bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260620-ecnmxaet21
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2952	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264011188096689"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{0EFB67E8-74CD-48C0-86DE-17BB229D1A71}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1636	764	msedge.exe	84
PID 764 wrote to memory of 2952	764	msedge.exe	85
PID 764 wrote to memory of 1836	764	msedge.exe	86
PID 764 wrote to memory of 1836	764	msedge.exe	86
PID 764 wrote to memory of 1836	764	msedge.exe	86
PID 764 wrote to memory of 3576	764	msedge.exe	87
PID 764 wrote to memory of 3576	764	msedge.exe	87
PID 764 wrote to memory of 2664	764	msedge.exe	88
PID 764 wrote to memory of 2664	764	msedge.exe	88
PID 764 wrote to memory of 2664	764	msedge.exe	88
PID 764 wrote to memory of 1472	764	msedge.exe	89
PID 764 wrote to memory of 1472	764	msedge.exe	89
PID 764 wrote to memory of 1472	764	msedge.exe	89
PID 764 wrote to memory of 560	764	msedge.exe	91
PID 764 wrote to memory of 560	764	msedge.exe	91
PID 764 wrote to memory of 560	764	msedge.exe	91
PID 764 wrote to memory of 2024	764	msedge.exe	92
PID 764 wrote to memory of 2024	764	msedge.exe	92
PID 764 wrote to memory of 2024	764	msedge.exe	92
PID 764 wrote to memory of 4964	764	msedge.exe	97
PID 764 wrote to memory of 868	764	msedge.exe	98
PID 764 wrote to memory of 4964	764	msedge.exe	97
PID 764 wrote to memory of 868	764	msedge.exe	98
PID 764 wrote to memory of 4836	764	msedge.exe	100
PID 764 wrote to memory of 4560	764	msedge.exe	113
PID 764 wrote to memory of 2408	764	msedge.exe	114
PID 764 wrote to memory of 4212	764	msedge.exe	115
PID 764 wrote to memory of 3212	764	msedge.exe	118
PID 764 wrote to memory of 3212	764	msedge.exe	118
PID 764 wrote to memory of 5004	764	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc4d44c188,0x7ffc4d44c194,0x7ffc4d44c1a0
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,12830156635328514286,11602653729776623867,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11739797644922415538,981433687965895782,262144 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,10527851257903842730,16837443215605860306,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,14500997139330886825,2467175579939822066,2097152 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,14294978752617074274,671785890264495971,2097152 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,15670414181975335001,13223003616397133355,2097152 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,7605428176329971385,1715092842566831731,2097152 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15801642821305245006,16014646316389186989,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11810428655115641854,8666211939356572504,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17825607204401343951,649271487024100159,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17825607204401343951,649271487024100159,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10800417267637715571,14833995745034895250,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,105177143059779036,12318081240824422567,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,4986674650135717488,5768607581702703513,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,4988072852723226444,9739152931049911112,524288 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5440,i,4468391665559164917,15328202632471011482,262144 --field-trial-handle=2244,i,6572504812022236611,16694817635451129714,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6cd868ac2b923e575432b08ccf9503269f6a953915f97eaf3975bb6dcd3907b0
