c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb

Resubmissions

24/07/2026, 04:07

260724-ep4vnasbrh

24/07/2026, 03:57

260724-ejba6a1vdt4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZenithMacros-1.1.6-Unlocked/executable/LICENSES.chromium.html
Size 9.8MB
Sample260724-ejba6a1vdt
SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
MD5 0ff177fbf2a3873dd573077840e0b8f5
SHA1 03d06bc7cd894399a5fc6600a0210f6e3226f92a
SHA512 3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY
TLSH
T134A6A52F7B48037706C642627B8BA5CAF21E903F3B561654344CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293394012209807"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{61A1E070-3D8E-49CE-A60E-9223552084B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3756	2080	msedge.exe	83
PID 2080 wrote to memory of 4412	2080	msedge.exe	84
PID 2080 wrote to memory of 4508	2080	msedge.exe	85
PID 2080 wrote to memory of 4508	2080	msedge.exe	85
PID 2080 wrote to memory of 4508	2080	msedge.exe	85
PID 2080 wrote to memory of 628	2080	msedge.exe	86
PID 2080 wrote to memory of 628	2080	msedge.exe	86
PID 2080 wrote to memory of 4388	2080	msedge.exe	88
PID 2080 wrote to memory of 4388	2080	msedge.exe	88
PID 2080 wrote to memory of 4388	2080	msedge.exe	88
PID 2080 wrote to memory of 2508	2080	msedge.exe	89
PID 2080 wrote to memory of 2508	2080	msedge.exe	89
PID 2080 wrote to memory of 2508	2080	msedge.exe	89
PID 2080 wrote to memory of 3036	2080	msedge.exe	90
PID 2080 wrote to memory of 3036	2080	msedge.exe	90
PID 2080 wrote to memory of 3036	2080	msedge.exe	90
PID 2080 wrote to memory of 4532	2080	msedge.exe	91
PID 2080 wrote to memory of 4532	2080	msedge.exe	91
PID 2080 wrote to memory of 4532	2080	msedge.exe	91
PID 2080 wrote to memory of 3048	2080	msedge.exe	95
PID 2080 wrote to memory of 3048	2080	msedge.exe	95
PID 2080 wrote to memory of 1772	2080	msedge.exe	96
PID 2080 wrote to memory of 1772	2080	msedge.exe	96
PID 2080 wrote to memory of 1344	2080	msedge.exe	98
PID 2080 wrote to memory of 2288	2080	msedge.exe	102
PID 2080 wrote to memory of 5048	2080	msedge.exe	103
PID 2080 wrote to memory of 3408	2080	msedge.exe	104
PID 2080 wrote to memory of 4740	2080	msedge.exe	112
PID 2080 wrote to memory of 4740	2080	msedge.exe	112
PID 2080 wrote to memory of 4608	2080	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ZenithMacros-1.1.6-Unlocked\executable\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15156267210729062837,5906991875299262673,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5912811208089065757,4415741983048738482,262144 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,2909239310786782784,18228803671455887772,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,13181697228502701390,41085016031887105,2097152 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,1846504530448162012,2161284307298186258,2097152 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4839511669274343151,15882844128149920433,2097152 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,9377123412414142455,15227476587724716848,2097152 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,3192769846639842431,5669074326835864403,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,3566261668194724457,13227922647074613674,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7528188062820809074,14038593920724114893,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7528188062820809074,14038593920724114893,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,17415453294197849727,15861198005564710771,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,3335296150723757613,9786690557843713287,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,315595112894649926,12682644130833534484,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,14004883781389003513,698600550188362071,524288 