hxxp://feedback[.]engage-powered[.]com/NINETEEN/aad417f1-e852-40f0-81fb-b16e323963c0[.]11870451[.]link

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://feedback.engage-powered.com/NINETEEN/aad417f1-e852-40f0-81fb-b16e323963c0.11870451.link
Sample260930-sd63javv3n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{F50198D5-282C-488A-8D2C-B32A3B98F307}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2128	4252	msedge.exe	87
PID 4252 wrote to memory of 1540	4252	msedge.exe	88
PID 4252 wrote to memory of 936	4252	msedge.exe	89
PID 4252 wrote to memory of 936	4252	msedge.exe	89
PID 4252 wrote to memory of 936	4252	msedge.exe	89
PID 4252 wrote to memory of 4308	4252	msedge.exe	90
PID 4252 wrote to memory of 4308	4252	msedge.exe	90
PID 4252 wrote to memory of 4688	4252	msedge.exe	91
PID 4252 wrote to memory of 4704	4252	msedge.exe	92
PID 4252 wrote to memory of 4688	4252	msedge.exe	91
PID 4252 wrote to memory of 4688	4252	msedge.exe	91
PID 4252 wrote to memory of 4704	4252	msedge.exe	92
PID 4252 wrote to memory of 4704	4252	msedge.exe	92
PID 4252 wrote to memory of 3528	4252	msedge.exe	94
PID 4252 wrote to memory of 4608	4252	msedge.exe	95
PID 4252 wrote to memory of 3528	4252	msedge.exe	94
PID 4252 wrote to memory of 3528	4252	msedge.exe	94
PID 4252 wrote to memory of 4608	4252	msedge.exe	95
PID 4252 wrote to memory of 4608	4252	msedge.exe	95
PID 4252 wrote to memory of 548	4252	msedge.exe	100
PID 4252 wrote to memory of 548	4252	msedge.exe	100
PID 4252 wrote to memory of 548	4252	msedge.exe	100
PID 4252 wrote to memory of 3948	4252	msedge.exe	101
PID 4252 wrote to memory of 1936	4252	msedge.exe	102
PID 4252 wrote to memory of 3948	4252	msedge.exe	101
PID 4252 wrote to memory of 1936	4252	msedge.exe	102
PID 4252 wrote to memory of 1628	4252	msedge.exe	104
PID 4252 wrote to memory of 976	4252	msedge.exe	115
PID 4252 wrote to memory of 2580	4252	msedge.exe	116
PID 4252 wrote to memory of 2380	4252	msedge.exe	117
PID 4252 wrote to memory of 4828	4252	msedge.exe	126
PID 4252 wrote to memory of 4828	4252	msedge.exe	126
PID 4252 wrote to memory of 3520	4252	msedge.exe	127
PID 4252 wrote to memory of 3520	4252	msedge.exe	127
PID 4252 wrote to memory of 3948	4252	msedge.exe	129
PID 4252 wrote to memory of 3948	4252	msedge.exe	129
PID 4252 wrote to memory of 2056	4252	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://feedback.engage-powered.com/NINETEEN/aad417f1-e852-40f0-81fb-b16e323963c0.11870451.link
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc8a49c188,0x7ffc8a49c194,0x7ffc8a49c1a0
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,2671126458287579043,16880890240179629494,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,8910893281372401700,11122216988635858213,262144 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,14841826695189420933,17750482561577478048,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,3779028956765914789,6921333825858394233,2097152 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,11981658517991923954,9869953337001200634,2097152 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,5565856437785353755,6966517361501826451,2097152 