCKhO8CdIiRCiefdElHEgFejXTByJElu6esWnnNjfCjCxY_qBcnUSmwXUwU
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,4772971300786307348,10751074011357840253,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17144995812725239723,11521015686858947082,262144 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,7692734993579896353,14476017542011679301,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15385978974481924239,7108913682983254960,2097152 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2074633022404697182,11791845994426573400,2097152 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,13396220817160034081,11255294581118832937,2097152 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,18241745168642572314,192400617018923095,2097152 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,123606896894997887,15388313649004092245,2097152 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,13454615864743997326,6218598302750692548,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,15754263363318564048,7194670413958897682,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14569158526490015151,4338066268183402788,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4813105544289169730,11887395330450406373,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4813105544289169730,11887395330450406373,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,10144418912237787771,8600564844416629830,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,4360656467757259291,5644655092664287462,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,6638120162099802878,10414211654251004900,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10287905069209927860,16922632866252768626,524288 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6432,i,4649966919263816758,1932472500391525524,262144 --field-trial-handle=2256,i,6252677072240557212,8641621362930120173,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37e38d86c0c5760c225958417ea38e7821db94252321ccd62db130d6cc825299
MD5 10edf78336c348ebc0880229750b98ba
SHA1 83a04cd9cc69304ec8e472250cf9be2b9f7ce3a8
SHA512 531fd46ed197cb214d5107db118476d9bfe640a826adf5883ac9c1a091254dab03a8b4fdb30c2695aab7119895370c4a9101056d61722997a0d065bcfd6af85c
TLSH
T13F81B33189930128EB670732EBE2C81A7272C6DAF63F5DED11D8587D4D0B3F18159A27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e3b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e3b4.TMP
Size 3KB
SHA256 6a0846bc357a6ef214a67a25677aea341a102e88d47be3638d38524b0a57085b
MD5 c8e06ab655d7bf2c5e2660ee018f19f9
SHA1 517a08fbeafd4f0c639400f608d4c421aefe4af9
SHA512 e45d1907e6b05c3f01ae9bdf75c88d00468962b0080362bfbc6f43e75e52ed7024d1637259799068a5973bcd027834830e7cab2c83b94444f4a7c546e96fd17e
TLSH
T1207193350A534268E7570332EBD2C51A727186EAFA3F5DED24D0587C4D0B3F1815A567
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e77297836bcf1435e0309ece5fdd7fc7bbfd5f86b500d9a4379133ff00e7a61e
MD5 daa9c00c67e0e3c3e21329104251d19d
SHA1 e189091309be834a76d6127e9f46541bd55048ef
SHA512 1663801316f89d9988f15ae6b15ece8c381c8569149c09c0aed03600cbcfdc0dfb69bc7d245b19c9faa071f26b5c84b0a6615581c63a8f4fa0800ded244e111d
TLSH
T1D7517CF7C3E4866DDC2256F0AA156E2ACE1E0915931C3D1EC9D5AF6BA3E2030E101E4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fdd5ad5d8a7c7ea4f7f2976f13d0c6ba0fe8cb5f2d9844fe132fc1bb3faf7f50
MD5 eabbaee0787d292c21942e2dc94ab440
SHA1 774bfd6ec460f722b4fcaedef8f1696c33a18b72
SHA512 7f26c2a693eb3b2bebfe15ae7191b15e6b5b5391e5e198fdf0f2ec2e50c98796456a3f6e2305a32c84950f2cea1fb72df58022eeb836d36fbdf60ddbebfac329
SSDEEP 192:sxZBRMyM/jK1Ml8MkZ/fFs8hYaYIdp5w1FQ/W6+WN062/YzSUHUIgrJ:sxZBSMZ/fFs8OMiobU/l9
TLSH
T12952E8026B3899B7CCDBD219F941BB53D6F9047392910E94AAFCD91C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a2eef0f32daf8c80643d808511b8953dc82213ca84bc4cf6aa16e1f8dc2fb912
MD5 48372a1f213f5e15c85665cfc7bc9d55
SHA1 bdeae554137fb6d68d21822b6de36b78cf8fcd91
SHA512 fdb581f18f41b18a3a75c29ed9f4f31cf9651d952626f6196753523c57d90845c7dfa4c537d0235b5e46311733b2e746cc06b07ee9bcd65056d35cb964fc4d6e
SSDEEP 192:sxZBRMyM/jK1Ml8UQckZ/fFs8TYaYIdpfw1FQ/W6+WN062/Yz23HUIg5ZJ:sxZBaqnZ/fFs8MMEobU/Qx
TLSH
T12252E8166A3859B7CCDBD219F941BB53E6F8047392950E94AAFCDA1C00F6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a7a32de66f6dcaa8d8d126277bed1912fe8a4c4ef261547ac8ef583d6652b7fa
MD5 789a9be6e632a02b7adcb6d9dbe0821d
SHA1 e62a56be273b911fce3d66ddd8ac775e0e79d98d