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6040,i,451713382123157114,2876778688781068985,262144 --field-trial-handle=2260,i,17381384891482742353,14172385765255700509,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4292bdc9735f3ac26eab51ed0b7c7c0ec1697b31f6f681f170489fd0298f8a4c
MD5 55b2912c6f6d17d5902859be98979f57
SHA1 b7eb971da7f2f65d6e5ab79732a62f9270accbcb
SHA512 c126ac6152d4cbcaf4cdb8a570696a83f9b3a0ab67d67d55fea6f6a8237d5c11e6a2f4b9f8baf0878125634202a6400ddce3225d125f45c06411de6f26757119
TLSH
T10371270C0012CCD1E3E256F1C0F2F245B4B0B26F3B779AA12274C5BC6519F72A369C0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f047.TMP
Size 3KB
SHA256 db9e30197585090d2f0fca4fabd37b90e5432e5e17e2da7554bf9752a7abd995
MD5 5717a30e0270e41fab3cbde80e93053c
SHA1 59fee39ecf2caf034d8ccf77d982aa6085f0ddcc
SHA512 51b3f77aa900856bde05aae57293a9c0b47fef2d13f538c1984c5e8e5baf08ff751e471880e0920b52834111a0a579e42d90d12e183bbf5b78c5229be2ce2dd9
TLSH
T1D371270C0112CCD1E3E256F1C0F2F245B4B4B26F3B779AA12674C5BC6519F72A769C0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2401a338d2feea46326ced16ad6a71460f4bc66c1ef532615912b03d36d024af
MD5 6f514f2a1a4ea82976a619c7efd777f4
SHA1 4506943f4a8e707982269d3471d8ac199fdf75d4
SHA512 d496fbde78145e30c1efd439d0aa12867f86ec50d2447aaee882b4758f2ff4c2486807b7a4ee02220eb037196d8a2ee6018ea3f1f766006295a6536820e1bfc2
TLSH
T195117DB7C7D5856E890556F06A24AE2BCE2D0905831C7C1589D4FF1793E3475D10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3cdaebd8e01666837aa744a1c8113da5f6046a18ae4bfc8ebca358ffc5b45611
MD5 62c894ac7481b97413a71f01452b28e4
SHA1 9e3afe986ba851dd7ee1121d1ca3e29e49f5b9a5
SHA512 f3bc352d6950f0e09a7d69cd7b6ab3eb7afae96d9d482ed1a51479158d1de139f9b65b01f503ab951c63fd52ea14e393cdaa7103375b89970dde8d025680cc1a
SSDEEP 192:sxZ+R2yM/jK1Ml8MkI/f7siVXQIdpdaHW6+WNGYLzEzqIgrJ:sxZ+gMI/f7siVXxYHbGo9
TLSH
T1E842E9166A3499B7CCDBD209FA45BF53E5F51473E6500E44AAFC8A0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7b026ef68ac3c0c2bcb4b5fd1291fd65738e3e6a656d3fd51b0e2d24f336b9ed
MD5 06ffbe6184c2a969ea7562cc767d0230
SHA1 0dd6792ee128fcc343f2913ec69c4b7975ca5108
SHA512 5c62954a836ce3453dbd0672d0120e0bdaabc50ecaab98dae570c9f7368fa7a25a336f99478aaae67765647bb91fa6dc9ba529e3ca0630e3ac8d015aec61aceb
SSDEEP 192:sxZ+R2yM/jK1Ml8UQekI/f7svVgQIdpHaHW6+WNGYLfPDqIg5ZJ:sxZ+gq1I/f7svVgx6HbGV9
TLSH
T17952D7166A3499B7CCDBD209FA45BF53E6F41473A2500E44AAFCCA0C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 48cb2611c42eaab1c8d5c4cd92ae9618a7300e0a10fa677381c583d3e7175265
MD5 9835abbec93cb60b10da033ee9d7edbf
SHA1 c0cc12c7b97d39a9cf396d47155a808c06279c78
SHA512 0f63175c3805b6fa4c47be5abfbdb364878394023a43592e3e3729cf404892a14fa7228bfe70ec8f0c136cfab91c9f5464076c52c09dba6db40aa13183f9a63a
SSDEEP 768:hxs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNlroTh:hxs6pD1WvxzWju1jahILIsNeTh
TLSH
T1F9D2FA3B680CCB7E4F841E5CEC2AAE967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 802457a601284fbe3016237862c793682f3e2c96d27cb2d7d9667a13d27f11f8
MD5 416ec794f0090ece83f5c6bac3c5bf25
SHA1 143dcbb3d4b6aa5a8162a7800086b9cf17f38ba2
SHA512 b53195c397c3c8e7a254ae429b386a49e2ebec8cb47f43db6c3d3138063e8911286b137e1ea6353ee2fe12e36b9a281c575aa356f3c8e45eefc42501f67214d4
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkE:ii9J3aJxV
TLSH
