798583ab2464d3602a63a328c95aec829329a5253b3b2b9cea59979d38fb350a

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 14.6MB
Sample260703-mesnmsft5w
SHA256 798583ab2464d3602a63a328c95aec829329a5253b3b2b9cea59979d38fb350a
MD5 e70cd212e843b2f5169adf6e2762b4d9
SHA1 1c47db5a6c337519d5576d367feacf4d4a50745b
SHA512 e5a9c93310fd59f093f737edcd8d8135dddc6ab5aae2080bd02e2287f2e2494585bb3df589a9e90faba4f27224a4e3c6c86a41702c7a631edf4968137a456e11
SSDEEP 24576:X8BdGjZ6JojjZ6XxjZ6yCjK6SwRquT1mfgjr6ZjK6yjr6mjK6ajK6XjK6QjR6pji:X8Te8rn8mfRxs
TLSH
T1A4F6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275479951803564"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6A76BF16-03F3-4F3E-BB96-BA55F873D88C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1592	4656	msedge.exe	82
PID 4656 wrote to memory of 2224	4656	msedge.exe	83
PID 4656 wrote to memory of 4484	4656	msedge.exe	84
PID 4656 wrote to memory of 4484	4656	msedge.exe	84
PID 4656 wrote to memory of 4484	4656	msedge.exe	84
PID 4656 wrote to memory of 4344	4656	msedge.exe	85
PID 4656 wrote to memory of 4344	4656	msedge.exe	85
PID 4656 wrote to memory of 1864	4656	msedge.exe	86
PID 4656 wrote to memory of 1864	4656	msedge.exe	86
PID 4656 wrote to memory of 1864	4656	msedge.exe	86
PID 4656 wrote to memory of 840	4656	msedge.exe	87
PID 4656 wrote to memory of 840	4656	msedge.exe	87
PID 4656 wrote to memory of 840	4656	msedge.exe	87
PID 4656 wrote to memory of 2784	4656	msedge.exe	89
PID 4656 wrote to memory of 1820	4656	msedge.exe	90
PID 4656 wrote to memory of 2784	4656	msedge.exe	89
PID 4656 wrote to memory of 2784	4656	msedge.exe	89
PID 4656 wrote to memory of 1820	4656	msedge.exe	90
PID 4656 wrote to memory of 1820	4656	msedge.exe	90
PID 4656 wrote to memory of 1788	4656	msedge.exe	95
PID 4656 wrote to memory of 1788	4656	msedge.exe	95
PID 4656 wrote to memory of 3320	4656	msedge.exe	96
PID 4656 wrote to memory of 3320	4656	msedge.exe	96
PID 4656 wrote to memory of 4768	4656	msedge.exe	98
PID 4656 wrote to memory of 2528	4656	msedge.exe	112
PID 4656 wrote to memory of 2968	4656	msedge.exe	113
PID 4656 wrote to memory of 364	4656	msedge.exe	114
PID 4656 wrote to memory of 4552	4656	msedge.exe	115
PID 4656 wrote to memory of 4552	4656	msedge.exe	115
PID 4656 wrote to memory of 1744	4656	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe3a6fc188,0x7ffe3a6fc194,0x7ffe3a6fc1a0
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,5560089543772254229,18365164475913410920,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13915035254923501467,5255981683073728354,262144 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,17024732071768792805,16554301294251522823,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,13714218467153168273,14881868364128762829,2097152 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5678553319871993083,10704517496789233142,2097152 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,827586449009466688,3070222859294987320,2097152 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,16071501341754573589,6258392945389952623,2097152 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12861398429298137545,17535787143669561472,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8295940378100857060,17437282990421909790,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8262041974723406000,12108623923043412432,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8262041974723406000,12108623923043412432,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6477506260842774449,16916439285446868241,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17217605272342103692,6736472949297452343,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5339256192203885349,12260005927339930058,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8057726176761510634,15771361366561848851,524288 