ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260731-anyvsshj5z
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299311275899336"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{44B345C4-87BA-4BF0-8F97-1968DE17FFE1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4400	4280	msedge.exe	86
PID 4280 wrote to memory of 1836	4280	msedge.exe	87
PID 4280 wrote to memory of 2420	4280	msedge.exe	88
PID 4280 wrote to memory of 2420	4280	msedge.exe	88
PID 4280 wrote to memory of 2420	4280	msedge.exe	88
PID 4280 wrote to memory of 2716	4280	msedge.exe	89
PID 4280 wrote to memory of 2716	4280	msedge.exe	89
PID 4280 wrote to memory of 2132	4280	msedge.exe	91
PID 4280 wrote to memory of 5000	4280	msedge.exe	92
PID 4280 wrote to memory of 2132	4280	msedge.exe	91
PID 4280 wrote to memory of 2132	4280	msedge.exe	91
PID 4280 wrote to memory of 5000	4280	msedge.exe	92
PID 4280 wrote to memory of 5000	4280	msedge.exe	92
PID 4280 wrote to memory of 940	4280	msedge.exe	93
PID 4280 wrote to memory of 4656	4280	msedge.exe	94
PID 4280 wrote to memory of 940	4280	msedge.exe	93
PID 4280 wrote to memory of 940	4280	msedge.exe	93
PID 4280 wrote to memory of 4656	4280	msedge.exe	94
PID 4280 wrote to memory of 4656	4280	msedge.exe	94
PID 4280 wrote to memory of 4948	4280	msedge.exe	97
PID 4280 wrote to memory of 4948	4280	msedge.exe	97
PID 4280 wrote to memory of 3396	4280	msedge.exe	98
PID 4280 wrote to memory of 3396	4280	msedge.exe	98
PID 4280 wrote to memory of 3024	4280	msedge.exe	100
PID 4280 wrote to memory of 4124	4280	msedge.exe	109
PID 4280 wrote to memory of 1472	4280	msedge.exe	110
PID 4280 wrote to memory of 1772	4280	msedge.exe	111
PID 4280 wrote to memory of 4788	4280	msedge.exe	112
PID 4280 wrote to memory of 4788	4280	msedge.exe	112
PID 4280 wrote to memory of 3064	4280	msedge.exe	113
PID 4280 wrote to memory of 3064	4280	msedge.exe	113
PID 4280 wrote to memory of 2664	4280	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7ffbb072c188,0x7ffbb072c194,0x7ffbb072c1a0
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16063112127308886091,9948384670040862205,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1448239235394907645,4802852978879798445,262144 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,16655765430817484429,1338874404784287228,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10030546196411367049,7678282081034262722,2097152 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,2637945759872142992,13495236707669481104,2097152 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,12482257826527918190,4474475215151318233,2097152 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16597713202726691561,17261621773441897845,2097152 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,8500391104750779441,10293841282726790204,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10733429044073400012,3139432759098707665,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3154516570566999633,6301326084226102935,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3154516570566999633,6301326084226102935,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,12750838626415730368,9915018007561591012,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,9138004779993157772,18164776745654168755,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,10053534365259695877,8552802599980882603,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3084,i,1940261452703159419,958210672138247071,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,11949013050400803665,14978690214040757193,524288 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,853583125299670895,9745697373069130150,262144 --field-trial-handle=2104,i,5075244907414449298,10759730877549162890,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4844c3a6e7312cc82f12664d572370e6386c2cf023b920761d611fe98ae25e9c
