a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 14.5MB
Sample260705-eaebfscy4p
SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
MD5 b5e57572cfb5efa08f55f46772a42ded
SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
TLSH
T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3932	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276987576591180"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{A882E3F6-55EF-4137-AA0B-AD939A5A3E9C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 3372	4332	msedge.exe	86
PID 4332 wrote to memory of 3932	4332	msedge.exe	88
PID 4332 wrote to memory of 4408	4332	msedge.exe	89
PID 4332 wrote to memory of 4408	4332	msedge.exe	89
PID 4332 wrote to memory of 4408	4332	msedge.exe	89
PID 4332 wrote to memory of 2960	4332	msedge.exe	90
PID 4332 wrote to memory of 2960	4332	msedge.exe	90
PID 4332 wrote to memory of 2400	4332	msedge.exe	92
PID 4332 wrote to memory of 2400	4332	msedge.exe	92
PID 4332 wrote to memory of 2400	4332	msedge.exe	92
PID 4332 wrote to memory of 4512	4332	msedge.exe	91
PID 4332 wrote to memory of 4512	4332	msedge.exe	91
PID 4332 wrote to memory of 4512	4332	msedge.exe	91
PID 4332 wrote to memory of 4744	4332	msedge.exe	93
PID 4332 wrote to memory of 4744	4332	msedge.exe	93
PID 4332 wrote to memory of 4744	4332	msedge.exe	93
PID 4332 wrote to memory of 3384	4332	msedge.exe	94
PID 4332 wrote to memory of 3384	4332	msedge.exe	94
PID 4332 wrote to memory of 3384	4332	msedge.exe	94
PID 4332 wrote to memory of 4928	4332	msedge.exe	104
PID 4332 wrote to memory of 3904	4332	msedge.exe	105
PID 4332 wrote to memory of 4928	4332	msedge.exe	104
PID 4332 wrote to memory of 3904	4332	msedge.exe	105
PID 4332 wrote to memory of 1844	4332	msedge.exe	107
PID 4332 wrote to memory of 5644	4332	msedge.exe	114
PID 4332 wrote to memory of 5652	4332	msedge.exe	115
PID 4332 wrote to memory of 5660	4332	msedge.exe	116
PID 4332 wrote to memory of 2580	4332	msedge.exe	118
PID 4332 wrote to memory of 2580	4332	msedge.exe	118
PID 4332 wrote to memory of 4008	4332	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff98493c188,0x7ff98493c194,0x7ff98493c1a0
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,8366094020350665557,2581528343200548210,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11448320573874645654,6185749168302521137,262144 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,13400439343331427993,2931840290781828066,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9158756265718527653,979946879996704447,2097152 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6225807588619939940,7731688398412251291,2097152 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,8235827211787345894,7703066945213200589,2097152 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,7080062244655281134,16021601835979705995,2097152 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10037612376419370883,7789625729392099779,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,781677396577919872,14095429973914196524,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,17827106941907207573,14875149601081040701,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,17827106941907207573,14875149601081040701,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,9572163808163061750,4487938014193130729,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,17499776196921528188,1028990690891808514,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,6309606791347442525,2768816932674106566,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,5175764754751768357,9525847799174709445,524288 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4108,i,7319105564632899440,2335289778528542825,262144 --field-trial-handle=2504,i,9710547650197658537,9141762719088248272,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4daba5d160c01ebedf1a1e869f676d6b27f25705239f3dca0abccd6d18ba7504