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,13827981545358115749,6492812445231856050,2097152 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,17518633965754738387,4494854565946226891,2097152 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,9807460402223862366,7776251103951280115,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5294296386738269658,3835870734952838181,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,15125945355701124185,15382291785311637143,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,15125945355701124185,15382291785311637143,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,4514333446093804560,15155566743724238369,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,2120303113816605594,13006264358421485575,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,2099241360200103967,5254699002951045110,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,2538809663390673583,12320940637470103199,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,13372776410912711268,17495484380883580051,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5223174352677153665,13154366580993704786,524288 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,2435111639143584476,6415658694393917565,262144 --field-trial-handle=2452,i,9654622422120091850,4689949901736555702,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d4c48b64b3d969d4f3d2eeedb4b691100eb261bf09ea447eb024a22f290b460f
MD5 ec5cbc9e640670843a6b1370f063e689
SHA1 7209a5c4e5302e5607943d93378364ec57dd99f3
SHA512 241c06b0ac01f24bb09ef49040c16157a5415a6ce824c7e707a6c1684fc0c46e8d7c50879edbe9ba67a91d7fe3615045e06fef272bdcc68a604fe2dbdb86b06a
TLSH
T13EE0269857CFC32FE64DB4CF41685B4CE2803B0E93EC6E0A2B088485F002848F7926D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1c48c3b5f9e845032ebce4df216b6226eef09ea07b5bb7a16be8e5e37876947c
MD5 009592767e6ccfb4f5b69968d4ab0b72
SHA1 6b03c27f358d1947273a947609d213e312960fbb
SHA512 dc6f7072771d0240e0aa66b4571b44e692b111c9c40c13c3f8f8fbda345dcb6c051264d85d5e51c3982f152759c49ff8d21b861d8497c8ba1ea723f9097bb53b
TLSH
T10081B84651D0D8A0FF6CC8F491E81FA736B5618015932EC356ACECFA6C723C7CA2262C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5902d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5902d5.TMP
Size 3KB
SHA256 7cb92f77319c2a08158216c026480bc93550aab5cc20d414319a560b30711cce
MD5 ab735f12677f13280e3bb10c13c8bdee
SHA1 c940a6c9f9b05caaa46670cc870db1edda491d15
SHA512 4669e0eb1eef2f11642a28a13b81785046919f533c446cc5b46544b5f4a496fb01d8027679694e61cacce2b724f2d4a5d8bf514050af5d0783965611a7f8cfaf
TLSH
T18E61A5865580CC60FFACC8F591F91F8B3672658019932EC565ACFCF668663C6C17203C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 0493e2295c00ab31dc6e6747f0474a9882f728cdffd34b3672b689d43c02ccb9
MD5 02d42ba095cfc40b973bb3dd59fdc7f8
SHA1 1f10854e435188131faaae825f93384bd940471f
SHA512 ddbb0fcc089a64a2d2b833018989f866c9241536f8a97f7ef0a4ace86f340aaaa5e9f1289b6e634fa39fcfae1501368bb7b538b68775fd1b7753d0b0d61e2794
SSDEEP 192:DrY2aBQxfdHeDYxev+i1UvWUIOHqgrqUc+fAbftQoQ0VRQzo2nwWjGUThapG+p1X:DrY2aBQxfdHeDYxev+i1UvWUIOHqgrqT