MD5 c7132278a5f64b04ede18385ec6e0e80
SHA1 0e17bf37850f073540a725006d463b4dcf3473b3
SHA512 046f700b9f8ee54cb2e6c6c504dc196060b87882035fa65cb992dd7e4435b7e5f4bf5c9b4e540d9b9130f40a153215efede4e998eed858396b619a141bd58878
TLSH
T1EB61C42905F634B8F761C23096D21633FD728CBC795F9E5105EC6C72F90EB290756908
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f46d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f46d.TMP
Size 3KB
SHA256 10284f51a916db0a7c477f847d4df012235cd8001f9d8385142857bfbbe367b3
MD5 76efa5ccb31a7f97172af1b5faa092f3
SHA1 68b42d8b0c144503d3e05ddfaf7f8ad7ef11c12c
SHA512 1d1a88b4cae7e29682670cd385c8909036b42f2c932a31b1aa27df90f0a08af480eeb65b82e9b6f01aa307b97dd85f43abdf1cc1be212abaf1f2823366509c15
TLSH
T19261D52909F534B8F761C23095D21637FD728CBC795F9E5104EC6C72F90EB290756908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 81bb2a47285aa9683286d330a154728d1c3248a3895f2b2c30928a285c0a28ab
MD5 28f1f826df601b5ed97f019bbed6a99d
SHA1 d72a8d8d89cb1faa42ce539aeaa1bd02a5142314
SHA512 5ae7ddcfa83fc99f86ab4af216faf766a3b91c9c21bcaa27febf08146cb5de26a0909d8189fe8b5790fc3a5dcefd78f871cbf3198daae011b6511599a7270968
TLSH
T1BC115BF7C3D5856E890556F06A24AE2BCF2D0506821C7C1589D4EF2BD3E3475D00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dcc0109e620aa0051ea70455743274db2fc11a3922eaaaa51f0a207d3372f62f
MD5 7b06add7af8debf7ebf3e2915a08e09b
SHA1 5804e67d25cb1bebedd601da5ea85a2ab89502b2
SHA512 fb972957c9b1f2d689ca9cc93c63038d8949c10b8f3f35129374a21a7d25bc05888951fec1fd79226b24c0e16f8fe4b466438d2d6dc30e6a187fa3c0bce61a4a
SSDEEP 192:sxZ+RpyM/jK1Ml8MkZ/fYsRxuYIdpdvHW6+WNGYHjBfqIgrJ:sxZ+PMZ/fYsXup5HbGV9
TLSH
T1CB42D7166A389977CCDBD209BA45BF53D6F50472E2900E44AAFCCA0C04E6AED2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 148c528c1e88d4679a943302a73fc184b1e33ade0ab2092d33eddb61550133e9
MD5 f4ca6cc302d237eada6f7120c631067f
SHA1 7324493805a879a6ea0a6cde682ab59f9be9fd80
SHA512 2fbde275ac4e3bb178623ca9e382b2c32255e6b2298ea4fa6ae04213aab60a875e2e98be3ec7ead12d0cfa346af3d16a824978e34099654241d03ef43dcf93c1
SSDEEP 192:sxZ+RpyM/jK1Ml8UQ1kZ/fYsSxwYIdpHvHW6+WNGYHo8FqIg5VJ:sxZ+Pq+Z/fYsUwpPHbGjt
TLSH
T19352D8166A389977CCDBD60EB941BF53E6F54472E2900E44A9FCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1af0f64edba96b4d2a771909fb205a9953e6002c21bd35d8623cb371183a6c65
MD5 0e0788d2a62f1ff542c18c75ef576b00
SHA1 9842b6613f786ecdf74c9276bb30f9bda566b746
SHA512 25d613cb5edfd1a7e59bced0332c7e921d509457a2f8d6b253ce00c9a20d68d44b41a9cdd0a70975235068692baed6fc4018477864cb687ed55292167aa07e64
SSDEEP 768:NYUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RqroVN0B:NYUZYTMWvg0Pou1ja7eLZmRB4B
TLSH
T1DBD21B2F280CCB7E4F844E5DEC2A6F863ED801CB5A984D5447EA894C03C76EB112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1fa5db791ae6014eae80cb26b35f20874aae2f89bf37b876c09e09fd883e7ec8
MD5 c6b68c8995382683308b40b39ef1a067
SHA1 3081b976c92f30faea6cc37428cfc455ed2b0a2d
SHA512 3f02d4cfc6be4ab6ca1415c80d03fa9e4f3c21cb7b031be7f444e4e61b0d77836c59496321e5556d02efe5e9f8dc2a29a0f6ea48f399beddfc80da03360c7b3f
SSDEEP 96:KA1eK2A8e8KziWa+EKLqUy8K7iSiKkKf6H:EWDXgfn4
TLSH