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,11600446873611515909,7544216290449470960,262144 --field-trial-handle=2256,i,13341652462978258480,10641702651330203416,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 393558edace7f7fdfd362633dd3876705ec9054b51ee90bf55a2c0e25f89889a
MD5 d579652894d397080e290c1d9ca9370d
SHA1 6e06805fc483fbc41a492ef5fdc0fd8697c20218
SHA512 1bcf9d588c1fd3b407059c91dd854153638e250b0ad6115f02fdda259aaaa486d2975d3cf239d3c25d024cce649337073e4e17b39ad5d6527aa1875ca4fb2efa
TLSH
T15161E87803B27CA1E7641C7070C60F4170B6CAE6FE4B5FC9D1CB99B71A1836D412659C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e172.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e172.TMP
Size 3KB
SHA256 d2d5f3c3a622d81e365a3d884a0f3ae7451671908387f6a0593dcc080269c133
MD5 8e9f9733474292f38a6cc36a03f771c3
SHA1 83176b4cb9ef741d06d4b02fe1856966146e16a4
SHA512 a6f15dc8ee6300d2ae7581393217f4b7240a537ff078305a8273608ec6f26948720c809675f61a729af2e91f1fde579a1756f90619af351b342abc7d02481814
TLSH
T12561E87803B23CA0E7641C7074D60F4170BACAE6FE4B5FCAD1CB99B71A1836D06265AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 41fdcc9c70c24fce8d1f11ab42051041e635f5443898bfd81eab1fd55014f400
MD5 22d7fa01e46c904fd28c2e7a49d3478a
SHA1 84a63ab9c4029b0c18563960bc31a06439c98cdc
SHA512 12e2a027f5df4d10a889bca98ae52e1e0fcc23926e647ff78ad15a3e17fb55321a6f0df3fe1aedd05e34448d1475ed3b00b7bb4c0a0f7756a13e96a8ae8f391e
TLSH
T1C0218EF383D5856EC91156F0AA24BE1BCE1D0505431C3C5585E4EF5BD3E3475E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10e9557f9b08bbc703c438e74cc018877dd9b03724b181cda3736031872a6878
MD5 4f8c2696ec28c4a5fd8e2695615ee8b1
SHA1 aa6fee36849e1bc7b8643aa408729a86fb5c3de9
SHA512 42ec018c6d62a08802bf6388b9d88593f87e245417ede728e9193a6b1753263b8d8c296d78a5487103329ff09b6aa302931e9a54db9adffb6edf8726e4310dec
SSDEEP 192:sxZuRcyM/jK1Ml8UQ6kA/fqsqXYCyIdpHYHW6+WNGY9IqaJTFkIg5KJ:sxZuaqJA/fqsqoI4HbGBFIQ
TLSH
T1AA52D8126A34997BCCDBD60DF951BF53D6F4547292A40E44AAFCCA0C01E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4b9829ca9212965423ca1e0b76f649a46547d891506b68a424a532390a014f3c
MD5 d06a295b1795de69e5254e837ee64842
SHA1 141401caf5e8c4c9dc1a95c10b16a9e44e6b6073
SHA512 93a126bf9a5da1bd059a94c3efdfb6ca31fd1adbb1fcd940ec819113534d16979c3c25d722f3b698c02c00e6c25fb7669e053175f27a8c1710bec6a8bdedd820
SSDEEP 192:sxZuRcyM/jK1Ml8MkA/fqs0XOCyIdpdYHW6+WNGY9IKjJTFkIgrJ:sxZuaMA/fqs0eI+HbGiFI9
TLSH
T13E42E9126A34A97BCCCBD309FA55BF53D6F8457292940E449AFCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6236a1a1ae5975f5865aa8963ed60c73207048d0721102b595220673000d66c5
MD5 1438d003962bea0501201e26395c9440
SHA1 c010067111971b1fb27c32771b4f63c32202a8c2
SHA512 381c19d9f6f88e4e45c5d2a83ef87382162ba5aa5c2545dacb678394b08036df61872e3725e8071874590889f51d7c1239b694577396c83cbc842f82b482d5aa
SSDEEP 768:yDcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNtroJg6s:yDcv21wWvu+Z+u1jaeFLeRNGJ8
TLSH
T1A8D21B2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1f593d5af9d90003ef53f5a345842f4851db8d98754f375b5760e1458a2f786b
MD5 48cabb8f31bec717a83b4d7d711309d1
SHA1 b66d6cd95f48ce4771d3a8feff679b21e8dfe54d
SHA512 dc21bf3c552abf9bdbb9e805f18189272a85d4e1c74b2fb66cb34614750f2750240dde73c8c4fbba19657550be1e8bacd9e48d9c2ee95494d3198ef917145c70