TLSH
T1DB228BF7C3B585AD8A9959F06A197B2ACF1E1824436C3A1EC4D86F5F93F2070D10279E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 61ada8c118550b57dc0a0cf443b64e425edcecf8a9db06fd50a43d6c15a642a4
MD5 ea0dd774edcec65531fd2f33e4dad40f
SHA1 1ce7e3c1f5fca096cffdf69a8a17aafd33e44d74
SHA512 4805c360057a32734bf1c0c2e2b6519e2af2f1b22fbbe13a503ed747ee6c3843bbf9470413049473d73862075ce3d1e6fe3b6eab31c9f7a4228ce70d85ecad27
SSDEEP 192:sxZPRUWx/fEscKIdpm2HW6+WNMGb/Y36SxD5IgrJ:sxZPNx/fEscDBHbV/XWx9
TLSH
T1AE22B7526E28A97B8CCAD21DBA25BF13D6F9503291D11E98AAFCC61C05E76DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a6b834b901eafbb4a559519ae7ec236036376e90db1d9d2c02dacd003ecc7ac5
MD5 520e6145e9fe1c17af0b7e258bcfdc8b
SHA1 4d42672274c019020ea506c0a2170b7d66fd8c18
SHA512 ae767a9b8218fe4aa5287716a80f2a03f30d6fc51fc08a84a4990f03be62705ffbba60a088a00447d47bd4d23cc4326f2df2e1dd6eaef6277b99a29b160c5e28
SSDEEP 192:sxZPRrWx/fEsjKIdpm2HW6+WNMxWXY36nxD5Ig59J:sxZP4x/fEsjDBHbHXXxxV
TLSH
T10922C8526E28A97B8CCAD21DBA25BF17D6F9103291D11E98EAFCC61C05E76DD1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 925778c12a882dbfe50a55e1b9e21c9a94384c54865cc43ee91f1765c40b1e73
MD5 210b14204c46dc5ec1a8cb4f8612b602
SHA1 5200ffee36f5e458cf066393d45006cfec6b7a3f
SHA512 25c727566ad40098e2aa28aaeadf7e4d19d651a113da7c74c19fec7547c669d89d7b88d6076672a7c9c0aaf7c14a77a98b8a7793e4a3375f9e5072a7574a5d9a
SSDEEP 192:sxZuRrWx/fEsiKIdpm2HW6+WNMRWdY36txD5Ig5XJ:sxZu4x/fEsiDBHbzdXvx7
TLSH
T19322C7526E28A97B8CCAD219BA25BF57E6F9503250D11E88E6FCC61C05E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a745ed5a38bea0f6b0d5df3dbd9b17340d8b237b883b03446d88754b711262af
MD5 559ddf3a7f4bb323acb2cb971b21546f
SHA1 264dba4a9f72bda086e7032db089528675ead9ff
SHA512 d3209b48b54dbbb60bd67a28da10bfcbbe98d29d60f0a3c0199dca3685776e6261b6c710ed3a2d74d2070d650c81053bb1e6ae6ac1a8ba57fe5ed099fe161adb
SSDEEP 768:esKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/proYja:esKlm7QWvUYe0u1ja8/L/E/CYja
TLSH
T18DC2FB3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a624be0f92560b63bc2773477760cd930b4cbb2004e5034804db50a7a0d64315
MD5 75f504d9d7c96d274feaa00ddea2918d
SHA1 69ed9fb07bb1142e9640cea7bf52beca4b5f15a7
SHA512 c684b486577f839f903502feb5fe407192d234d6fe9a45979b6cdd1357f1d422808706fbd3670093edba065b1539f86c00c9294d8be3668f168f68d8b04166c7
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyLMb6G02aDbqpyIS+DK9a5+NQkmoYVbg:KsIoKxiGGr+Kw/tuK2s6enCKa
TLSH
T17191F511337B0381387E35488565CA2F424272A73418EB6B7BB854B28F6AE546EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 d982fadd31ab420d5b7b3b2bd7b31fc70c550cc90c62a3aad96f6d82560075a8
MD5 14df096b5edf01254f1812d876de2124
SHA1 f171f99117614046da87eb46c2fd96b54c3d288c
SHA512 fefbf5cdd50e2a67652636797f2a40398017eab528a68eab08cc3e572b91d8926719e2d47ca97c9da01207f723a7cf7a70694d0fc3a752b55db758100272765e
TLSH
T19C212581B3A651D56E8DB981C11D990B60A63F5D150F9D71233D84F64F88C192FAFF21
MD5 SHA1 SHA512 TLSH

Submit Download

620020f4-4cda-4e57-8552-525ac2c8913e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\620020f4-4cda-4e57-8552-525ac2c8913e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 875f01859ec607b1388e70092b9af68a3cadf9874e1482bde153c4fcaeaddd10