MD5 1eca30b268623da895506dbd81a72a0a
SHA1 5dc9b92e2dfc7e1f074e7ea42273f24e9bfaf87f
SHA512 a7a383c1a644b2450985d97423998913cd1cff3aec430f5a9c4990a79430a72597f9e556a2c24ed7b64ab01a86e665af8f79773e546c62c7ea25be8e38542784
TLSH
T12C717056B6A13490E32E8239F8D336D133B18C9E96C39D9132905C7F67177E0140ADDB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bfe0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bfe0.TMP
Size 3KB
SHA256 4444fb6d9f4223926c9dc47cb702de75781cb0090dd9c87e8b9f6b8e5b8ca6be
MD5 1a72752a702967718d56bc52b302e9e0
SHA1 559b81c7b82f7f31be090cefe2b26d670c13ebf1
SHA512 d8f727528227712656d5fb8aacc5b85702672fe206e82091cd17175d1302f1e0fea9b2528dc4036855d72f0b9499161a0f1c0641df97293eafedbb0c3d634d45
TLSH
T12D717056B6A13490E32E4239F8D336D533B18CAE96C39D9132905C7F6717BE0140ADDB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 981B
SHA256 ed0c0e103d8a91440d72324725b3224ac933333d2ad295ff24111b809bdeaf93
MD5 8e141ae99151bd69e0ce5f7541eb1bc0
SHA1 9fbfd29225f16df2bad9fa434873f2e522522133
SHA512 9bf409d6832af99fdc12b2c82069c61ae698b4077df24b37159de584c8c781ec205bd8d9359e8d7ed8d7961731780708dc4f73859d581152ac9d1da44ae9b44c
TLSH
T10B11B1F3C3D585AECE1156F0AA24BE1BCE2D0501432C3C1A89E4EF5B93E2479E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 680d89eb6a1780b9c80214ed246a120aad657c3ca17e056cc1aac5445c6e6146
MD5 aa6561e98360ebb793c61a27fdc112b7
SHA1 f67bc9983d3f5395d92df026788a75423725422c
SHA512 dbd143dbc03fcd407300642113ed105314157e5aae94805d1ebbc76832e1195512609c191b7a6797ac3ed1b1a59ec64ff14d097069a360df24f4932c4454f81c
SSDEEP 192:sxZNRPyM/jK1Ml8MkG/fYsfsxnIdpdnHW6+WNGYHjnUOuIgrJ:sxZNxMG/fYsf4oRHbGT9
TLSH
T17242F8166A346977CCCFD309FA45BF53D6F51972A2900D44A9FCCA1C05E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 64898a3d8144a0c570d6dc06cc4bd1452f8aa2399b379a26f31ba28e574af54f
MD5 bd30e9a8f5b4048b351f444a43cf2185
SHA1 8035eaa1dc074a723bd423ca190d227b728eec21
SHA512 2d962878b9a9c99bc91f858799a6026a496548dd562cf5bf3e7e576bba3721bc1f6ce988244ed847df660579cdb42c7350502e0d8595acc1a1fa8fb6baff4263
SSDEEP 192:sxZNRPyM/jK1Ml8UQokG/fYsxMxnIdpHnHW6+WNGYHKWEOuIg5gJ:sxZNxqLG/fYsxYoHHbGdS
TLSH
T1E252F8166A345977CCCFD209FA45BF53D6F51972A2900E44AAFCCA1C01E6EED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e31a51bae62d484ff5a70762363fecb9045631f61e30ec27734c0ae61ca2f67d
MD5 445fecfa628b7bc5b3e156e2861856b6
SHA1 57beaadafdd1a2bc0ea03833a6af1fb65b8b51ba
SHA512 17970d256e54555903e40ddee37cb57fb9f1832e5235652666a69312ee330a797b0eca7efc6a8fd486e44afa4303f7bbfec4ae6c49ca4fa9d80e6d8e6b366bfb
SSDEEP 768:lEUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R2roVAr0D:lEUZYTMWvg0Pou1ja7eLZmRNPD
TLSH
T112D20A2B280CCB7E4F844E9DEC266F867DD801CB5A984D5447EA884C03CB7EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 34c389583f83238eb681e9c50bd36f8e773420e364c92d042b3ff8953c3534a1
MD5 af778dfc8463e0f725849094a28e7946
SHA1 360b1a0d8bfb38c9ebed7cf0fb8df31c06c29a4b
SHA512 0a29cc21aa5678c2e78c2351eb5c38fce887fd11191b7a8d890efde6be0c2007f4a7416be756369377ec7d73a6be9209f3ee18f625fc3cda1995915fde307705
