3d9978d34937bd7828fcdb5825e7368de1d0eddc4da8847f3505c6c3ad27b374

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpalCraftSMP-CurseForge/modlist.html
Size 454B
Sample260908-pkgvfabj7t
SHA256 3d9978d34937bd7828fcdb5825e7368de1d0eddc4da8847f3505c6c3ad27b374
MD5 47f9e6b4fbaacb2b54913f5564032781
SHA1 bfeb28b23cb440f8ac3070d3e194a5e0dd5aebbb
SHA512 2e41aafd1c0ac1abed0a8094e6680d00a6fba785b2508d4fa81c61f137e47775702694308dbeb8dbc7f23ecefa1dad4bfa5033108dba5ddb8e37a9d71df3418c
TLSH
T1BBF082B7DD6F7812672D927CD021760DE02391B78A0D8DF7A5B308437F80182081587A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333438019476910"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{AC5664C2-09F7-460E-BEBD-08438F41634B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3220	4552	msedge.exe	83
PID 4552 wrote to memory of 2708	4552	msedge.exe	84
PID 4552 wrote to memory of 3956	4552	msedge.exe	85
PID 4552 wrote to memory of 3956	4552	msedge.exe	85
PID 4552 wrote to memory of 3956	4552	msedge.exe	85
PID 4552 wrote to memory of 1180	4552	msedge.exe	86
PID 4552 wrote to memory of 1180	4552	msedge.exe	86
PID 4552 wrote to memory of 3496	4552	msedge.exe	87
PID 4552 wrote to memory of 4912	4552	msedge.exe	88
PID 4552 wrote to memory of 3496	4552	msedge.exe	87
PID 4552 wrote to memory of 3496	4552	msedge.exe	87
PID 4552 wrote to memory of 4912	4552	msedge.exe	88
PID 4552 wrote to memory of 4912	4552	msedge.exe	88
PID 4552 wrote to memory of 2880	4552	msedge.exe	90
PID 4552 wrote to memory of 3696	4552	msedge.exe	91
PID 4552 wrote to memory of 2880	4552	msedge.exe	90
PID 4552 wrote to memory of 2880	4552	msedge.exe	90
PID 4552 wrote to memory of 3696	4552	msedge.exe	91
PID 4552 wrote to memory of 3696	4552	msedge.exe	91
PID 4552 wrote to memory of 3612	4552	msedge.exe	96
PID 4552 wrote to memory of 1876	4552	msedge.exe	97
PID 4552 wrote to memory of 3612	4552	msedge.exe	96
PID 4552 wrote to memory of 1876	4552	msedge.exe	97
PID 4552 wrote to memory of 3976	4552	msedge.exe	99
PID 4552 wrote to memory of 1204	4552	msedge.exe	105
PID 4552 wrote to memory of 1804	4552	msedge.exe	106
PID 4552 wrote to memory of 3520	4552	msedge.exe	107
PID 4552 wrote to memory of 2316	4552	msedge.exe	108
PID 4552 wrote to memory of 2316	4552	msedge.exe	108
PID 4552 wrote to memory of 1300	4552	msedge.exe	109
PID 4552 wrote to memory of 1300	4552	msedge.exe	109
PID 4552 wrote to memory of 4736	4552	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OpalCraftSMP-CurseForge\modlist.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,12165301367899574680,9402914203037116016,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12343514823680578240,7912041934438271270,262144 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,1224887350618035181,13737511697341677662,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1073501918870736045,3451842901500234684,2097152 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,17196387079439779693,12680878519040849844,2097152 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13640884212800468259,12077052877468128885,2097152 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,17844578477973959852,18175357168198225293,2097152 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3763109047288058778,16874825358705153271,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,13140724182105157637,10997607264509399702,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13004210032760009509,13316390426025707538,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13004210032760009509,13316390426025707538,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,12847442801377172500,5967114682893124447,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,12777207598029623849,2939620290931281393,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,510160585366961643,2723776494037229035,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,17279952866139239626,9190686916279666631,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,105748384533313731,16978818383892840948,524288 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5524,i,13735985292995146385,10447148438297867031,262144 --field-trial-handle=2328,i,5322702511337356365,1077155191882362123,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6a1e020cf78ce834a01b7cae8f3c091390e7c8e8d7659181e78ced3f5607f1a3