T188E1F31232BB02123D3E691C939987676F427AA33418F42B37AC10765E66E344DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598a93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598a93.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bb2ad5b57f37966c4e26df2991e4f4384496e5af98c321cb2472874f97f63449
MD5 042c2d95d4ed362af6ee1612b2645dc7
SHA1 477bc86db45355956dc0dd58dfdcc46072c4ffc2
SHA512 314feaef774eee6cc379177a9c4a571f987882cad686f42a16018d82c44ee58ea0add85b9fc5035435024a4e8d3790b4704fa77e0145be5fadc81b617523c18a
SSDEEP 192:u/LsNEpoQ3x/7+3v2/QmiU1QRt4atb0h+FdPoYRh2vFLMxwrqYhVOOZljYRHKKGN:ssNEyYCSmia9ndQcMixwOObjI9G6w7bF
TLSH
T1C2727C356C785CB399A3A111F58B3517AFF891A7DB893F40E2ED9F0C05DB5AC530680A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9033216a1cb3966d5544b332b56a0bea5d6c7cc85f68f8a01de82e95f6458524
MD5 00652f746dea4259ce54e57f229db42d
SHA1 ed6d9a7827b598a52ebc174fe902a3d4a6ab037c
SHA512 f46c0fbf564db7243d7e6010a8f376c3b0922a8dc971f6d22d43f486bff2ea1d57e73b5142ad0ff49c9522dc4da7f1428327b9de1d2ccfcabd2364e323eb9d37
SSDEEP 384:1iFtzsNM8TUNTUlIlrYCSmia9ndQcMZxwOObjI9G6w7bF:8FVlwgSOjRGJxw29MbF
TLSH
T14F825C375CA88DBB9EB39A41F58A32179FF450B7CA957A50E3DD9E0C00DB5AC1306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 70dee32591d9a7e6fbfb19978e68166e35e0649be673df823407fe4c42bae4d8
MD5 5da82b197d5d38c4882170e22eeab2d4
SHA1 cc7aa192aa382d0a3a8c1bf6c0e130a8f7eb5f8b
SHA512 a2bac5ccca6c27f95d03d1da6b14fc5d2c055cd4233a9f6a4efbc0a986edb19e7c068f9d7a5e5a716e20b349351e7d624bac27dec2c072c10a52162fabcad3ec
SSDEEP 384:1iFtzsND8TUNTUlIlrYCSmia9ndQcMpxwOObjI9G6w7bF:8FVEwgSOjRGZxw29MbF
TLSH
T174825C375CA88DB79EB39A41F58A32179FF450B7CA957A90E3DC9E0C00DB5AC1306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3df8f013a2df8fd37a8ca61f802962a82df42025005f05b9d4877f4da5625634
MD5 8c18e362b9db1110a0410778439323eb
SHA1 17c9db793b3144a5f3494dee6930132008bbb9e6
SHA512 022ed204d732907c9bc175b38e1c4ae17adbcf35ed4de0eef2f2821a6335467c875b2039d5ba34696ee1911f34f28650c55098e35caa38e6dc1ab48d0f19c312
SSDEEP 192:qONa6O7+3hQmiUyYEGttb0h+FdPougGxnCU6:qONa61YGt9ndQwxCU6
TLSH
T11502C7396C786CB78EB2AD46F58736175FA8117BE9962F80D6E85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 efcaa22dfc95c44e39bb671d7a823983a60f0b99679194a39ed3f888d71d52df
MD5 74498818a554ea7a2263c68f27d53efb
SHA1 7005482363b56aec12a6d6d37d8674c4e4168323
SHA512 a082c345b99ecb632c9d4af43f0e60a3ad2efb98be44b25cebb7411185244d663ab0ec62ec9167f06e23cf6d599a26939dcbd63191e8dbc2745edf482f1485f9
SSDEEP 192:uoLsNEYoQ3x/7+3v2/QmiU1QRt4atb0h+FdPoYRh2vFLMxwrqYhVOOZljYRHKKGN:psNErYCSmia9ndQcMixwOObjI9G6w7bF
TLSH
T1B7727D356C785CB389A3E111F5873517AFF890A7DB892F40E2ED9F0C05DB6AC530681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aac97dff323c0cdae45fd52095bd39d218210c87280f05cbcad246c276958807
MD5 4a451e72d88b6345769a5211b93cba61
SHA1 70e74c5adde3dfefc8ea4d48cad7103c3145bd85
SHA512 6de2388bd16545fbfb0b1d02bc7e655f27221b70c5b8f7edab27cf938dc70474560176564b11c295b03bbc7e4c8f2a8e316a4c60c79687c95af9c189a86c9880
SSDEEP 192:CON16O7+3mQmiUy7E+ttb0h+FdPoYRh2v2cNxwrqYhVU6:CON16Qd+t9ndQcMPxwU6
TLSH
T1F21209356CA8ACB75EE3A441F48735179FA45167EE8A3F80D6EC5E0C01EF66C234681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eea2b4b0e3202019b7a352d59defab38224cdeb00ea18cd63b42390b03c5d426
MD5 16afe4eef8c40f52de051efa52fcdb75
SHA1 a8041dae3e039dff9ba5a0c92024bd3a932b4075
SHA512 90d1e4c9c37029948182256a3e5c7ab783fdae672c3b85484b419c2e9b2ed86314158cb59b347ff5b1fd2d16075bee82d776323e099fffa93b8f4c150add0066
TLSH
T125410B68B6FA114CB3B76F1A9BF7A46D887EBC672E06945D10010E4F0A63B40D9B1737
MD5 SHA1 SHA512 TLSH

Submit Download