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD4D6HTNJ9wZx0jrbwKjlrlwnrbkFDd414xZ:mT4D6HTNJ9ox0nbPlrlArbkFDd414x1L
TLSH
T185918661713B0241387E6809B35696368E8279A3742CE56FBBBD40A14F27E176CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0796161c-41d1-45f2-a18d-20d132c0fb62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0796161c-41d1-45f2-a18d-20d132c0fb62.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 28ec207fff23d2bdfffbf3c33d4d8c24fb0825c1056e23fe87e8fbe3c11473f9
MD5 d9c7d255d5e43fc8d7a740b81eefcb88
SHA1 c21bebcc814155a352788e5c640f5d812b716213
SHA512 fa1334ce46a0f258ea856e93c49efbe5f868eae3e0fdb524ff54490fe7d539325d61386c94553b948f808ec8421ef7ea76190ec132f95afbaf501457510bbb99
SSDEEP 384:htNn/s3n9SfsNhoRmxnCziC2Que+CwOt/XclOObjI9G6w7Og:hj+9UGxni+QYOVXcl29Mp
TLSH
T157928D326C385D7A5DD29964F54B3A1B9FF881BBD7852F84C4DCAF0C02DB6AC530191A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0cea4adbbaae85d3cf23937b07e1ca9b9eb774689a78f61561941c7baaa39c3a
MD5 1843699d34016b399ad7eef53368b7cb
SHA1 6c33ee47d41a9511d8de7bce2fd4d39227eadc44
SHA512 5aa4aa23430a1d6d5cebd30e7848fff6b2a16bc28ce907a6ae30c3ad662c90c5028728d2ce8cb3d66f0258e2ad0d6bc9c28d1ea654f4c6ea6a57a1efc2b02ad1
SSDEEP 384:LiF1tNn/s3n9SLzsNz8TUNTUlIltRmxnCziC2Que+CwOt/X3lOObjI9G6w7Og:mF1j+9cewgYxni+QYOVX3l29Mp
TLSH
T1B6A25C336D688E7B9EE29E54F54A361B8EF441BBD6856E84D5CCAF0C02DB1EC0306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f1d644eff242579438c066a277005044f4b14e5e74c2746d084ce1b2a5627c5
MD5 d74cd9a38575b0c977e849c02342686b
SHA1 3b6b266fa150f98512f454a56ff105f44df4f3ae
SHA512 375c4da307b250d4fa45537ba00ddd0edfe2871d11e22daeaae440174f11aa3a29fa46961a60c9f35123b987e52c22354354bbea82be98c51f3b0dceec838030
SSDEEP 192:YONU6v+YLdQmiUyAhrh+CGdOt/XvCHiqFU6:YONU6vzXRrh+CwOt/XElU6
TLSH
T135120A327C785C6B5EE2A954F48736179EA49177EB853F80D4DC2F1C02DF6AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ad1d08de3e886370690dac265bf878ef342f83208b54c2002680ca9316660ae3
MD5 3f7ce1e13da9bab263a3505a27ed3002
SHA1 ee6895a898a3dc233f8674a0468125b2dbd18469
SHA512 df6773643b458f763cbb712c4794af3eb27b8bc96d7f94eea966f4a967288896803e682594c058e840faecdd12c938b8351920ab0378337b8a213ccdc9347591
SSDEEP 384:ftNn/s3n9SfsNhtRmxnCziC2Que+CwOt/XclOObjI9G6w7Og:fj+9Urxni+QYOVXcl29Mp
TLSH
T153928D326C385E7A4DE29964F54B3A1B9FF4817BD7852F84C4DCAF0C02DB6AC530291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5aaa766c698d73298ee19e4296b354f7824ef3a59fae5223027216a31de265b
MD5 38693a6aeb0181e77a2a1938687d315d
SHA1 b3606213de0683a84f406ac1e0a384fcbb5e62fd
SHA512 4b9c6506667399928f1cf20c15de0e91d7aecbb11907b79e787430ce86f9b879135479a298434c4d270f35852198ccf5426224ecbd5b436c3564424216c25aed
SSDEEP 192:JOND6v+YLNQmiUy8hZh+CGdOtPusik+U6:JOND6vz/rZh+CwOtbEU6
TLSH
T10C02E8356D781C7B9BF2AE45F48736279FA4117BEA912F80D9D82F1C01D768C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34c97b36-fc56-42bc-b3a9-96354013d051.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\34c97b36-fc56-42bc-b3a9-96354013d051.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 281508c9d526c32813dd310824c30d9d680ce8af1c083fd40b36605cf1a795d3
MD5 11dba82a514ea44bff80bfd2ae065b01
SHA1 e4b8be2e194bb772d0731c24f4e9242e83d4171b
SHA512 9cebbf5476b9b1242c70adc43dbabaa1941ec9302b057b9c5a12372fe34c07178cb4ca9faff4cc3a9c784fcb1ac20ee57b111fd3c6eb83c2ab420496ea3a8991
TLSH
T198413898B6E91148B3B76E1BABFAA86D447EB8232E06D45D10100E4F0A72B00CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download