MD5 3508858483be54c1dbb991e0b51ace20
SHA1 6d6c7148bc41f1a59258cd9e7775c415e6f8ca1a
SHA512 6edb57f2d94221fd942e7814e871d697b995c28d713ba722c5ebf5697f8d606db8ad71af0e17955a4f15ea3261f93ef66beeedf7cf196ed1bb875e4d84faceb0
TLSH
T1F3716E7803010062EBF01171B7E221DAB575A8ECFE679D89302C84F96AB836DD81DD6F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a1b1fa3a-bd28-41e2-b5b5-8b5788391a41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1b1fa3a-bd28-41e2-b5b5-8b5788391a41.tmp
Size 949B
SHA256 422187044b1418a3b7c25ba46c5f47cda2725f3f6d09f2b17427b4f360a7d0d7
MD5 62addc109d5a802391d44287b795367c
SHA1 376a4f648143987c4987dab17830b31e0ca156a6
SHA512 4365dabb196248677cf1ccbf841325224cae6c67985903d4b336957ecac28e964487cd44b6bfd4ae698974313f55c7ffe10c13e62ccb21de9b89aee85b3befb6
TLSH
T196113DF3C7D585AE891116F06A24EE6BCE2D0606822C7C1989D4FF6BD3E3479D10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8b7b784667b01944dc550d35c75a3a7ba6c2114464b4b20c1af4b8f8a4914540
MD5 d87e18620878ce355d072affddcd213a
SHA1 61bef0d5aee4ec1afe918147460b20ff71ff828d
SHA512 983bdd8e850d928c446b33ff664fc0457b014066643384905c7c58ac07c3211c6fd521320cad539a9cfc9acc5b8ccc02e41159319c2950d567fe87098e56a5ad
SSDEEP 192:sxZxRekq/f8su5zdtrVAIdpdbHW6+WNGYvrmmWg/IgrJ:sxZxvq/f8sSzdtj1HbGGWK9
TLSH
T10F22C7126E28A47B8CC7D31DBB15BF53E6F9503261951E58AAFC862C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 196bb871adde8fdb3906f7cf2f72914bbae6100f022a7bb7e5a904ec33d0dcd2
MD5 80590f8ac502457f8849e5e6113d3745
SHA1 ef7bcea6db43ad332ae8a50853a1d0345e0724ef
SHA512 76a78e71188be9f8e87392f16b8da0f87513745615523d6e830ab5300e18d7237c12b473677157524285bdbc6e025241f9c9275ca568d106c1eeb52e05c1ae73
SSDEEP 192:sxZxRekq/f8s+5zdtrVAIdpdbHW6+WNGYvrmmWg/Ig5sJ:sxZxvq/f8sizdtj1HbGGWK2
TLSH
T13622D8126E28A47B8CC7D31DBB15BF53E6F9603161951E58AAFC862C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2276df0071e5ad0df48bd0d2561c4897cdd0dd0e016dc889a2727b18d089c794
MD5 97b10a5774b52f19bea33870e6ac49a0
SHA1 02c87d45abb0153b07b0e559a2d4026269cb0799
SHA512 3d0a338c863ef57824ab7cd4fa8468ad2feaaf3454ee30604d618d9b2e023b7b8b1c76dbf7ce707b119f835704aa8cd37607472f3532e884fc2058626f7a8a30
SSDEEP 192:sxZxRekq/f8s+5zztrVAIdpdbHW6+WNGYvgymWg/Ig5eJ:sxZxvq/f8sizztj1HbGbWK0
TLSH
T11722C8126E28A4778CC7D359BB15BF53E6F9603261951E58A6FCC62C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cc9ede0aaa7b5e59b6ef535c37a6d0ed3368a9d567d15d7027c9c5a7735008a6
MD5 7632f1f1ffe8ae4e418857e22997373f
SHA1 6eb8962156c42a7a2c025cbd729e48f59093b90a
SHA512 b5af7c984a927c389e5f820f2a4a793472faaa29d5453a0e9d6cb191f77c72699394651c2d9b291a6003278d2ab725e795618d4141de45cb245c19bb37402f0d
SSDEEP 768:Ijee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbProW:Ijee3rxWvhffnu1jatcL88bcW
TLSH
T1F5C2FA2B640CCB7E5F800EADDC5A6FD76FA802C7A7548D4087F9994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 50911f03367121957e8b2b1b5116ba337e1b7d79d251363f96585f53d7d42d39
MD5 ff7d6f70198a9ce94c9ea6d3a003b123
SHA1 512a29f6c23a735af33e4d5ce8c8b2054e3e2ecd
SHA512 4f75baae6efbc02c76bb05594699458a4e19c449393d63e021e160b2fea9c8a8375765e20f3053d7826318ec79e43674617c8edefb7e129adc0fffc058caee91
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Eh:KYHIhKggkXyh+IHKnKIXyxmIHKbaMPz
TLSH