MD5 b249b6a618ce5c80414c7daf03de52e3
SHA1 ffd1eeb29c0d6dfe4926edeb357f6af5f3b309ba
SHA512 2dd0b85a999416c8a5948d2ab4a2e22a09147aebd77db96388ec09f309f9b828be0a91e9bbf306c8d04a8338f48c08f49b2f8946e5fda560619e47a25bc15134
SSDEEP 384:JZcIhsNoXS+pJeVpbR+Oh//afVeYJtgOIwZOyrRo3:Bha+pAou/CNeYJXsIg
TLSH
T17D827B3268B8ACB75DE7A145F08733038F78806797C5AF94D5EDAB2D01EA1A81307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e00cc8280666fd7a1c2d332f35d1702d5e68d5edf819b7a3b002ba94829cb58e
MD5 8b8ca2f151284abb1c2bc42b604a1426
SHA1 778e971ccad1e9cd8a2547a7c006d92d0767a399
SHA512 b7d97f2717c8005768d5b5b643b7636c05d782e7fb4777cba4123b8ed716cbd65842869f3feea2caf4c8c988330ddb3dc6d09b2b26af9a6a08a152018f4c265c
SSDEEP 384:IiFiZcIZzsNY8TUNTUlIlKS+pJeVpbREOh//afVkYJtgOIwZOyrRo3:TFQZBwg7+pA+u/CNkYJXsIg
TLSH
T1C1C208F258D7887AD9AE5747B37E2E038E7CC067B5819A90B7985A1CCD960BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a591edc3f3a8f00adf1447699e9c2adbc87ec92a7be972ed72754de178cc741
MD5 129211f543625d6b6ee770f3c039d360
SHA1 ff9c8c6abaf1671ad23a6d7126a5b27515d038a8
SHA512 ecb6fd6c3bf15f4d50f2be12903e0e386a1802cbcef2c742e5c39261eb93361aa7bb9bd0a80e32e2d36495a2efd65e251113a14742764d659f70621617479d1f
SSDEEP 96:KqONknQsjpfbUmjH5ih/cIPURHl8h4otop5EaDKBKP4v+Y1xf//ojdOx5YEqso0d:BONr6JUm0QmiUyFaso//aOBCPaU6
TLSH
T1DF02D739BC68BCBB9EE2AE45F04737239FA4106B96915F84DAD86F1D01D715C2303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 960fdd578a57ae845340ee82de87d8762209fe994484930e542accef63b92409
MD5 56fdd1abb90f353a98399cc1ab4484af
SHA1 dec8c66330e54b6022a783ff8810c6fc0486d554
SHA512 825803807563901669f405f23418ddb53b030664c52a7aa1f25e0c3db33a48bf0a0d8c997ec0d73a7ebc38390be7fab312c3a5ae38a40a679349d78e19c56b1c
SSDEEP 384:PZcIhsNoKS+pJeVpbR+Oh//afVeYJtgOIwZOyrRo3:Hhx+pAou/CNeYJXsIg
TLSH
T1D8827C3268B8ACB75DE7A145F18733038F74806797C5AF94D5EDAB2D01EA1A81307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2cfce3b9c3ee677baeca91359feda2c8f3044d18c3d5d5af10859a5221b9977f
MD5 ec8704499fad797bcdd741c87254711b
SHA1 280b236258dd62a865348e74bd5d920e8a5b20d2
SHA512 65c1ac3e4698ccd110da9954cb92fad9e22d319ca481019d4c00686849644f5e36490103740aa42f7397e3909413323285c4e23047c293c965cf531638a33c93
SSDEEP 96:KqONkxQsjpfbUuH5ih/cIPURHl8h4otop5EXDKBYP4v+Y1xf//ojdOx5YEqso0k8:BONR6JUlQmiUyeaqo//afVrNxnqjJU6
TLSH
T1DA12083578A8FCBB5ED3A595F08736139E744067EB856F94D6DC2B1C02EA1AC6307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a74fe4b2-9944-41d1-b0d4-0d6edb0d5f87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a74fe4b2-9944-41d1-b0d4-0d6edb0d5f87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86c7a9ec3b9a2a09282a6c74179357cbac9f140db2687c99722b7f129f4d7602
MD5 310aebad27f76c4c3ea24c6ea49618fc
SHA1 9c9da9673aa4d9fe18a1857a8ab73b7c284d4b8c
SHA512 8b498880d8253a69ad7c748665114c8298007441cfa295d5b9138186d79ff947b25905670db8382689b6a73766920b13e3158b57e16dc250067208f2d8c817cd
TLSH
T13D41EA58A6FA1148B3B76F5AABF7A86D497EB8372F07955E00110D8E4A22B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download