hxxps://u[.]wechat[.]com/MJtM7zKx1MHHLL4ecKWbcYA

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u.wechat.com/MJtM7zKx1MHHLL4ecKWbcYA
Sample260910-m7w7jabl6x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335120286534144"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6B8CEAC5-7A29-4D4F-B1C6-FFC4BEFBDDFB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 6040	5324	msedge.exe	87
PID 5324 wrote to memory of 5716	5324	msedge.exe	88
PID 5324 wrote to memory of 5736	5324	msedge.exe	89
PID 5324 wrote to memory of 5716	5324	msedge.exe	88
PID 5324 wrote to memory of 5716	5324	msedge.exe	88
PID 5324 wrote to memory of 5756	5324	msedge.exe	90
PID 5324 wrote to memory of 5756	5324	msedge.exe	90
PID 5324 wrote to memory of 5904	5324	msedge.exe	91
PID 5324 wrote to memory of 5908	5324	msedge.exe	92
PID 5324 wrote to memory of 5904	5324	msedge.exe	91
PID 5324 wrote to memory of 5904	5324	msedge.exe	91
PID 5324 wrote to memory of 5908	5324	msedge.exe	92
PID 5324 wrote to memory of 5908	5324	msedge.exe	92
PID 5324 wrote to memory of 5164	5324	msedge.exe	95
PID 5324 wrote to memory of 4852	5324	msedge.exe	96
PID 5324 wrote to memory of 5164	5324	msedge.exe	95
PID 5324 wrote to memory of 4852	5324	msedge.exe	96
PID 5324 wrote to memory of 456	5324	msedge.exe	98
PID 5324 wrote to memory of 5680	5324	msedge.exe	111
PID 5324 wrote to memory of 5596	5324	msedge.exe	112
PID 5324 wrote to memory of 5644	5324	msedge.exe	113
PID 5324 wrote to memory of 2224	5324	msedge.exe	115
PID 5324 wrote to memory of 2224	5324	msedge.exe	115
PID 5324 wrote to memory of 5340	5324	msedge.exe	117
PID 5324 wrote to memory of 5340	5324	msedge.exe	117
PID 5324 wrote to memory of 4904	5324	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u.wechat.com/MJtM7zKx1MHHLL4ecKWbcYA
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcff25c188,0x7ffcff25c194,0x7ffcff25c1a0
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,9180268562967907025,1956596087519233380,262144 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,7668819705723007041,1259376540901591605,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,11469848408087877519,11724214472885173845,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3752037126902167725,9792746460832346005,2097152 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,15708544330028834937,3073187573602633647,2097152 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9502184657927156648,12188795779148959118,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,8397103380263849346,8744130552180381405,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12508299680415923224,7123321861567701497,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12508299680415923224,7123321861567701497,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,16100942456478084009,11754744675402180094,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,11254017637301384857,7371823073264894129,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,16701640260683081089,12494929809006729288,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3369049921662731151,12348185316730868830,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,16053541041048674524,6467894955340967536,524288 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,10588029681711951300,12143392586386404857,262144 --field-trial-handle=2352,i,13802993573962257297,5760204534942764078,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c0da286beb15eccdc25653811a8f7bf9f1dedd0adc1629a2017c5a75d2359010
