hxxps://static2[.]sharepointonline[.]com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light[.]ttf

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.ttf
Sample260903-rtpyhsal6s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329193722484514"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E8F4937D-BF9E-43A6-8A1C-019EE41B1D48}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3900	4356	msedge.exe	85
PID 4356 wrote to memory of 3704	4356	msedge.exe	86
PID 4356 wrote to memory of 1432	4356	msedge.exe	87
PID 4356 wrote to memory of 784	4356	msedge.exe	88
PID 4356 wrote to memory of 1432	4356	msedge.exe	87
PID 4356 wrote to memory of 1432	4356	msedge.exe	87
PID 4356 wrote to memory of 784	4356	msedge.exe	88
PID 4356 wrote to memory of 4480	4356	msedge.exe	90
PID 4356 wrote to memory of 1304	4356	msedge.exe	91
PID 4356 wrote to memory of 4480	4356	msedge.exe	90
PID 4356 wrote to memory of 4480	4356	msedge.exe	90
PID 4356 wrote to memory of 1304	4356	msedge.exe	91
PID 4356 wrote to memory of 1304	4356	msedge.exe	91
PID 4356 wrote to memory of 972	4356	msedge.exe	92
PID 4356 wrote to memory of 972	4356	msedge.exe	92
PID 4356 wrote to memory of 972	4356	msedge.exe	92
PID 4356 wrote to memory of 4996	4356	msedge.exe	93
PID 4356 wrote to memory of 4996	4356	msedge.exe	93
PID 4356 wrote to memory of 4996	4356	msedge.exe	93
PID 4356 wrote to memory of 3020	4356	msedge.exe	96
PID 4356 wrote to memory of 1060	4356	msedge.exe	97
PID 4356 wrote to memory of 3020	4356	msedge.exe	96
PID 4356 wrote to memory of 1060	4356	msedge.exe	97
PID 4356 wrote to memory of 3124	4356	msedge.exe	98
PID 4356 wrote to memory of 3124	4356	msedge.exe	98
PID 4356 wrote to memory of 3548	4356	msedge.exe	99
PID 4356 wrote to memory of 3548	4356	msedge.exe	99
PID 4356 wrote to memory of 3548	4356	msedge.exe	99
PID 4356 wrote to memory of 4648	4356	msedge.exe	100
PID 4356 wrote to memory of 1616	4356	msedge.exe	103
PID 4356 wrote to memory of 1772	4356	msedge.exe	107
PID 4356 wrote to memory of 3868	4356	msedge.exe	108
PID 4356 wrote to memory of 4256	4356	msedge.exe	109
PID 4356 wrote to memory of 4556	4356	msedge.exe	117
PID 4356 wrote to memory of 4556	4356	msedge.exe	117
PID 4356 wrote to memory of 2140	4356	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.ttf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffaa793c188,0x7ffaa793c194,0x7ffaa793c1a0
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,17204888477364771255,14151156553054421857,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,1767187307917877253,14740397949682004891,262144 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,9758362259794742215,9776726537247951650,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,11791819435500160019,9976951745280860815,2097152 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,6870174612544998054,2804377079834742613,2097152 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,6996240785271042773,14726918387595249683,2097152 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4935682664406800008,4238169326022882390,2097152 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,7155991702391854244,10647624841266746784,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16789499934813934587,13110740962758851720,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,12679821238107130049,3713144734727069975,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5672,i,3130049730539466813,6939321074811470421,2097152 