SHA512 c7906a8c5e162257e51ae1f4eb9a415cbbf2c3a0e4d0fac22c476610ee3b99e839d82bfa19d94a27d43d6e57658e0a82bbea50244db6ce5e83b1d765f8754aa0
SSDEEP 192:sxZBRMyM/jK1Ml8MkZ/fFs8TYaYIdp5w1FQ/W6+WN062/YzCUHUIg5ZJ:sxZBaMZ/fFs8MMiobU/px
TLSH
T12152E8126A3859B7CCDBD218F941BB53E6F8047392950E94AAFCDA1C00E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 48ca756c5e868dfaab588ad46367fbe88d81264703db5377c1096e1a4829b4e8
MD5 b3b4c583780ec034bc682e06d2a90a2a
SHA1 118ed04d9bb001c7aa7e8a8e1c35f819e8107f3d
SHA512 7d8bf8242eac9d1a9f17831b8e7d50c4c34e905f8f4e1871efd5e7b65fcb3dbfc97f747ad5ac33ca37cf1b1e3fb616435e1ec871b958b69b983e5b20cce2532a
SSDEEP 768:FkW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjqroIeicYj:FkW7kf0Wvqidau1jaa5LA3jB8j
TLSH
T1A4D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5447FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1f4af16d0bd885bb9d34c83a0c7c9f82dc905c2bf681aac414cc7cd1468e2687
MD5 e615a2aad43d2cb13ae0d77be43fd1ed
SHA1 06443bbfa835dbb896b6b7e23888bbc2bb20b2c8
SHA512 04e842c52a1ecf187c0ef022bbbf47d5f8043aaaf13ad2ead62cb54c20602a9140707a53e06386b33a436cf214555db148f5d1eda9012856ba29dd6e3058dd15
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbEIfKFmc3yZ8ILK9KcVhIVKqq:KIbCKcbEQKFmeK8gK9KWhGKqq
TLSH
T155918886753B16013CBE6C48A355D6364E4235A338ACACAF7FB940621D66F124EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595922.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595922.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 83e02fd7f0d4d36607e7640a6598ca354a2ac842b0dc37dc21af17cd3708b47b
MD5 a1e0fb039ebbe053ece8c0b269618c6f
SHA1 cc714deb390c56be0c9c6979870ca2d6247a0a2c
SHA512 220160734f11fa1a1f22e8ebb28a582197f519eb3556fb7e37e8d651443b2e82633bfbb25961b1cf4876cd06af8d00b17e9d21a4e609eac35845a694bb0fc23b
SSDEEP 384:AZcIhsN5j9qbdg3PdlhCEJrx0L6HlytEDq17:+h3if7hxYoy6Dql
TLSH
T181928E3058B459376AABA145F8873B139EF88037E7D46ED4F2EDEB2C01DA6A41307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0670104da065e9200e43b75ee05a087719ca97dcab46c8c14cbf2531babad394
MD5 24c6016f162fcd1cc77a4b59589605cb
SHA1 db80c4067690824962aca5edb5742c8de6a3dd80
SHA512 d95f79e5341b4177e53f9c5062400ecdead9c4806c8d0acebf190ece233d9344a67a9a10958396cd1dc358ac8643839ef3f3dc669592fa7e989e387d18d390ac
SSDEEP 192:MONB64BAQmiUys1TW5GBPKDv+FdGEIaDurU6:MONB6eAjtWAdlxgU6
TLSH
T1A302E938AC797C7B9EA2AE45F48637175FD8113BEAD51F44E6E85B1C009764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 12c670a42bc93f4e0fb654cefebfc8a3ce2b7de533831322088658ddae4f498b
MD5 110f09213ac5f097677c5c46137e120c
SHA1 67e683583e541c97c4aa3077363aca38e52c4abd
SHA512 f5a1e68ef6b87026e18e72dd2bf8207cc02c2b5a09c88889095f5ecdcbf7c0c964c15d9e45382d37ee03c3a92e90463d907e9a9c5a87b919ae01b3809c841501
SSDEEP 384:yZcIhsN5u9qbdg3PdlhCEJrx0L6HlytEDq17:Ahqif7hxYoy6Dql
TLSH
T1A3928E3058B459376AABB145F8473B139EF88037E7D56ED4F2EDEB2C01DA6A41307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 373d890576ef1cf6642a2ff65f7c8d0d64fecd7cafe8b600b5e51e76d91e328d
MD5 e467439a02f316b745eeb4a800f8cb9b
SHA1 3fe879dca294c686151c2be1ef89345c9013f393
SHA512 19d0007b2fc52824f6ae16e7f84dfa76565b284487e676b29df8182dd625fbe6f0cf33bb1576c53e4c81a7228172fbddeee326a256f6d6b5d5b8c01d70c568af
SSDEEP 384:0iFiZcIEzsNb8TUNTUlIlu9qbdv3PdlhCEJrg0L6HlytEDq17:PFQ4Gwg59f7hgYoy6Dql
TLSH
T107D229F148E74537E9AE9703E77D2E028EBCC067B5946994B3D89A1CCC961BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f10a91c0265bd6791c1d5ce458f53faed9eab66ee4c530b80a6de32d09c24bac
MD5 785ec87f933b2147e866b009ee8503ca
SHA1 07190370b9e37887a1eb691a4a25b502e197e390
SHA512 6b1b9da72c910e9cbd910c2103a55ee56a01bb066364d9aa5918d267039560cb2a809c27260f94faced77b16eb403c891ad339af8e7c54a54b40c92fbf2d30cf
SSDEEP 192:+ONE64BZQmiUy7TF5GBPKDv+FdGE1VFC1SJrvWwUqeLU6:+ONE6e3qFAdlhCEJrb0LU6
TLSH
T1D4120B355CA8AC6B5E92A151F48737139EE8413BEAC96F90F6EC6B1C01EF75C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41c2191b-2d6a-4a95-a5b8-7dce6355f7d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41c2191b-2d6a-4a95-a5b8-7dce6355f7d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c3f86131d083f492913384edb0621e7a5c276feabda4f89315cd46a183a020c0
MD5 4dc3d7c98f39565fb1fb5ff4b44abbd8
SHA1 5dfaa6e1a8ab97a3b481a9aeab99001a327e8c31
SHA512 76e425108d80753d260ca2ebf6adce05c63c1e958c74387731398575a7f2bd9c0d1956bec95a656aecc94e40588f24058f490184970037bdb70184feb8020135
TLSH
T14B411798B6F91148B3736F5A9BF7A46E487A7C372E06C49D10110E4F0767A41C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download