MD5 09394f37069f746e9e715e63c8564512
SHA1 4358103c9157f74bed40602bbfcc1144e0e21d4f
SHA512 b3b52e96ca53444e1afd2d266abe47d8ffbfe0838d6cfa22a27b7b26b0921cc2f47bbfcca24be9bc72f27732b5d32db2c08fc7a0b1821c2e80cd088a2ca99fff
TLSH
T1F0E022AAEC22EC275CFE0799A00D8A46E74013172A41895F3B3D82098FF063A95C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d87b0666b5f7f085a5324234cc41abd6f024d491c9f7eac385debc911950808
MD5 a3c23349f299bca87675dbd403723635
SHA1 22e60d29e6216d020c0f33c472cb3e5f60dac2b1
SHA512 a793a4833d9875a70ba50e11df568e6e2784706044d9d6734c3ee78292a0c6d2718a56067c518e21b230c9808d021015612782f4515214304751b1ee9d0bff7b
TLSH
T1BD61A13839528BE2EB10D2BCBDD4065075737EDAF6D30E2911503CF9262CB62C19A6EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c186.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c186.TMP
Size 3KB
SHA256 34a7c08a6fbd25b62ad779457148da3cfb0991b3c29ed480986a54ee30aee177
MD5 8c8e4a61940da12793bef9bb88752481
SHA1 7897d72b7b9491952eac0cbb1e1441712051e4d2
SHA512 1a8febbcff23a4cffe5088f1a7fe9d4fb6e5a1f87749513691849165af7f13361be9006a1ed6120a2ca6c0dd7e314d63b53ee481e461a7164d282f0465526db0
TLSH
T17B51B3383952CBE2EB50C27DBDD402907473AED9F5C30E6910603CF92A2CB62C15A2EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 59de724457598d1054cdd04fbc8419ae209547c18e980ce7812daf0c48fa83ca
MD5 2861dc2058a44fc46fe92eb7b4839ffb
SHA1 06f069f5ddd6fc0fcc5feacbeae849e068fb065e
SHA512 95535aa5373cca0159162fa09e66c268ffdd395b7a69b53134951cc175b3c2e97038c12566486515765287917ac549d2620d099e85c726344ecc5a53ba07d642
TLSH
T14731A2F783F4856E9A1196F0AA18BE1FCE5D0510432C7DAAC5E4AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6de1b42362af854593e3fb80621aedb7131a44f51ae06f45d5f6bff52983a855
MD5 9be91791686e2bd66199ed6aa83dda73
SHA1 a2f2d98411109b8ac4a8d3170ce4ed4c26956376
SHA512 825893588ba25e388edabf4ee0ab79f4956cd603346aa50c7c61995e1d317871c8d0adb16eb1e4280470cddfe956c8895c3bd667028cc10310eb0b2e156ff6b3
SSDEEP 192:sxZnRvyMqZjK1Ml8UQKk5/fxsK2ZdizodpAfHW6+WNi97/YvbCEYgIg5H4J:sxZn4qZ5/fxsK2zZ6HbY/0rRc
TLSH
T1B062FA16AA34997BCCDBD209F685BF53D6F90163A5904E44A9FCCA1C00E7BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 66334c3abdea677526e8d45552b380e92a9473118716ab6b5eebd20ea279e6c0
MD5 602d15751365d98365c671f61cd5428a
SHA1 f04ab458aeb7b097e5c382cb3e05109a8a806cf6
SHA512 ec10f01c4442b5dab7303297c07f7750b932448f903c5d4dddab5a95d24ed92032d9b505a421a2b5608a26197cd0b7653e37cdf32f46ecde4ba473b548369a28
SSDEEP 192:sxZnRvyMqZjK1Ml8Mk5/fxss2waZdizodpAfHW6+WNi97/YvVuCZYgIgj4J:sxZn4M5/fxss2wazZ6HbY/mrjc
TLSH
T1DE62FB16AA34997BCDDBD209F645BF53D2F91163A1904E44AAFCCA0C04E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 05482573c781ef1d3ec7c539673a871282a652f2787f59d9f46ab274279a9d9a
MD5 ad3fec8dbd82777da232afcaaf9f3d50
SHA1 02803553b7b908a69715664a77bdb88c3daa85bb