T145915616367B06423C7E2548B6A696374F4133A73458E8AF7FB850A10E26E212DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb78bd14-29c7-4227-9924-2bb85028c16d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cb78bd14-29c7-4227-9924-2bb85028c16d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 0db202d1376b8990efbb7a72f1ed9fa9e97e0ea5c27465adeb1fecab9ce6ee28
MD5 4d81cd08f193a1a1061a1da47c493df6
SHA1 b8c30c342c193baee9c2a7f76c5b980471371f9c
SHA512 6018544e7f2e49d603da32eacef0f6a7bc64442844d4deb8ea9a575811d337fdcbea6ad2293dc3e540f179676a178cfd98818b0255e3f13fd74e13f39eac8002
SSDEEP 384:O/tiFRsNjL8TUNTUlIlncvb2ZC7dQsjvQRjzE0dbJr0MRIy:LFRewgCTBfYnVh02Iy
TLSH
T13B6219325C649C7BADA7AB85F54A32138FF081A7D9C5AA64E7DC9E1C01DB1EC1307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 602626fb5b3be6843b573d9a472ddcc26b51745102ca54c897875bad5db25886
MD5 2885eac1510bcd6f592311822abe12e6
SHA1 5461edf10b8d2de257a18782377291a1b8e1adfe
SHA512 62decb693d94a6d391493a0f4199b68b7e25efdef56ceaa2e8e22b192f959db6448436455f8595f00693fc047fbbfc0142abcfc73f404339cb270b93e4215221
SSDEEP 192:lONr6vMtPQmiUytjt4ThTwz+FdLDf847Mx6U/u:lONr6UtRU54Tnd/McU/u
TLSH
T16B020935AC786CABAAA3AD45F48A37175FA4607FA9D05B50EAE86F1D00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e13c600647535f94169ca53c6864eeca08f8b665db42b12e8ed380d58b4dee8d
MD5 c9ef6f0d210f7ebd2e5c8be65ecbc979
SHA1 389bc46eeff20d05d06e22aec166ca876188cad8
SHA512 8b4607f931e75317abe590ad7dbe8a681cf69f69d745132f34d4f41307f9eb1a0362702b505491dc99e35d88756bd1fa59c3233be42f3a8155680c1b765c63ca
SSDEEP 384:W/qsNjpncvb2ZC7dQsjvQRjzE0dbJrUMRIy:bXTBfYnVhU2Iy
TLSH
T1FD424B31AC746C7769A3B285F44A32139FF0916BAAC56F54E6EDAF1D01CA2AC1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 95027133ac44b4aabd051bd0eb4a263b5874f7444e9dc2c01fee8f96aaa94f97
MD5 4c4d8353f7c17f01891e2f8809230fcd
SHA1 ec691bdd549112ae1d2c1d12ba6e784b7d7abc0a
SHA512 205bc0b4e58787cfec6bf490f28bc6e455a2bd3bbbdd8136b3da2cb965b83fc997baf5f1302c4e16f4e19174ea5399f1a2dd3c92fc2dfeb13e962fbc808e3f01
SSDEEP 384:+qsNjpicvb2ZC7dQsjvQRjzE0dbJrUMRIy:jMTBfYnVhU2Iy
TLSH
T134424A31AC746C7769A3B285F44A32038FF0916BAAC46F54E6EDAF1C01CA2AC1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 a5aa8e7fe8ce78fb7c7f1ced693651ead0bc545d6a7e72358f03765d2b7604f6
MD5 c478d45b727f6428ad69e2cf19a296b1
SHA1 d4d09f6e646fac66e8c0aa983bbf81eb15e5a83b
SHA512 56909493ee34f4afbd04610c22426f8020855884bb09d576868d72111a87ed24d0a25b96baf66bede95a8b7d528d9befc1197bc6d52ecb2069a662fdf0a1ebf8
SSDEEP 384:O/tiFRsNqL8TUNTUlIlncvb2ZC7dQsjvQRjzE0dbJrvMRIy:LFRfwgCTBfYnVhv2Iy
TLSH
T1476229329C649C7BADA7AB85F54A32138FF081A7DAC5AA60E7DC9E1C01DB1DC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 446f28cdca8518b3c801c59aa42050b26cab64e4b5bb3c27f218527639d49916
MD5 f3a6b1c9cc41cbafbc9630946cb68575
SHA1 e5d3f4fd2030f7ab4ccbd85d0902f91f9aeb94f3
SHA512 6ee769512fd67bf6dc1eeb02ba55f4f3647278d1e945dcbd3ff3dc767df94b96c1c673a9f9a980b6f0eb6a55670327421dad32f05d0a24107dd90d380886f6e0
SSDEEP 192:6eON/I6vMSQPQmiUytxt4zEhTwz+FdLD1WSJrl80IMyqhU/u:6eON/I6USQRUD4zEndbJrqMRU/u
TLSH
T17F121A31AC64AC6B6D53B585F48B32175EB0D16BEAC5AB50EAEC6F1C01DE6AC1307C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f435eaeb-9a4e-4b80-88c2-33c630d52d0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f435eaeb-9a4e-4b80-88c2-33c630d52d0d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 017ca7169ef570a8d25ffc4805774ca0de48faea19073280263fdde20fdfa7c1
MD5 6cc172a687150fb2a86367a857c3f127
SHA1 d08ab0690998066dcb0c3c005a573a733e708467
SHA512 295171d009ca9c45d667130441f745f87cba11de3cefc8356de1e7cb41be0d06aafdbd7f2d00b99dcbd062c1353ec5c7389a8863093f65240cbb1832b59d3442
TLSH
T1EB412958BAF91048B3B77F1A9BF6A46D847BB9771F06D09E10110E4F4663A00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download