MD5 67544ee7a7349eaacae2ef59897ba9a1
SHA1 fa0259311e31f7f7d60f6796406a0aa3681a0b05
SHA512 d61e4b779cc76630aa1bd3538567f33ab99dadababfd091ca00683df2ebbdb6ad3f6156adcedf745c7833ce8206b67bf3f3d834bce13a1f934bfe895a1d30b32
TLSH
T1FF719F31B25040EFE7D221F220E2528974B0CDDAFD339EB1C15A52F1E639360B2282CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587c40.TMP
Size 3KB
SHA256 365946d62f3fef96a583d121664e91f19e936c86a82515bf4b04a668e8644472
MD5 baa00753857bf4c1773a85f1714a3efc
SHA1 975ca85c3678be1a9bf7f126b771039b30fb9672
SHA512 5a414f5de382b2ce36adab8b86213c76a5ea9e7c57e7580acb359a55827e7e465b72f2f8902edd9529b85b740c34e630eafe784b978d0cdee22dac19365746e2
TLSH
T12F718F31B25140EFE79161F120E252897470CDDAF9339EB1C14A51F1E639360B2282CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 efa28aeb0cbcd47d33d981f8b0d82231ba72f8cf9672be7ed32a5497fa5576d3
MD5 3626ae7880fb298277ef3392a3ec4094
SHA1 8678b1e1bde2bbd0402b3cddd969044a1cc7ac06
SHA512 583d70b77da1ef0e5fdf92269d1da0d9403c249f8d29a88287521a00d3e2f6d50dcea2d94f682062ea2c7bd3d114b434e7d955c12559377d4e260018b7c89da7
TLSH
T107117DF3C3D5856E8A0156F06A24AE2BCE2D0A06431C7C1589D4EF1793F30B6E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2c81295d182f15b48e7d9f5f81ac4737e5ba0bb67685a04d8de37af523a0ea6a
MD5 d3c4d61c7711d7f1ce21d9779c86d8d0
SHA1 fd3b6d24eb756af4fa132026575c118096f25ed0
SHA512 d3050ffdd3b3a4aba179c267950f140a4df1ccdeedb65761872c0ada52ff8098846af11f7fa5f6db8a5bdd7bb3478d38b1abb2caf03855123b671ce57193c069
SSDEEP 192:sxZSRMyM/jK1Ml8Mku/fHsymE7CIdpdeHW6+WNGYIkkl/IgrJ:sxZS6Mu/fHsr0r0HbGJ9
TLSH
T1A052D7166B349977CCDBD209FA55BF53D6F90462A2900E44A9FCDA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 22e0ee85ce4d39974680464fb745f5457710367f3fa69b44e60631f92c1e019b
MD5 94a8f583c0885c003e207d585a07a529
SHA1 13e0fc352390cb2f77730baeed8bbef67d0a8263
SHA512 2718e09ac045aabfd9d7271ca5df3a4e1e304f12fb1f62b1fa594a9642565e548e7744b6f63bc5a5f747453f009c7e0c8395ad6655a5fc41cda3770116b125ef
SSDEEP 192:sxZSRMyM/jK1Ml8UQtku/fHskmE4CIdpHeHW6+WNGYITPw/Ig55J:sxZS6qGu/fHstPr+HbGs5
TLSH
T12B52C616AA3499B7CCDBD209B945BF93D6F50462A2901E44A9FCDA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 609ecd34406a1fdc9d2e8ec842045a4a605df57bc909f985435f4ab2ebc6ac34
MD5 16d4bfc5b283c74bde89921b379358ba
SHA1 d9e76dd38bdb474e165c8e59d7bfb5f124b4c25d
SHA512 cbd4d69f0645ff3780b0648da8ae938001b046554e6b8ee3b32883c00e3b35657a81aef1267fd6ca94bcb97a30d24a74879a9616c274bb7f011858faebd2b765
SSDEEP 768:VpsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9iroJNJP:VpsqxXlWvJD6Tu1ja54LAs95JNh
TLSH
T113D21B3B694CC77E4F840E6DEC266FD76ED801CBA6988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 03bcec34ebdd85e154b4e8e26b6c653bd2a027610147d2a7ccc4de9b9e9b1588
MD5 8b79917bf0299a771efcbcdf72a20b01
SHA1 997ceded820dfab110bbb4fa65e72ed4c93b7719
SHA512 1563cd655d16d395012491e8bbda952e8ee3aabacacbff105c269be6fb4d84d9888f881de7b0323ee37c7aec3ccdd42f07eba18d47320a6352e9f7bac9f4e541
