ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260704-evmtbsaz2x
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276123543752289"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{703E9F9D-19FC-4082-BD19-44FCD23AFF56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6112	msedge.exe
6112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2308	4332	msedge.exe	87
PID 4332 wrote to memory of 1004	4332	msedge.exe	89
PID 4332 wrote to memory of 3192	4332	msedge.exe	90
PID 4332 wrote to memory of 3192	4332	msedge.exe	90
PID 4332 wrote to memory of 3192	4332	msedge.exe	90
PID 4332 wrote to memory of 3352	4332	msedge.exe	91
PID 4332 wrote to memory of 3352	4332	msedge.exe	91
PID 4332 wrote to memory of 2304	4332	msedge.exe	93
PID 4332 wrote to memory of 2304	4332	msedge.exe	93
PID 4332 wrote to memory of 2304	4332	msedge.exe	93
PID 4332 wrote to memory of 4148	4332	msedge.exe	94
PID 4332 wrote to memory of 4148	4332	msedge.exe	94
PID 4332 wrote to memory of 4148	4332	msedge.exe	94
PID 4332 wrote to memory of 204	4332	msedge.exe	95
PID 4332 wrote to memory of 204	4332	msedge.exe	95
PID 4332 wrote to memory of 204	4332	msedge.exe	95
PID 4332 wrote to memory of 216	4332	msedge.exe	96
PID 4332 wrote to memory of 216	4332	msedge.exe	96
PID 4332 wrote to memory of 216	4332	msedge.exe	96
PID 4332 wrote to memory of 1952	4332	msedge.exe	101
PID 4332 wrote to memory of 4788	4332	msedge.exe	102
PID 4332 wrote to memory of 1952	4332	msedge.exe	101
PID 4332 wrote to memory of 4788	4332	msedge.exe	102
PID 4332 wrote to memory of 2328	4332	msedge.exe	106
PID 4332 wrote to memory of 6072	4332	msedge.exe	122
PID 4332 wrote to memory of 6080	4332	msedge.exe	123
PID 4332 wrote to memory of 6088	4332	msedge.exe	124
PID 4332 wrote to memory of 5532	4332	msedge.exe	126
PID 4332 wrote to memory of 5532	4332	msedge.exe	126
PID 4332 wrote to memory of 6112	4332	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff45cec188,0x7fff45cec194,0x7fff45cec1a0
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,12877296232782324204,17211535968575986678,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,1498282574272623684,5000172792985957433,262144 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,7516078054893553640,12486186368727377004,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1775478871869410979,2601049947876679405,2097152 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,7859035370431724367,12811482660988803811,2097152 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1586114322099284977,12057425956862047733,2097152 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,9128981881791157917,16253565300866739061,2097152 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,12256543948946302264,18080825773026739116,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,10742143465199979007,2332273710686397604,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15539777949741051683,17008527471666386400,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15539777949741051683,17008527471666386400,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,941864810647558784,12504153614829551257,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,6644004493185451785,12326564286793372209,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,7820494465541279060,14400324524493253234,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,18305797912143212460,3978113553999682692,524288 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5784,i,13288808215289745564,4954753760981343409,262144 --field-trial-handle=2280,i,2513035846006538542,7574791588745943948,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d8195cd3cca49521bd4add5671873bc8098c3028ab4382e4182a4d5cd7221f4
