b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd

Analysis

user interaction
yes
max time kernel
78s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 19.4MB
Sample260803-wvs4savepb
SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
MD5 c8e8384bda055e42bcdc54cda98574ba
SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
TLSH
T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302559551493487"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{32C304FB-9C63-4FB7-954F-E1A1278171A1}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1320	4536	msedge.exe	81
PID 4536 wrote to memory of 3844	4536	msedge.exe	82
PID 4536 wrote to memory of 4168	4536	msedge.exe	83
PID 4536 wrote to memory of 4168	4536	msedge.exe	83
PID 4536 wrote to memory of 4168	4536	msedge.exe	83
PID 4536 wrote to memory of 724	4536	msedge.exe	84
PID 4536 wrote to memory of 724	4536	msedge.exe	84
PID 4536 wrote to memory of 4596	4536	msedge.exe	85
PID 4536 wrote to memory of 780	4536	msedge.exe	86
PID 4536 wrote to memory of 4596	4536	msedge.exe	85
PID 4536 wrote to memory of 4596	4536	msedge.exe	85
PID 4536 wrote to memory of 780	4536	msedge.exe	86
PID 4536 wrote to memory of 780	4536	msedge.exe	86
PID 4536 wrote to memory of 1896	4536	msedge.exe	87
PID 4536 wrote to memory of 3176	4536	msedge.exe	88
PID 4536 wrote to memory of 1896	4536	msedge.exe	87
PID 4536 wrote to memory of 1896	4536	msedge.exe	87
PID 4536 wrote to memory of 3176	4536	msedge.exe	88
PID 4536 wrote to memory of 3176	4536	msedge.exe	88
PID 4536 wrote to memory of 2512	4536	msedge.exe	93
PID 4536 wrote to memory of 1444	4536	msedge.exe	94
PID 4536 wrote to memory of 2512	4536	msedge.exe	93
PID 4536 wrote to memory of 1444	4536	msedge.exe	94
PID 4536 wrote to memory of 1052	4536	msedge.exe	99
PID 4536 wrote to memory of 4904	4536	msedge.exe	106
PID 4536 wrote to memory of 2268	4536	msedge.exe	107
PID 4536 wrote to memory of 2016	4536	msedge.exe	108
PID 4536 wrote to memory of 3764	4536	msedge.exe	117
PID 4536 wrote to memory of 3764	4536	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffee8dac188,0x7ffee8dac194,0x7ffee8dac1a0
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,2881952308805847321,9738349121057326175,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,4044003547113699468,757887611487268050,262144 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,12725553934327842461,508928260654367702,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,12307251427537075118,16683377706738818064,2097152 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,14449423213888280187,17384498675835386162,2097152 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10316302125584746173,6689855019243305665,2097152 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,15300700173429376433,2512299005671326187,2097152 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,10663459884032698315,8100415149978122315,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11767296388547436193,7975294152303451427,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12743928308395496688,9061825896164902776,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12743928308395496688,9061825896164902776,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,6558015876480158411,5162054773787944264,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,2815720119958770525,6323528301985437985,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,3384863954408884740,5833486995466029144,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,6532235911577215009,1450310483262211177,524288 --field-trial-handle=2352,i,3324575563297086711,2538727666103403661,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 62b7725f6bbb57a71bd3573b33c89c7c4f676d63206ff81adcbc62ce3c1240a0
MD5 cacf09ead0c31487eb4c70144f83be33
SHA1 08279a13ab6ad99bf10f3b98e45269ca1731a420
SHA512 e636892785237642c086af7a65c66b5451148eb90e83bf4203333929c4c2d931ac904f6526974d14afb85d4e3c119ec6a89a81815d3086f9f1565b35ad547f3e
TLSH
T1C171C5653351A4B1EFE5053CEDD24AD579B070850A139EA900706B3D2BDDB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e5d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e5d7.TMP
Size 3KB
SHA256 09cc14914ba3f99fd5eca777b7541c6be494fc106d5773a0a2526c9a55db1dd3
MD5 355951d3d4e0ddc26ba65fb9b5b3b23e
SHA1 137ca6b42635bfce52fcd6ed93613b1a2fd789a0
SHA512 cebc63598c64f39c7a28681ed5f528b2509b9bc81e9a460fa666872215bdab1a0b5d9768bc383c8514be88c105e3d15809d32a538b40241941860ae1b1c97b96
TLSH
T12571B3653352A4B5EFE5493CEDD24AD979B0B0890A139EBA01705B3D2BDEB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 bcc90e132acadcd910a854e24ac239eb9ce1f115c64fb284701a5d2fe5cdf68c
MD5 2335f6b5d19761aff2d26b275e9d5081
SHA1 2d35a7c6d9d71f3ef549e001a4755ebe93e697b2
SHA512 8881ced00e91349ada6192fd872f47304cc64946fd1c7d62d4d9188dac7b6974e030415c79a1d725560e2c20e5d78514146e818a8b1441bf2438b41d18740b99
TLSH
T1CB117DF3C3D5956E89011AF05A24AE1BDE2D0616431C7C2999D4FF6BD7E3075E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ac4eb5f5697101164e4075100470a0488ff60b584a755bec0459b260cb604f37
MD5 ba73edbee37464c465778a6a0b26488a
SHA1 6c4b8a35cb70a97989494920cd8f2807b5139843
SHA512 451aba5f1e103ee808898a4125cde50e64f8751d7cad0bc2f1997db5f796bb532622dc3bde03884bf98ff2dd1394a26ecd5f6db524c69cd3a4cec959df748940
SSDEEP 192:sxZ+BR/yM/jK1Ml8Mkq/f/sRw7CIdpdjHW6+WNGY4wTNUIgrJ:sxZ+B9Mq/f/sRw7r5HbGf9
TLSH
T16242E8116A34A9BBCCDBD20DFA55BF53D5F90472A2900E44A9FCDA1C04E6AED6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7dc4261a2af7dca808c5ba32a2793eeb22b5967cc7358364baa9a05a921621d3
MD5 90948ebf8874cc0e704ef56d0226659f
SHA1 824c682c5c048e0db6bc21589772982cf1ef0f10
SHA512 e8e7b4af9890fbccf0153f2804eed7ced97cc981275bd8105262e9aeac04e3e1c5aab6ca0f7f863675db3a5341c7961d28e024003f6991df715ee63afa32237c
SSDEEP 768:Tz8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdaroCkVUnH:Tz8iJPNWvx76ru1jahALocdR7UH
TLSH
T1F1D20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA880C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4429c3ba238e8d196df9f5c7d658bc65613eec338de7b8df4f94d058e09d3ed6
MD5 86eb9aefdf12643aed52889ed84e4ab6
SHA1 86b47b7c97915c3ff29cb8234c917572c7c37749
SHA512 70b8567714c79e125289ebbda056119572c61e08ac70401b200450377a8536a1175c00aefa0aaa621b580ac16dd8fc8925410ca62c11303a3095012e9efe4bfa
SSDEEP 96:KoZ+Ky06SCsKnqJa3G60MM+68ZlEa+KsLEw+4yaBAKfbe7CeAg9:09369Q
TLSH