T1BED1079670BAD2513D7F2B088794C7568E8273637418E52B3BAC40B65E27E249CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f798755-fd94-4060-8e68-f44fb6ecabc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3f798755-fd94-4060-8e68-f44fb6ecabc3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2b269977914e855de1d50c94e7746c100bb9360c2124fecc22d665509d5a4c70
MD5 1b7cba77bf7bf1fdea09c05f8404217f
SHA1 4f67a58edc4d202c8ecc30f3ae595e6576d341f1
SHA512 03954de363c101ff6957e60119337163d4907e6806150fa120dcdf9301ea3bf5864e69c63320e401943e02fa0e74b77c209f12bf43146f19880a08209ba0b01e
SSDEEP 192:uMLsNUTQldSctbmB5QmiU1rnv4zX5Obd+jgjzorYyRNMiX1z4QeqCU8:RsNUTUQibGFAzX5od+s8YxiXHeU8
TLSH
T1B8321B366878AC375EE3A595B44B36135FE4416BEB842FC4D6EC1F1C019B2AC131AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 0e4df4a40b8a4b045c020d31f69799a22600f0e9d1c29e6c53d242a4cd5a6a4d
MD5 370393a254fb5a022635362da2b34420
SHA1 83471828b94d1885e67f7cd102a4a2901a3a1f14
SHA512 92ea37d041a4eafa1cbaecef36f3be830f5c4ddab97f6e3911a6760606e9fc3fc5877b06dea27f5b292085d8a7f68ec42b5469298a2214a6cf91a0c99eb91ea6
SSDEEP 384:bWiFozsNc8TUNTUlIlCUQibGFAzX5od+s8YxiXReUA9:ZFUJwg8oOlaReUA9
TLSH
T144620A375858DC3B9EE3AA85F44A32139FE441A7DA85BF94E7DC5E0C019B1DC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 788388c522ac58c02ab23b7631800ae6fa3a4e966c44ad3f58b555c2d4304403
MD5 9b0df48cf9d1a8cffebf576b1c41013c
SHA1 c9e6a0e21d655dac6f7267bf211d909531bb5b52
SHA512 6c00d92b5a4bd454053e02ecb16728b1c32731f4633b0c1a4815e547f3c7fd9228e81d0ba13bd9125ab79f0206903e18de44765ab7e96cc037457caf82798a23
SSDEEP 192:yONn61VWQmiUy2vgGX5Obd+jgjzorYyRNF/ag3PmU6:yONn6WDgGX5od+s8YBwmU6
TLSH
T10602C736A9687CAB8EF3AE49B44737135FD4106BEA956F80D6EC1F1C009765C2346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cad2802bd1a35d061f72f93169395a5aef9de4652e3cc63b17c09656e0e74c3b
MD5 71b845a51dab42b2f517f1ebeb6f311e
SHA1 c8733a4e22226b1dae2e0caffb27f8a8bc469d5b
SHA512 7b808d690afc8eb14c4c5264adbce012ea3cbe54f30daec337d6e2537c9b60c1474bbae86338ba5a6ee834d2d96c5053c1a54a02e208c012fb23fdfac10af181
SSDEEP 192:uALsNUCQldSctbmB5QmiU1rnv4zX5Obd+jgjzorYyRNMiX1z4QeqCUt:1sNUCUQibGFAzX5od+s8YxiXHeUt
TLSH
T184322C366878AC275EE3A595B44B36135FE4416BEBC42FC4D6EC1F1C019B2AC131AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e40ce1bc779e4489a675157982449f5fad6753976b3e6bcdf66989a4627cb139
MD5 20a9321aef18561957fafa0c6ca9256e
SHA1 9e300ab433d3142e3fe346340a692c69776d80be
SHA512 05697c6fdd9e7efdcb537e3e2e09f1cce3915a5baa2cbeb1583c0f52640332c968f9414acb83a379248f3669f9099550c01296aba81cf0f1ef6e79b1637d9d66
SSDEEP 192:kONV61dWQmiUyFvgGX5Obd+jgjzorYyRNMiX1kjJeqCU6:kONV6SmgGX5od+s8YxiXieU6
TLSH
T106121932A468BC275EE2B995B44B32135EE5416BEF897F80C6EC1F1C00DB59C131AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 81a5825d784e49c27b11379e73d28817adafcb208bd0207b2e805f1bf11a3268
MD5 e2f8cd4f5838f71f11b94dacaec79fab
SHA1 35fae28442d0e081c2a52867dee8dce5960b8fe3
SHA512 12b002a2ab65a5c32646cce76c781d49ebec7a1b78a436eb2d085a0affc74f024a4755eb3e4515745c8190bbb579c5d45485445e7529cc2d1ff63af77b98d8de
SSDEEP 384:bWiFiZcIMzsNc8TUNTUlIloUQibGFAzX5od+s8YxiXFeOObjI9G6w7M:ZFQwJwguoOlaFe29MM
TLSH
T12EA26C339868D93BAEF7AA55F48A36175EF491BBD6D4AF84E2EC9F0C01570AC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16ce5300f89eac3d4c134d4ad173540f8d7d6865f0cbdbdc7dd65c5ad8b96f6a
MD5 0b32be192fd19b60c378b20cc6a85d32
SHA1 7d2dc29e74fc950a6e46ede6d9ec6a84380d51c8
SHA512 bd2614f7d1139a9ebb0749e3111e593c6cf7aaa0b18a9bd2c109d8e579c8a4072cf6248387c6d5e38c071a4ab08d09512dd794afbb0d59cea686be706c308ed0
TLSH
T1A2412858A6EA2108B3B37E569BF6A86E587ABD332E06D09E00110D8F4766B00CD61737
MD5 SHA1 SHA512 TLSH

Submit Download