MD5 2b50c48cf85eeb063a1b4b45a1264f03
SHA1 0574f95dcbcec20c3768f86485647f2b1ad3ca13
SHA512 7e396d2b82061d6f1ba9f6ccff738baabac3a65c9c451d0865993b10879b12eff6257c28de1305fc87157097478b7bf445f343f345649b655b46c51e5d0f8df0
TLSH
T1AB81C639C20301A5DB2D01B8B1CD112C34FB9AE9FEAB1E958CD56B7678323D5E39825C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58da5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58da5d.TMP
Size 3KB
SHA256 e89a5d6f34b7be24c743a2c0e575bea1609140646d056bb41899864ad21f984c
MD5 5af19398d8c0fa6dd61859336221f5cf
SHA1 239f4f2dcc9ccc2238d895d0c7d85887719930bb
SHA512 c23b3123ae380aab616e110aec184c76cbd61ba0e7c7fff06e1209e14caebbdef7f3e8923b2f395f1d48d593d421798a034bb17b3ce7e138bc8b80b8a3c08b55
TLSH
T12A81C739C20301A5DB2D01B8B1CD112C74FB99E9FEAB1E958CD56B7674323D1E39925C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 67fcbe95f8014b42e0785deb3bc9ac274a1dea81522b0b5a2b44589c3b5adfdf
MD5 65809eab4c50e5d2543e2aa6b25367fd
SHA1 e6755a1925830ba5bc3362217fb27c04b07fd79b
SHA512 363be94f039ffadb2e75807a0cc775adba219258c18ef175fe25ac88b931910304ab7d82d7248f6de5714943f95dfcb0e2ca468c36733b0e41f74e6605c8a7e1
TLSH
T1C3117DB3C3E585AE890156F06A24AE2BDE2D0506431C7C15C9D4EF5B93E3075E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 68762958775137e13fb0f61982f8f5460ae8ca5cede6628c7398b818d1779df5
MD5 291ae7236b976b40b7a6bc392cf514c4
SHA1 caf76f9150f4245f67ec4dae577fda881859bed0
SHA512 037bb18dda336d675a91cd58c3c32aa1a05ff31c30fae54bf77bc8c7ff10337a1472bf9b7100a71872542fb36b5b54f8e8567ff81baf0e130591f79903f0f8d4
SSDEEP 192:sxZYRdJyM/jK1Ml8MkK/fcs+1g+4nIdpd4HW6+WNGYzQ24IgIgrJ:sxZY9MK/fcs+y+r6HbGt9
TLSH
T1CD42C7126A34997BCCCBD209FA55BF53D6F45462E2940E44AAFCCA1C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a705179539c6f10a454db8b42462c80fe6eb2b6631afb2d68dacd3d5b1592c20
MD5 572b4e7a489bd5996c778476f879e09e
SHA1 ab61b136df0982b00700e4b0b74d62f3dc500873
SHA512 d0e4d07c7cbd426a9bac5f4bd5f0dc4aa7d7a7b3d90c45f845aa5c16c9d0615f2bb4125713c74628cd07c4d2a3ddda413d462180971d1039bcca0609627bc5aa
SSDEEP 192:sxZYRdJyM/jK1Ml8UQbkK/fcsb1P+4nIdpH4HW6+WNGYzX94IgIg5OJ:sxZY9qwK/fcsbd+rYHbGFU
TLSH
T1AC52D9166A34997BCCDBD209FA45BF53E6F45472A2540E44AAFCCA1C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6aa27ff05501d98096367ccc4604d19d3330618f67964f164780bc88aa7c5600
MD5 b2235b2a5482f39593a64258f3372cc5
SHA1 2d87583b7e506add137300f8ae99f69e18e59bca
SHA512 b4a7385c100b0e809446a1236a4cc6e0a1af66e079cb93030c57dc9607cb3153795de7dfd4fa5b26534105d9ad81527c53ad4e5d8bf8be6a9e3003c77cc9e164
SSDEEP 768:JcW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjiroIVixY3:JcW7kf0Wvqidau1jaa5LA3j503
TLSH
T1DED2FB3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2e1fba317d81a82d44d0eccc9817d502fe0b88444f7c3c4f72adcf741c5f5f0
MD5 586e7db269706b06647904fbd6123dc8
SHA1 bc336470f20edb4a300b65b9cabda207ad1d20f9