SHA512 3d4cc366bb1f1ec60fd2e9ab5997afd2db5df6af96135ec9d0405ee8b1b15746b61403ad6271f47d082ff7313b740aab3376ff449e630636e046f37aff9e760d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG5:05ppxnY753RNBvRJJdt7p5J9D7nu1g
TLSH
T1F9B2565A713E0212397E2948B39696364F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c657c2753aa554810c15e1f6933c2384b92eab774c87534cd337db5412a56fa8
MD5 800be55c3736ddf97245e658af147edc
SHA1 76e9eeaf4339aed114c74951f56433a75cf716b1
SHA512 6408d05531b01798c50f7f9bdb8a97a8ff19b3bc3d965cb8133788cbd1f9777d3976bc31d2c6eccce54cbbed075388a1207abccf800cdb35d8b2a6e915f9e6a5
SSDEEP 384:npviF9CcmyWCs3sNj8TUNTUlIm2QckCr9lCKphifGGY6sKbpwe4KV8p0lHrty/7a:p6Fccps3CwgbkU4kFGYa2I8p0V7
TLSH
T173B25B36EC58D9BBEDE74F89B74E7A07DEE0112785989AE4DAD81E0D00971DC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f4a8201fbc5f09508f28c4216f1b050935ebda10c833d468b44667a7960a79e9
MD5 f905726745b22ca2c9ea5ba94542d2c6
SHA1 c8c8f05c13a6bb77a7bd6ed96142f3c753841aea
SHA512 755a0b383f8829d1c1127580047fdda849f930a048bcda7cb0ddd62b3ab826642c8d3f1fe3daab4956306461501b7c4871e22e352ea131f1edeccf417f5d98e8
SSDEEP 384:nDiFiZcIr3sNP8TUNTUlI4tQckCre+9phifGGY6sx8rcJtxuvzxV+Mhdp1BKty/w:uFQr3iwgkk0zFGYBCcJt4184p1N8
TLSH
T162E2B2F198D79977E89E4787A77D2E029AFCC013B9889690B7D91D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7514ed1b625c527b91800d85ef669e7e9c9609590324a206cc545dfa302c8c6f
MD5 103d363aef72a41634cca04cff7560fa
SHA1 f17d7388fcbdd0772a84c03cf21ef620f0ecf1e5
SHA512 e9fd407930947397f57ecaa62a3ca80b4c0c37bc89c59d15c951780863e12de7def0f21f5cd51d6f34a548710e9f6027d4e32dda1a76680ac21875ead71178ab
SSDEEP 384:n+iFiZcIR3sNP8TUNTUlI4tQckCre99phifGGY6sx8ruJtxuvzxV+Mhdp1BKty/w:VFQR3iwgkkvzFGYBCuJt4184p1N8
TLSH
T11FC24B32E854DDBBFDEB8B85AB4A7603DEF48163898C9AD4D5D95E1D008719E030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e97bf37581c53feaef0d8935dcf81f641f69c662801e3cbaa01bba8586c1eb5
MD5 aa56055af5be0120d437b3ac6e15959e
SHA1 fb0bc99ea8322581d273abc7650a582615c9a01a
SHA512 f0a877bd1347f1ec5628a92ecee4fdfa8cd61dfb319ea1f8fbbb6006e3cfe24b43728f19de937a54fe7120cef0f2ff69d793a88254d7bd3ebee6fe0722494808
SSDEEP 384:npziFiZcIR3sNP8TUNTUlI4tQckCrJ99phifGGY6sx8ruJtxuvzxV+Mhdp1BKtyo:peFQR3iwgkkizFGYBCuJt4184p1N8
TLSH
T193C24B32E854DDBBFDEB8B85AB4A7603DEF48163898C9AD4D5D91E1D00C719E030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3bd97fff8441ff4b7e64a7b10e26ca8102ce8e6ca9807d28bcc60da6a72fe5a4
MD5 37c9ec93607283d06ab2b2a0525e0462
SHA1 16ae7d2579205037f487b5ba0c13161f649e606d
SHA512 c5052784bb33d24818edf5a308976034baf112f842a5df224f784549bc5720c38779bf21637b154d02267e58e4d1d94dc3e226df3c50ab8d8629cc6725521c13
SSDEEP 384:np3iF9CcmyWCs3sN78TUNTUlIm2QckCr9w4uphifGGY6sx8rPJte4KV8p0lHrty2:pyFccps3ywgbkU9QFGYBCPJtI8p0V7
TLSH
T1A6C25B32E854DABBFCD74B99A74E3A07DEE042238A8C9AE4D5DC1D1D00DB19D470BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43c977d49c7c5ec7b594278f0655d1c8bf0f90993e1b2d7f8e61252e541e40a8
MD5 46a8be1c3fd2e1f63c52112935e06bc4
SHA1 29b473ee6a43b49b9e236c2f1cbb6f7cc1386b4e
SHA512 bdf63aea19affba0e1718614f5e21112a3248a98861cc7f3be008afeccb91ad4bfc72403d68120f86d35f9d94093a849a6d6f2e7b4fb7d6d0f275499a1425dd6
TLSH
T14E413A58BAE91148B3B77F1AABF768AE447FB9732E06D45D00110E4E0627A41C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download