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9802855101145289298,17540759046509168545,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4470742491149011063,4531325805171772240,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4470742491149011063,4531325805171772240,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=128,i,17998495503913147182,7306599542227539537,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,13031047211812028040,16904537911024498649,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,2518460003443022612,4638711413176751005,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,18403214870279106304,6485911595172772517,524288 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5492,i,5639689365520668559,953343435327280809,262144 --field-trial-handle=2312,i,11956492984673102007,6817264068905008275,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 05050a5034b8a1c90afdcf04cde9bfedcbffde7633b231a9cf45f3a1cda1e910
MD5 82736210c58a1e65d1cc24451ea5d72e
SHA1 638160c94b840f615d7f5650827cb73bdc16fb8c
SHA512 a32bb2b5c5e5ac223a79a6e1ac04b933d4f911a925ae4018677f5a78fb37872e76d36336232a225ced6d97f5ba8fe657ebd15ac41375efaa22be904ae066a313
TLSH
T1B871C53B06E26CD2E39047FD74DE1AF5747349DBFD8F5EAD12209A303613712922A568
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58430f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58430f.TMP
Size 3KB
SHA256 e2f6cb19b46a5634fefbfec39ba8822414513d5172689ead15a86b158d4ca6e0
MD5 465353bc89570d366291d231e5c797a1
SHA1 339c3f4c2d2d7ee2990b3bd3f1dbcbaf5cc019c0
SHA512 d67a983bb678c65b06a4bc1cab58312c0632fbe08affbb5915255d95279aac726b0f801c887c8d48e8586813e0e334719c00cd69de7c9e4d086c802eacc1c023
TLSH
T10571C53B06E26CD2E39047FD74EE1AF574734ADBFD8F5EAD12208A3036137528229568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 74486af2b6257ca2550c1448e6ff4a37605b584e3a1ff2324ab3be1f603aa964
MD5 782301aff277fb6bbd49511e58040b6d
SHA1 85734372e4ca07c891b2d760e3c8f40268fc29db
SHA512 519655a071399219db04436ab2226561a5d49b46e84681eef7a42e346ca91045605cf024298eccaf3e97858f150f25edcf4c08fe5270e5945adf5132e3cabd1c
TLSH
T11931AAF7C7E5856ECA1116F4AA19BE2BCE1D0952432C3C25C9D4EF6B93F2071E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4092e1b357fc88d6bc563ec3fafd866a4cbf7283909ed3a79dbf581176c4420f
MD5 484bc31b6ca79be192e8cae5b7a40894
SHA1 96c7a456eb7baae459a46850e44ec9ca49bad32c
SHA512 cd27ba57cc85db0e5f6d020ed215d0e59bb58001689f6ae03a5bbbe76aa0c7a54e2e8b645537bf1389d082d3c96ab73be352eba5e665f7c1724169af5cadf4b9
SSDEEP 192:sxZ7RzyM/jK1Ml8M9T/fVsfAcIdpJHW6+WNGYIwoEIIgrJ:sxZ7z1T/fVsfAFJHbG59
TLSH
T1D342E7116B346977CCDBD209FA457F53D6F84472A2900E48A9FCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0358077c2c50c3ba83ab70f7b89b8c71165d9d874b4df4cdd383bddd5e7da09c
MD5 c129929c7ca233dbeb5a640d296bde6a
SHA1 5ce45981018faa238a807ff2900fc6a47322745f
SHA512 6d668afcd4934c5abfd83b8cadcb0da492f007d1badcc7c0375e03b821e5bb65d2d9389b41462b2c8d681fd7149dc6b2b97c5bbffb9c463ac4af991a64807f62
SSDEEP 192:sxZ7RzyM/jK1Ml8UQA9T/fVssgcIdpLHW6+WNGYIFLcIIg51J:sxZ7zq2T/fVssgFLHbG1F
TLSH
T15952E612AA346977CCDBD20DFA41BF53D6F8547292900E44A9FCDA1C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6f00bfdbe81c9e621b735484fdc87bd0606937fb0fd576c815e99cf07196e74a
MD5 a9873c52779a02bd69cf5c2d0daa671a
SHA1 4eae66ba32d70575f39e0352e1c87a1018896051
SHA512 9b1733728cd7ae28863168239f3387650ed9316482dd347ed7cf90f488a4214f4de5ea2ccb5970c6d59cd8208624213609afe97d9e583b879868395414bf588b
SSDEEP 768:gCsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9fro5XM:gCsqxXlWvJD6Tu1ja54LAs9M5c
TLSH