SHA512 667bef36fde94320cadbb89345025454439c32593172614c1efa09fcabf582b9e75cbb7e146c919773380c9ceca0250cc3879ed6d783839c6e660921fd94dcb7
SSDEEP 96:KIbCKcjNmKeQqCIwKJu/8dIsGK+MW6XXg0MK4Zgr:s6prG8dIsGK+T6XQ0wZgr
TLSH
T150918A52703B465138BF298892AAC6368E4375633418E87F7BB854B21F67E124DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597536.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597536.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5134f0a87552036e49f7a2a6b30cfb6fdcd1e96e47982a0f58cb7a117317a581
MD5 757b0e968fa52cbf06c1b0f403c74d5e
SHA1 f166ce1b866d8e8a35ecd0ec83432260678f5131
SHA512 7c7fde0de519d7903467d5894a35c3dae5fed2ed929a65a464fa7112e5f868d690897231fa426e57fa0ee71d0ba288d20e3c930a4bcf62f71dd019c188e69470
SSDEEP 384:W6iF1tNn/s3n9S1zsNC8TUNTUlIlorZXbA2wGdpqFyOObjI9G6w7iU/:eF1j+9enwg+h5Lwy29Mb
TLSH
T126A27C339C64DA3BAEA29A55F54A36179FF841BBD6C46A44E7D89F0D02DB2EC1302805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cfce372742ead231ffce91661591f46b81d0b4c11a50d18388693664ba226026
MD5 61b09758995d456ba11463d5a8b99a04
SHA1 ea13d0cab34717f837c096b5abc6c1821301aee0
SHA512 2a35dce39c471b5ebcc2c72c0a072a7047da9c61fff72890e9e5f872629d6b0e50636c5597923e19c913c3b9a4838c78c9c07022854106ed8af69ac64333df5e
SSDEEP 384:PtNn/s3n9SfsN6vrZXbA2wGdpqUyOObjI9G6w7iU/:Pj+9UJh5LHy29Mb
TLSH
T147929E366C75AD2B8E92A151F44B3A179FF8517BA3C42F44E6DCEF0D02DB6AC5312806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2abc5e329ec30b2bcd5974c7fce32a1e48589af66d869c74aa272f7b68118ae0
MD5 b3f2a54402407802528352d9c4dd4998
SHA1 ee896e0234cd8aa4b208df54c57f15bf014ed48c
SHA512 323da579465b19259275df1b4597c295fb832de7c4f9e6ff0b2ffd37dbba552a54f0c5971d6e81bc1a4054b5414f2a21ed39534a43b19067f29deddf77ab5884
SSDEEP 384:+4tNn/s3n9SfsN6orZXbA2wGdpqUyOObjI9G6w7iU/:xj+9UGh5LHy29Mb
TLSH
T115929E366C65AD2B8E92A151F44B3A179FF8517BA3C42F44E6DCEF0D02DB6AC5312806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebe3fe4d53776591e61e082b0b10fd7b7d0d5a0fb263c16795f107f220da7c01
MD5 64b23ffe0ee9cf4142f66f3661a9d1df
SHA1 d54eacb80ba76bc2ab3f16383c98b38301782da0
SHA512 dd13ae30de4de823a59c7ff87274b7c58f871db7556aa4a508dde24fa462f2bbf76293af34cbc907d35dbf92b7446ae170788444bc1d22f72b553d511a7eb3ba
SSDEEP 192:MON064BAQmiUyE1rW5GBPKT++FdGsfaDeouU6:MON06eAzNW1dpcPuU6
TLSH
T10402FA34AC756C7B9EB2AE45F48737175FE8113BF5C41B44EAE85B1C009764C234382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b7b4332463362be44b1aeefdb065c7f9857042be95e304f579ce234ec3c402b5
MD5 13477f3d306eeb7f5e8e005d2794d407
SHA1 58d7332eb78a4036711ba6e128f3f044aa670ddb
SHA512 cd8571669cb8a0c9bac4772deaf716c2426655932823a5cd6fe3a597d783f9b7813203dd4a322debf944ed2cb67feea535075baff68c85cb835fc5f156ff0594
SSDEEP 192:WONr64BBQmiUyWrw5GBPKT++FdGsr2PNbWwbqBU6:WONr6efNw1dpqnyU6
TLSH
T1DA120935A875AC2B5EA2B541F48736135EA8413BFBC56F44E6EC6B1C01EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e725e74db7f694bc03f8e7a2826bdf82bf34595d2ed91ef953df78295149d943
MD5 4e782b55c2ea239ffce59808de1e885a
SHA1 44cad296896f53430bd69a09dc63a389e313acfa
SHA512 8b56d1d60bfa6e26c3930bd3900d740542bc1fa365149757609fbf837ca46552e2abc0b5d10f158516aa0e16db7b5fd13520326f496b58f5d7dbfa291ac57cec
TLSH
T11A41EB58BAFD1148B3B76F5AABF2A46E487BBD772E06945E00110D4F0663A418DA1B33
MD5 SHA1 SHA512 TLSH

Submit Download