SSDEEP 96:KYbaKYIKqawK/q+KkgKtuTrorZrsr4rqr2rP:ExvrLiMN4cWa7
TLSH
T17B91F246327A1252387E2958B266C5370F8236633118F47F3FF854624EAAE124DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591870.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591870.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ec31aad61dd21dac8289018358c2070fab1063fcf2170ddcb818f5b5b2ad2802
MD5 6f9835d2f10b1f00b9b5dca6fb9c7830
SHA1 51924a54bc9fcad11beeb1efec60e4a42889b3ce
SHA512 45142e37040a07e87fa40ca4506dcc81e7c7ad785ee140788dca1bfc8cb3f0737027bf9a037d620d3e3698eeb01e3349d57441cfe0ed4a03b3cdd458d81e0ca1
SSDEEP 384:KiF1tNn/s3n9SIzsNG8TUNTUlIlCBsbt6OmTfVRNmOfI9xp7OObjI9G6w793:BF1j+9XvwggJ9TNHmOA97729MV
TLSH
T131A27C335C248E7B9EA68E55F98B32178EF451BBD6856E84E6CC9F0C02DB1DC0306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6b1b9b0247fc6e553e34fae91f0a95c1f35fd8b690be11c21c6da1b96b83b0b3
MD5 462ce5790ca5b82c628ffd8546c39f83
SHA1 537fb1c4ceb186e02b094bdd628baf3c756d4554
SHA512 c12270b95bc367d6573369e6be14beb2c94d5ebea1bf4b7722374ef0a326e9c249ca3e54266beeb28f0d42aed56b31d23b30c8d30470fcf2a9d53aa09e41f6c5
SSDEEP 384:4tNn/s3n9SfsNGXBsbt6OmTfVRNmOfI9xG7OObjI9G6w793:4j+9UfJ9TNHmOA9o729MV
TLSH
T1B6929D326C355D738EA28959F48B36178FF8517BA7C92E84D4DCAF0C03DB69C0316929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1fcb14e17f279f7acc1cccf482b07e9bb2747df44305dce05e3c030849029f52
MD5 32c249c583b5c6871605f28285b80858
SHA1 a99a97c2cceffad093cf168682264eb47f1c2635
SHA512 3a0a3db7b2913b09169edf8ca2c56f0a3bbdf1b864217111e1e9eb741165215d761cef0c1131278ba3c9d55416b5e43c6f5d32f7f65e844e9e15a2ccd9e7235e
SSDEEP 192:tONX6JkRtQmiUy4b4ZW+RNmOmoTh30RvU6:tONX6UrRUZW+RNmOflwU6
TLSH
T10A02D835BD382CB79EF26E49B98727175FA4207BB9952B80DAD81F0C01D765C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2a4bde3d4c1dc0fab365b0e0101191449cda2a7ad0a2c5b6b1754f9d64ab7a34
MD5 3bfd1522b90322f0c23d50378a9880f6
SHA1 fc39ac97c82d263ab251c4be2968351c2c7956ba
SHA512 ee2a8ce562c8565d98ac464cbb9d5c50aefda72c9d904fd43fdac77cc527bcfa19d1dd80070034377c91c3e7becde33b0446b2f0ebe7e148d440964c5462eaef
SSDEEP 384:ltNn/s3n9SfsNGCBsbt6OmTfVRNmOfI9xG7OObjI9G6w793:lj+9UwJ9TNHmOA9o729MV
TLSH
T1F3929D326C254D738EE28959F58B36179FF8517BA7C92E84E4DCAF0C03DB69C0316929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f79efba8ba2441e49ca79bb8453cc9f5d29781077d0f5e3e79ac725fd50e86f
MD5 ae83d0247b79c975fd65a70e506784c3
SHA1 d2298ee84a73e3c0938e64f0de36f0151819676a
SHA512 ce29ba8cee75be5515704f2b094f5ce47f457923cffa360f2618b253f520a199f4fc08497cc97bbde4dbb50e944bf62837e899065d0a5773c9c4923c4e0db55a
SSDEEP 192:hON36JkRSQmiUy40F4Z9+RNmOmos19RvbVcZq/oxU6:hON36UOR0iZ9+RNmOfI9xS7U6
TLSH
T17A12D83679385C7B5EE2A945F48732435EA5512BEB897F80D5DC1F0C02DFA9C134A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c5286e8-a339-4bb6-a326-d7be9d5211c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c5286e8-a339-4bb6-a326-d7be9d5211c8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d2c48996f884f320c8d56cb4d750eb70f1a0b7e09f54f2f81cf388782c4001a2
MD5 9ff434bd23340794826e4aceada5a165
SHA1 b4c28ef2cb6b5a1749239304d5e64084a6c00e56
SHA512 1f226de2cdfd6d860d00ed10ad188fb3e2d523ce6b99fd9d132f1e4c83336cdc50546875280222f53069e1f4a34be2300742e5f55de5a0ef9281e9ada1b8c270
TLSH
T1C041FA58A7FD1148B3B77E5A6FF6A86E887FB9771E06D05D10010E4E4A62A40CCB2737
MD5 SHA1 SHA512 TLSH

Submit Download