T1D3D21B3B694CC77E4F840E6DEC266FD76ED801CBA6988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d10c6a83dcd132cd02787b79e095bea7e7a2da8d56490514ff54149f1c7938e0
MD5 20b27a3357e4b975a3bf054a7678a67e
SHA1 dfad321184b2096e13c1c4484741129720d906d5
SHA512 b0f2b210f2bfb698c672f8d636e9d6a7279774cce6c331c75f94e277acd466e68c0b39aa0b982a3c19aac45289ac377f22ed018203d2dea17e79a097a8aa582c
SSDEEP 96:KYbaKYIKOBOKyw6aEAKdieH6KYUOWb+KoEY:ExthXc5hZ
TLSH
T112E10822737B1342787E290CA2EA96378E4137633818A56F3B7840E50D67E615DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5a5561c2e162c48a233c628f8968c0905588c1e6d02d068099936dbb9d1c280f
MD5 784af742fc4634d6e2dc230a37f17c18
SHA1 5a9c035279d5ce1d1190cea738baed7b1dd3b741
SHA512 1a35981250c3ef2b7c0edfabfc7b78faccc2c88f85d0bfda81b25835e27746644f5091c5c30434a148cad479c0328a6fd00f0f90f32611d000107cb58bb8549f
SSDEEP 384:VZcIhsNcINEb3PYVRNwOqp9UiXzxuvzxV+MhdplfTod:thROHwOS9UiXz4184plfTS
TLSH
T18D827D717C345C779DEAA146F84736138EF89027A6CC5E80D1EE6F1C01DA6A9131FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3781cf45277b1bfb221d8523f3456d6c6bacef606678d713b83f605b1327fc0e
MD5 6fd825474fdbf9703eed601bb01de658
SHA1 1526edcbbd362ee165367bf15e6f20081f11889f
SHA512 adfaf9caa98e0205fdba925b66827cee87736a695fed00a5ab23f285d4bead8b33a89a2fd2dac3b0e55fd270157fb31d37fff0e42eb7dbb5173b7b54b69c04bd
SSDEEP 384:fFiZcIisNU8TUNTUlIlINEb3PYVRNwOqp9UiIzxuvzxV+MhdplfTod:fFQi5wgLOHwOS9UiIz4184plfTS
TLSH
T1F9A25C726C649C77ADFAAA46F94B32138EF49067D5C8AA90E2DD6F1C01D7198130FC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1bcd63a13ba58c9023610655348804df8fa40eed17037d5e6833f2dbaf896b8
MD5 59702f9bee32a1ab6081bd5edb3d92fe
SHA1 3ce97a7d239ec1a145438661bf326af849594091
SHA512 665af24ef52495eb03511657ca6634133eb6ac62fbdbb4a01992a9be362d83805afb283ecd01720047224f58b7680bae8e6473c6e222f39e84ba930e877211f6
SSDEEP 192:tONA6JkRtQmiUyZ/W+RNwOm9OmGh3IRMU6:tONA6UrGW+RNwOq6/U6
TLSH
T19D02E9357C382C7B9EF2AD49F98B27135FA4206BE9952F84DAD81B1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2c7a9fcbee3aa2d42577326a40906131ce87ca99b2ce745d6602b7b4ad9f071c
MD5 0e8b1ec285e41228b4303061fdb4fe8c
SHA1 90687f6c1319313637f7b8cd7de29d2777135a38
SHA512 1c61dfee3edae92ee7eea4b04e5af521e4e19f022c1c5f97f888a58d061071ee670ff580183a4eb8b6b116bae010e757c294458f457e947c4fd6cf7b708e9dd7
SSDEEP 384:uZcIhsNc5NEb3PYVRNwOqp9UiXzxuvzxV+MhdplfTod:Mh6OHwOS9UiXz4184plfTS
TLSH
T19C827D717C345C779DEAA146F84B36134EF89067A6CC5E80D1EE6F1C01DA6A9131FC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91ddbe036d85ae4f2f56f305d2c88b2900b26e113ed385a9cae7f2ee1eaa4c85
MD5 a6daef760e117a916d5d137cc4a4ac35
SHA1 721079cd59ebb24d744479a6db762c0d17017c0c
SHA512 5c0f5919f8aab34b3716db9c1eb584d6f58b2874091930dcecb589cc751ae3119cfe56d7adab882f099914a31998766f7eab2049ed927ea1869da39174edc1d6
SSDEEP 192:yJONV6JkR1QmiUyu/o+RNwOm9Om3l9Ui/VcMqxPU6:QONV6UTro+RNwOqp9UiezU6
TLSH
T144122B3178385C7B5EE2A845F54736135EE45127EAC96F80D5ED2F1C01DBA9C234BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56ce1db-3c5f-46f3-8db3-9eff1285df54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56ce1db-3c5f-46f3-8db3-9eff1285df54.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 876b7be5021afb8325793b5001a1518e9b5ebc311dc1745249ccd8023fa84f3d
MD5 99eb46f89134c7ee1709f53b6c33a089
SHA1 11ad8205273de2c65f1d0c2c05fb2a18b3d38ff5
SHA512 46beb16f3297dd1ecd440e0f915bd84ec4f1780007561a64ab5aa3a2d910c1ada73d2c3f02da71a9fd21635d34a60929bce10934a09072cfc6dc001a428ddeba
TLSH
T17F41FA5CA7EA1148B3B76F5A9BF7A86D447BBC372E06D56D00110E4E0B32B40D9A1737
MD5 SHA1 SHA512 TLSH

Submit Download