SSDEEP 192:ERRKNx7Dz4DExxBTz30pR8nRnXkXNizuS8w0hwl2qWBOUxySF8K:EW3kdizuS8w0hwl2qWBOUxySF8K
TLSH
T1DDD1F40270B71A013DBE2B0DA295876A078172637019742BBFE840B65D6FE385DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed597886-45a6-4e7d-9f6d-d4b6e4afd5d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed597886-45a6-4e7d-9f6d-d4b6e4afd5d1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ad6034e7fa77917bc681fe54475721a0746920ef986736d54b4b12f62872f0ef
MD5 81508a05b63d8e6f8a8021b7c4784f47
SHA1 b8d4fd10e2a7f3caea49ecabed555caad9840c68
SHA512 a1ca9f53ecafbb866508a4301fbda18a86911eb36b2cbb7001ab5e7f7e16299b351476c657e6042ed0d44ad7fd24cbc1fbc13e43d37169b35fc0bc48f789c1bb
SSDEEP 384:diF1tNn/s3n9S36zsN88TUNTUlIlxlgqCy66zX5od+P8yQXnUITGT0I5Ix9W:UF1j+9BZwgdR6uObnUi+0fvW
TLSH
T116A25B339958DC6B9EE69A85F50A32178FF015A7D5C1BA80D7EC5F1C019B2AC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a0db91568bae36b5ef7be7f247fb3ef7cb03c8bd657e074a00f07c1d87d5cdf2
MD5 f49df4cc21fe4c11762744a43d3273cd
SHA1 763306ea3e39614983a5e974356d1cacc487d299
SHA512 16680a4ec9db39b13fe5030e61d701364efc60f6579a96b76667d65aad27df23434bb784d902174d954309e6cc4c9e49549f2f5518218c9656230c0d01480d77
SSDEEP 192:yONH61VWQmiUypEgGX5Obd+jbjzoryyRAb/ap32fU6:yONH6WDgGX5od+P8y6AfU6
TLSH
T1E002D936A9686C6B8EE2BE49B44737135FD4206BEA956F80D6EC1F1C00D765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2f116dbd8cc13e4ecccf6125f8337e2c56f5a167f9190d104afd94647f6e2d22
MD5 b50a25e4707d114a468ca1f604d8b94f
SHA1 43ccc6c95d288e5d230215af5aa96a6ed893ec1c
SHA512 82ea5d4dfc7febbc645fc21588b01a408d0dde4bb774428b26aab88e49fd7f17d3ddf1f1571b803a9de32a521e1a3525182c2b9272282cadfca40df4b6347223
SSDEEP 192:OON961TWQmiUy7EmGX5Obd+jbjzoryyRAMX3jJIqaU6:OON96ETmGX5od+P8yQXVUU6
TLSH
T10612E936A468AC6B5DE2B594B48731139FE55167EB857F80C2EC2F2C01DF6AC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c1c54e4823a600ed11c499529a73ac21c49aaf68f4f4e138d00e546e0e050db9
MD5 e369c8fc486a27a1f56a5ec53b098b47
SHA1 03a512ebb099c499528e2cc234d7fc856329bbbd
SHA512 fb441abe53a56560f1df3838b79c060cb78c1da536d9b36dc3dc3aae6587fa53616c736ba6d78904dd000d1b8e85a2c024568470ecf052291a24065c6b6a3b98
SSDEEP 384:5tNn/s3n9SfsN0MlgqCy66zX5od+P8yQXPUITGT0I5Ix9W:5j+9UMR6uObPUi+0fvW
TLSH
T1D8928D339928AC675DE6A485F40B325B5FF415A7A6C03F84C6EC2F1C01DE6AC131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 911c20e5ef1a37830daecde1f0a7cdebb31d401bf74fecbe1708353cc00a2fb2
MD5 8128fcf73410dc1820e722442e297540
SHA1 a2ee6eca2fd104ccf91f8788c509f9688383773f
SHA512 193e1f182bc70b4df16865c0e55b04a6d197454c10c540977de15f52bfce2b5f94fa5133cf3823a657b4a0f27b08caebd9a4a154bafab28ea7db19bd601eb71e
SSDEEP 384:TtNn/s3n9SfsN0xlgqCy66zX5od+P8yQXPUITGT0I5Ix9W:Tj+9UvR6uObPUi+0fvW
TLSH
T1B1928D339928AC675DE6A485F40B321B5FF415A7A6C43F84C6EC2F1C01DE6AC131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b50ed0ec5a87c10b98d2f771c3ee2f20cf2ce4b26e086d4b3f2852fd0fbddec9
MD5 4032c32fd32284d60d73ba180a76c448
SHA1 f7d8f3c6b0cc34b1bfb5b7b228d2cc93d3030aeb
SHA512 5d464dba0d261d6fa3ce7fa299da8babc6829b559c9cd18737ccfed6a2a096c609bd7d2de7a095fe1f46d5b9d1f703d2da007f4e78591e46a24447f5e358356f
TLSH
T191412758B6F91148B3B76E569BF6B86E487FB9372E07D49D00010E4F4A26A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download