T18791401131BF13563C7F290DE5A187679A4272B33605E42A7BAD01E34EA7E220CBDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 ffb29687bfb958c5ec3a26e343affe81f04aa801558ff11d68e2f87a15654846
MD5 1fac37d19a380b14c09a319ac82a5cea
SHA1 34f3aaf8b3da17d42e09e39d4c029929a3e97378
SHA512 d09a8b735b9d00f161c93b8a7a27e5c500c1ce8dc7697b09b2ff5ac42499a2332edfae2c991e73cd540995e583f545d1dc76ea83f701f344a8ad36400daf9db2
SSDEEP 192:uim+xasuheOwQxMGsN55Qs5+mX7OQmiU1B9M4k03YHHNuLIllqJrw+jr2Yy:UZcIhsN55N5rO5DkVHtjlI2
TLSH
T156726B7268B8387A5DE7A551F44732175FF9C137E3C92F9494EDA71C00EA2A8130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed11b380568bee572a507a5655523120ba3b11cf858fc4c4065a9009d1e80d12
MD5 ff1a0edb47f90ad63aad71d1e8f8c9fd
SHA1 2bc65a389c6ed1e94fb365441b8dca9ed5089d87
SHA512 a40ad1e49b1692196d8234af833ec2e25f5e02377a6a12b49b4d82a238eccdf8b1c696ec7f54cf7ac41cb0605c58b6bd21f6d45a57f7fb968e832e1f0f4e87d4
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5p5DzBhPwivh50xy0SFYKRAxcbsx:gONp6kDfQmiUy7tZ903YRQilRQU6
TLSH
T10502E93968B83CBB8EA3AE09B48737275FE5113BEAD52F84D5E81A1C40D725C1303926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 2fd8d627daa2d982f4040107b6a6f077a9161bced5a73353d04af2ff862ae146
MD5 66125c0b0c7184d3be0a1a985e3c699c
SHA1 dc70ebf525481b1d637f97be51e7f5b31b09f92d
SHA512 7a569b42472695f7c2989f1237090bc15d516b237481b457f0417ac98deabb73468fbb1e708c221e7c7b719f9031f33e09e2f26252f6a824596d5dc922ed814a
SSDEEP 192:uAm+xasuheOwQxMl5zsN5fQs5+mX7OQmiU1B9M4k03YHHN7HIllqJrw+jr2Yy:MZcIAzsN5fN5rO5DkVHtElI2
TLSH
T18A827B7268B87C7A9DE7A541F44732175EF88137E3C82F9494EDA71C00EA2AC130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2aaf9f9ce72a08b64fb389bd9ef49c75371ae68a74926d9edccab2b154e7495
MD5 ddee5433d3451e1869df82eef81b6dfe
SHA1 b4711c225679d0c965ec923cf94c6e1fe25830d8
SHA512 42c19b2149df65d3da9417e6271179bce0ddc9b7e5490cb9309ca03e0355e143572115c4f48c81648607724e371e9afe619a81d354d20e932f11569f7499412b
SSDEEP 96:mqONkMQsjpfmUTAK5ih/cIPURHl8h4otop5pSDzB5Pwivh50xy0SFYKRAxcbsa4E:tONc6kxQmiUyytR903YHHNNcRllqJU6
TLSH
T16D123B3568B87CBF5DA3A541B08732175EA58227EBC97F90D5DC261C00EF2AC5307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 babd35bcd6f6917d3825593fd99c04cb397372cdf9022547e842c350e3487ef1
MD5 5ad5cfcae5d03c2080c1807745fa8d54
SHA1 667b28beda8b28c45fd6d8c9d9e7e1c4ea7ba083
SHA512 0e0a4ef8939230f9aa7851d0a428b3865feef0363df889736218a3f14936a558b0c2d3da15da3e30c9f43c67e5fc9ff2d8122e4e5b44c4000720a3a60761d842
SSDEEP 192:ukLsN5b+Qs5+mX7OQmiU1B9M4k03YHHNuLIllqJrQ:hsN5b+N5rO5DkVHtjlIc
TLSH
T15942393668B87CBA5DA3A151F44732139FB4812BD7C92F94D5ED6B1C00DB2EC630792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a758098-b608-4d7c-861f-871212283b3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a758098-b608-4d7c-861f-871212283b3a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cad18fa43fd5a6bd8ff59f6d5e81d1cf7b6db63c05a2e35af19ae81e592b1c2f
MD5 9916ac455971c9ca33b080a30e05e9e6
SHA1 84bd77217a083025f96584df33e0f2a2884e6f75
SHA512 3bd9a50be2217a3c235b2ce7faa98833de74dbdce9abc0f6affc4b4822e8206f23d3820c977787365f679c1013d126f8e4369b0861cc19700f15cadafe084343
TLSH
T15041D75DA6ED1108B3B76E2A9BF2A86E487EBC772E47D45E10110E4F0A63B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads