e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6

Analysis

max time kernel
899s
max time network
762s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 19.4MB
Sample260720-xd4pmab13q
SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
MD5 f18ed9a25df7c7951cb7f936ca9feeea
SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
TLSH
T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290471035317556"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A89BD2C2-05A6-49D6-A197-C4324378CF9E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 5880	3112	msedge.exe	83
PID 3112 wrote to memory of 3432	3112	msedge.exe	84
PID 3112 wrote to memory of 4880	3112	msedge.exe	85
PID 3112 wrote to memory of 3432	3112	msedge.exe	84
PID 3112 wrote to memory of 3432	3112	msedge.exe	84
PID 3112 wrote to memory of 3064	3112	msedge.exe	86
PID 3112 wrote to memory of 3064	3112	msedge.exe	86
PID 3112 wrote to memory of 5108	3112	msedge.exe	88
PID 3112 wrote to memory of 5760	3112	msedge.exe	89
PID 3112 wrote to memory of 5108	3112	msedge.exe	88
PID 3112 wrote to memory of 5108	3112	msedge.exe	88
PID 3112 wrote to memory of 5760	3112	msedge.exe	89
PID 3112 wrote to memory of 5760	3112	msedge.exe	89
PID 3112 wrote to memory of 4012	3112	msedge.exe	97
PID 3112 wrote to memory of 4012	3112	msedge.exe	97
PID 3112 wrote to memory of 2004	3112	msedge.exe	98
PID 3112 wrote to memory of 2004	3112	msedge.exe	98
PID 3112 wrote to memory of 2200	3112	msedge.exe	100
PID 3112 wrote to memory of 2432	3112	msedge.exe	110
PID 3112 wrote to memory of 4792	3112	msedge.exe	111
PID 3112 wrote to memory of 4620	3112	msedge.exe	112
PID 3112 wrote to memory of 5500	3112	msedge.exe	113
PID 3112 wrote to memory of 5500	3112	msedge.exe	113
PID 3112 wrote to memory of 2304	3112	msedge.exe	114
PID 3112 wrote to memory of 2304	3112	msedge.exe	114
PID 3112 wrote to memory of 1348	3112	msedge.exe	115
PID 3112 wrote to memory of 1348	3112	msedge.exe	115
PID 3112 wrote to memory of 5992	3112	msedge.exe	116
PID 3112 wrote to memory of 4852	3112	msedge.exe	117
PID 3112 wrote to memory of 4852	3112	msedge.exe	117
PID 3112 wrote to memory of 2392	3112	msedge.exe	118
PID 3112 wrote to memory of 2392	3112	msedge.exe	118
PID 3112 wrote to memory of 3944	3112	msedge.exe	119
PID 3112 wrote to memory of 3944	3112	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb05cfc188,0x7ffb05cfc194,0x7ffb05cfc1a0
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,16695117717582124936,12733767569856992542,262144 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,3694569116130907611,3887759845689321016,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,1421243173160022630,7890036985219818080,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,15674500676760617320,5535970368305072514,2097152 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6618018757524277069,1536860269902704940,2097152 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,297965422119401247,4230972119114504935,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16299609016266542957,8424636615753846392,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,15257230169834009157,14762173644563960365,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,15257230169834009157,14762173644563960365,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,5722622777962839482,10605168963033738042,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,9228748453331979577,12647296549234913436,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,17281124517672369524,814011748742730792,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11168347737355100918,257917662334279776,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,7589347824008143282,4169949516390136834,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,376415405826402586,7587920678369635314,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6296,i,6163300519259840382,2534527444281328844,262144 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,4193998978400327762,3559336337529259367,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11009518018375636224,15241976214652189305,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1520,i,5670860927135745988,4176410178334671403,524288 --field-trial-handle=2276,i,17503619797076472495,6022919396293487293,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f89d096d4931f102ed0d846cf7c00628e918bf6ece6e67672df102a3827d7001
MD5 df26a001d19a02865f3796364cdc5da9
SHA1 eaa88c3939bdb0b5f62c93b1a8a962eb7578ec6e
SHA512 e881032fa0b755ffaa5bfe96f40ab025af45de1280276abb3fc0c11281f633356a804feb4a4869cda2d7d425bdd5f22b67272724472a7610f8665ca0dfad767b
TLSH
T1D5D012B62A4A7110F2694A31B456CB00776D15A12852A705E22D944CA9A90B562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 5KB
SHA256 6b5bcf4e50864758f226d0a55c48a24b213a20d41c457ed14ecd73a9d3830522
MD5 c736dfa92055771fb20de622ce0a088e
SHA1 c14291b7bfc0593232b777f6c5a76ab361a5629c
SHA512 9388b18c02bc7a00c15f41d324ddd183c43d1e29477f2b8ef2d22cb852c3e7ebf2236868102e225829eb84ed8e4725b0197a33ea0d6f28b44a53753e5241c46a
SSDEEP 96:q/mJj1fzmJKzmJbzmJTzmJTzmJTzmJTzmJTzmJTzmJTzmJTzmJTzmJTzmJTzmJTW:zjEPOGGGGGGGGGGGGGGGGG5512h
TLSH
T1CBB1590782E4DBDEDB0510AA8DA4E35C0071770DEBECD50C178DA9ED354E8AEBAB5690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 59720a68b220f88b31176b3eaad7d9babc79da40a34627fe9fe773b2e0f43dbb
MD5 3c6dfe955493ff521f01379eb3b08254
SHA1 16c265ea5bff0eb6797daf45bff328445d6e82bc
SHA512 65ff574593f037a2bf860a4c72950b51b7aaf0f47ec2537b379c9567ca16c14266fbf3fd0813d3261caf9d4bc5cd1dfcebbba8f54a3304b5e2d08b1979deb4ca
TLSH
T1E1E086E809CDC6AEE318A44B416C530CC3D0762B97CA694F270998A87143548A7A36E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 226315f2aedd912c16d0c518fc4d0e9a2c896dc65ea3e687fff149c60de71a9d
MD5 74f27a645be219d396ada989bae4aa94
SHA1 db9aaae0ffe0048ea9b201b876145b9bf81fbaa0
SHA512 85185b01381d6c635b014a2ae6e0d1ef496afe0961ac035aa4e126180584329757c0a02d7f7c6b3a818ce4db8a638c6fabe5de7b92a12c538c3237d62a5d9b3a
TLSH
T1EFE026C418CCC33EE328A44B417C9B0C8280F60FEEC8698E370984983023650F3B2699
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 44c6742adc09038fc839fa16cd5728fa286d0eed902463a2fa270761cd9be31e
MD5 764756579527e32f843e9198fe49910f
SHA1 04a957486e16fadaa752c3d2885719a0c103bf63
SHA512 3e3629bf6c0e732a833182771c5bb743c1e9b8e0b3bb5ed0aa42314028ee9e2c76a95d0782fe13e30eba268a21137dafe69f71f9b85811fa6a80c678eda71512
TLSH
T1A7E026A444CCC2EEE311A4CB42AC630CC280360A93CA695E170C84A83242084A7A36D0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9b230b7952470b5a11c8994228adfb41967c624bc6c19c67181aca371b5b7464
MD5 458d2364547d020347eb86fc50fe21db
SHA1 e8b89f91fec932a8f05aa6a381123566f2d8e206
SHA512 858be406cd5b3904a045e2106d59ee78a1aaa8803b14137a0dd742c8bf125fb2e0cd56328c9b134a8aef062a522e45708b3c3ffc59e6a6e376976616fb30e5ee
TLSH
T102E022BAD822EC2B08FD0728A0098656EB8013172A51899F3B3C820C8FB462A46D985C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 566dd03a10e3dc5b80899edbe874c453b149f69fb0c019240ff43a1aaa09d0ba
MD5 1258143b9386380f58360e476100975e
SHA1 840d50dedbc439b57c5b1cbababf0ac6d589e379
SHA512 fdacfb2c4f708d04951309e3fd871b935ea94edd8563e5aac06bfc51782ee622a306f8597e7bc3b91927e18ff987f78f817842d23f3ff3d475e10b016f860f54
TLSH
T1BA31C1F743B4856EDA1196F0EA18BE2FCE1D0510432C7DAA85E0AF1793E3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a4e5276b56d1c93b6a8f69ad0e3366813904b52dabc37f6fdabd68d27c6512ac
MD5 329cf2797fd143f4c2594b06b0c9077b
SHA1 d9da7aba2bb93326d5bdb8e26771e75fcfb733d7
SHA512 7631b08c78e88353a9b53297c2eec133009628be06ad1a13fc425fc92bdfbb974b17c191e8e1c851488c669ab63624362fbf39effb84c5bf1e894730562a7e79
TLSH
T18431CFF743B4856E9B0196F0EA18BE2FCE2D0511432C7DAA85E0AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a1337f003b34ffb37699d0752d594d6d4498d8e64286d08c44a531accca3d1a9
MD5 cefb94d3139aa54e5592e7140b5710e5
SHA1 438d746f9a99b14747f3c7335a07d3b921e0bf15
SHA512 49806cf7b43f3c14f75f6627e6efa875b7c069249b1407c776b36bcc3860bd7c6f1f16de7e9387acd9eea5d64916c2d5dfc06950b23bb7b0f367899fa0b3d476
SSDEEP 192:sxZIvf2Rc7yijNKOMl8UQbCkbfd/f7+sb1/bDeHOZdp3f/zodpHIIHW6+WNGYvtc:sxZY2aiq9Td/fysp/bD/zxUxHbG/HXl
TLSH
T1D662E80A6A349D778CD7D219F645BB53D7F90532A2944E44AAFC8F0C05E76ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 57788b88a77bf456a263a5fbc627056bf074edeb5dcbeea13ac54a8a00c8b000
MD5 e18590132305a6637132413e2437af96
SHA1 de6f5477663d5d9fad9ff5b15aba887fd4863995
SHA512 2300fab8881aa55f5890a27ac238bd2a61765127d9decae933b8fcbf75947b64e40b2ad9eaa188524062bd9fbf8ec555ccd16d2a813705bfc5653ff5ef5e14fe
SSDEEP 192:sxZIvf2Rc7yijNKOMl8Mkbfd/f7+sso/bDeAaZdp3f/zodpHIIHW6+WNGYvIC+Jn:sxZY2aiMTd/fysso/bDXazxUxHbGrTjl
TLSH
T13962F9066A34997B9CC7D219FA45BF53D7F90533A1905E449AFC8B0C05E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cd7ca7f7c04d3ce14a6c1912fd74c95b22a9e70bf321cd592df1cce6be9e9808
MD5 7dac9e2760e1a6777dc1b87508f43a36
SHA1 2215d3399c6962a430cd21f8d89dcf546d5dad37
SHA512 f0b27a7c7a7e9e333d29a1683b0e04f0be43f63d6bff71737948236ab4688b946c3a2d381af4c74fe09aab7e8596ab7f3993b6ac642f1e77b2042c564a03f2b8
TLSH
T193E068B37EFB1850FCBF93CA203149A10009795098809D0F642AB2C325A13192016CA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 62969c5291966cd0125729e8d9983d83400a0f4b7501046985b5b39eed0cdd43
MD5 49e657655996332c9b9440e7fe85b50e
SHA1 0e47aea1a7698c1db1c867f8b9ba42b94f6b8cba
SHA512 e15acf36e2f8969ddeccef66de9bf61212917d1f9e08d55cd8ca883011518276508cb1a52f46aac362b5bbaf5f4a58166ecbde41ab85910847118c2b0d464162
SSDEEP 192:05ppxnY753RNBvRJJdt7pCuDw0uAg/U1wMC4LO9meNMgSHgjA6z0wqAsf0dw4SeW:0LppY93PBZJPtNx5gddZe
TLSH
T13CC28716703B0602397E3958B39686364F4235A33458E4AF7FB814A64F6BE225CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9e08a5c357fd154c1e8ad16524efc6165ad03b9d7cddd067fc6f599b203c6e32
MD5 66d6372683b1c76510a526bfac3b6424
SHA1 6547ebdd8962fad9d4ff496539cf893173d4164b
SHA512 15102b97ffde00b2f875dd346c9dbffe9cb44d269a1e758fa026508901d75d6faf360ae8ebcfca344c678b3cee7f0d077727a178f98596b401ee5d65327e05fc
SSDEEP 384:nciF1tNn/s3n9SV3sNL8TUNTUlI4sQckCrGrqphiftGpeK5DuLxOObjI9G6w74tK:HF1j+9A3OwgDklEoGo4aLx29Mx
TLSH
T1AED25B36E864CEA7ECE74BD9B74A3A17EEF44263858C5AC8D5D85D4C01D71EC430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f17e07756d9d4ecb936d3a17ccb06a6f153730f5d2ec44927dcd5285a92abc17
MD5 0214c550ea51d47f0f725bf29c3b663e
SHA1 edddb63640e8a195f3a56f372e2b876dd3b922b7
SHA512 a595cc09795a8e805f5f7dccac6f0857c520e7c723fccfa9c727f21346666a2c9799467ba95e4ca496d750a57ee6e48af1f4fb228a3bcdcf347004c002f9a2be
SSDEEP 384:nyiF1tNn/s3n9SYR3sNL8TUNTUlI4sQckCrGrqphiftGpeK5DkLxOObjI9G6w74A:5F1j+9R3OwgDklEoGo4QLx29Mx
TLSH
T158D25B36E864CEB7ECE74BD9B74A3A17EEF44263858C5AC8D5D81E4C01971EC430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1d4ad84c03c4e4738412076e38a8231761bee6475f9369d7967c2495800abf39
MD5 c080a3690f4d944cf15e667ccd23429a
SHA1 fc8ca5b681efa9e59c320de628308ac70ff2d9eb
SHA512 0d132512dee42422494a5ee6b4029ff64aa2d5d6bba56b89581c590be2ad9d0c79591e6217b704eabb99aa1364f927e84f6dcf2c3e126a4c0e97c8e69bac2759
SSDEEP 384:npliF9CcmyWCs3sNL8TUNTUlI4pQckCryrqphiftGpeK5DuLxjQzty/7Igy:psFccps3Owgik9EoGo4aLxjM
TLSH
T1CAB23937E8A8CDA7ECE74B89A74E3603EEF44163868C9AD4D9D91D4C019B1DD530B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 87c806c0a2d8c800ed96fb3904fe3e97a4c3376968ef90653f647367dd398125
MD5 451bd8f3278f99b583f6c30033d2b000
SHA1 5cf8392793e48ff9a8dc300829015e5a7aee0e2a
SHA512 0896132509a017857e1e92a6d130eab52deb8347683382da6a49e6f13c097e00717b73fead7d8f9bf5c3289a73e8e54eb1c5851fa06435349a1b6d12671dae39
SSDEEP 384:npoiF9CcmyWCs3sN28TUNTUlIm2QckCr9lAKphiftGpeKM4pYe4KV8p0VL2ty/7F:pzFccps3DwgbkUqkoGo5JI8p0VLp
TLSH
T108B25B36E868CEBBECE74F89B74E7A07DEE4126785DC59D4DAD81D0C009319C030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 32db8705f6858b9855a8d7a4b904b35b06b192bc65e71b768382abe00644019a
MD5 c65a69fd95b130086d693003ff5f6536
SHA1 dd098c6b0f9df46ef878f7ae7bb1dc861c1800df
SHA512 045ba1fdaf8f9de4d9c3b6b148c7ec92ca0bd9eea2222e654bbfdfb6d2119275b8ba40c1d4cfe8bb619ea1f7497dcab8b65d75a83f673ff9badf4c0d748e657d
SSDEEP 384:npFiF9CcmyWCs3sNH8TUNTUlIm2QckCr9bArphiftGpeK5DKLxe4KV8p0VL2ty/h:pMFccps3ewgbkUcFoGo4GLxI8p0VLp
TLSH
T12EC25C36E864CDB7ECE64BD9B74E3603DEE45263868C9AE4DADC1D4C00971ED530B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 286fcfa366c5cd28f1a0e34b0edf7c1dff015e896487cb4219233bb66fd04d17
MD5 5e3b3f4959da2580db1723ef3a0a8966
SHA1 30b9716199105ce53811cd568403455f424ca3a8
SHA512 2983d54a83d3ab4dc3444fbc7c9a419edfadad635ef20e4933535ecf3b19c25c08172e4d5571c376f4e98bf3ba6d2800e33784ee6f66101eed6687473e5f8a82
SSDEEP 384:npliF1tNn/s3n9SV3sNL8TUNTUlI4sQckCryrqphiftGpeK5DuLxOObjI9G6w74A:psF1j+9A3OwgDk9EoGo4aLx29Mx
TLSH
T1E0D25B36E864CEA7ECE74BD9B74A3A17EEF44263868C5AC8D5D85D4C01D71EC430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c72544da9b1b7bf7bbe07696ee63b35f03200680fd0c3ac00d7e682faa02bbf
MD5 63d208af7d7714dd00d0a0404192ae5e
SHA1 d4a97cda094dae2a7ae1c3db833b78b3f1720294
SHA512 8776fe12df1c7e66d37262559adadc38f36260322ab96fafc9d04e3494fc9a75b0817dfcaf3def40d3ef819114de6513fab99da11eb5bcb73858539dcbe1bbef
TLSH
T175411B58BAF91158B3B76F5A9FF6A96D447B78332E06D5AE00110E4F0727A40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2200-216-0x000002BAD85C0000-0x000002BAD95C0000-memory.dmp

Download