bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260803-1vblysgd96
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302693184123848"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{4D42916C-1405-441D-9A85-8538122EDFAD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4748	3952	msedge.exe	84
PID 3952 wrote to memory of 2204	3952	msedge.exe	85
PID 3952 wrote to memory of 2644	3952	msedge.exe	86
PID 3952 wrote to memory of 2644	3952	msedge.exe	86
PID 3952 wrote to memory of 2644	3952	msedge.exe	86
PID 3952 wrote to memory of 628	3952	msedge.exe	87
PID 3952 wrote to memory of 628	3952	msedge.exe	87
PID 3952 wrote to memory of 2828	3952	msedge.exe	89
PID 3952 wrote to memory of 2828	3952	msedge.exe	89
PID 3952 wrote to memory of 2828	3952	msedge.exe	89
PID 3952 wrote to memory of 1188	3952	msedge.exe	90
PID 3952 wrote to memory of 1188	3952	msedge.exe	90
PID 3952 wrote to memory of 1188	3952	msedge.exe	90
PID 3952 wrote to memory of 1232	3952	msedge.exe	91
PID 3952 wrote to memory of 4724	3952	msedge.exe	92
PID 3952 wrote to memory of 1232	3952	msedge.exe	91
PID 3952 wrote to memory of 1232	3952	msedge.exe	91
PID 3952 wrote to memory of 4724	3952	msedge.exe	92
PID 3952 wrote to memory of 4724	3952	msedge.exe	92
PID 3952 wrote to memory of 4288	3952	msedge.exe	96
PID 3952 wrote to memory of 1808	3952	msedge.exe	97
PID 3952 wrote to memory of 4288	3952	msedge.exe	96
PID 3952 wrote to memory of 1808	3952	msedge.exe	97
PID 3952 wrote to memory of 776	3952	msedge.exe	99
PID 3952 wrote to memory of 900	3952	msedge.exe	108
PID 3952 wrote to memory of 3416	3952	msedge.exe	109
PID 3952 wrote to memory of 3332	3952	msedge.exe	110
PID 3952 wrote to memory of 2552	3952	msedge.exe	112
PID 3952 wrote to memory of 2552	3952	msedge.exe	112
PID 3952 wrote to memory of 4336	3952	msedge.exe	113
PID 3952 wrote to memory of 4336	3952	msedge.exe	113
PID 3952 wrote to memory of 3964	3952	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe30d7c188,0x7ffe30d7c194,0x7ffe30d7c1a0
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,7345582264571286217,12775244601671559370,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6248552041881694410,2503821936344427712,262144 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,9512444783725174956,6518418811039822573,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,780316149368092418,16944297348983231180,2097152 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17271065759325094443,16195016994630514465,2097152 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,11524912005021555972,1300449470654657668,2097152 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14186377869164956435,15679816535080359712,2097152 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5244586381017957936,10377498931836932256,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,5552940657727444251,4480804018925494806,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12946255942825707243,14547496404390717223,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12946255942825707243,14547496404390717223,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,6942802097252329538,15067598213448424990,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,2361532676619497255,7057361020951388055,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,15394101825965713558,9995377001734685797,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2888,i,11541549680418050372,170563511245348403,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,4292597912540925182,3192172690415529988,524288 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,12323863860263219824,966777092473180531,262144 --field-trial-handle=2196,i,11261035179776456840,4010810389778424707,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ea331082f4c67ef6c76d0cef3c9ad5efe0fc685144339744b3672d496767ca2
MD5 0ac42e601bc502cb05040f34b87dd9dc
SHA1 1880e24ef262ade88114d99fd0a58443a3185061
SHA512 3d921c2be9a9b893e92fbafc98621d6ce4e00124c72875a20cbf095c5ab0da24cfd9092d371a11d4f9702236f4c5ec923d21e017b3f39d38fc44f04fe928e618
TLSH
T1B77150348616C4B3D7461DB050C12D0D727A8AEBFAF31ED6239C8239237277493E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc94.TMP
Size 3KB
SHA256 71a18471eaa363386f722dbf1345ec5a50d94d965812888e17f164737e1413c9
MD5 578b2cb323da139344d47fd5c1bdc9a2
SHA1 4c32c2fb4d538518e131b215adfeb324293523fe
SHA512 708f69222e48d8565c8a1fbb88bfe1f0f9f2c7db89d67be8331bd000acd5581926f674936aa09ad102eeaaead8582c4c238e95025d51a4ad64502887dba6064f
TLSH
T1A4714E348A16C4B2D7461DB050C12D0D727A8AEBFAF31ED6239C4239237277497E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 05365356c6e3d231048fa4216eebee234fc134a55216eeda4ce0ca56a3e7d431
MD5 1fa36a1df54a099eae294660ad731d97
SHA1 72f9ee023a7c8acc6e99368072022e832686112a
SHA512 c5a0e9f54ab240fa42c629873b5945ae906e7ebd65a828e3bce0ed3eda9690a2b855e9e50bf6a814798e7b8fa4408399dd5efb142a51246b3aa15f77bfe486e6
TLSH
T162117DF3C3D5856E890556F05A28EE2BCE1D0506821C7D2989D4FF2793E3075E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9eca7af3fe42dfa58eb9f68b6bbadc799c489db4ebfe42cc06c93b49b4a50514
MD5 fd1709bc5cc74b7d4f5a200f4e26de20
SHA1 1e4c90ddd03f844a84b091d75585498c02415ee3
SHA512 98f830505e604dc633fdd464a829ae34b3ae6e434f15a8e80eb35f8b873b16c7f5e54c95928ae52595167dc7bd829f84fcd70a7507363c7e8727fa3f0856ad4b
SSDEEP 192:sxZGRRyM/jK1Ml8MkL/f7sUAt6IdpdSHW6+WNGYIkr4nIgrJ:sxZGzML/f7sUAtT4HbGB9
TLSH
T11C42F8016A346977CCDBD20DFA55BF53D6F9147292900E58AAFCDA1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fdac2db5534c6627da7ec9d55d586efa75cfb49e104d77b9fae47dec00b28458
MD5 68220e0bcb5522169f8313a336ea1254
SHA1 ced28ad53e898d4c95cdf7eb0384679a0da46a4e
SHA512 e3b82b820a7aeb11ac1ac1f62a8d9567714b02e5bfe4b2fdc3e29bc209c021ec3a81fd2b627b5b685fc406b1b32d85020849c09b0facbfccbc2cf86ceb9f2cc6
SSDEEP 192:sxZGRRyM/jK1Ml8UQ5kL/f7stGt6IdpHSHW6+WNGYIwmNnIg54J:sxZGzq6L/f7stGtTyHbGRy
TLSH
T1AF52F8116A349977CCDBD20EFA45BF53D6F5047292900E48AAFCDA1C04E6AED6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ed5f6752fe52b253d403d1853a9ba955467f89353c6a9ad8c0c31d281610dd48
MD5 e3463a60f0b6ea085f0cd989ad4d90fb
SHA1 99ab3c7fcc6c85e1e8c30274f5d13fb17c9e7803
SHA512 d158bd8401f4932e983710a92ded20d10a8677378e5dd8bf2b5d51aadacb1e07bebf8c05d04a183900671805005c79cf7c710c1aab24fb9d36fdde356c29f05f
SSDEEP 768:BZsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9sroFmZ:BZsqxXlWvJD6Tu1ja54LAs93F6
TLSH
T1AFD21B3B694CCB7E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 aad345a0dfde649bce3a48a69552c517544c14e7d4f6b56cb5238ce67c9e7f84
MD5 b6a443f6725cc19b37f1eb199b025f25
SHA1 367f9b53ea8ef59ded0c59b1c4119caf87558d74
SHA512 f3a8e4dbc5c092a6edf9a076b3038058ecbbe44a24f4308b9f47269737cf8c9b406c54142ce8a455393557f04eff11df870a958693b2f65a4e1835427bc73569
SSDEEP 96:KYbaKYIKS0QKJ2ihan2K0Isk8I5PWCkK+BWMkyqKZ0L/WKE0K6GMK7Sn:Ex7jVjd/g
TLSH
T1F6E11216713F024338BD3818E36685368E4272A73819A5BF7B7840A65B6BE121CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595c9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595c9d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 718b07cb2b4ca89acc5a388ee05de1a584661825b806b144f7a0e7fbca26d821
MD5 2e8eda7528a5d51e922f71cdac5a8ac9
SHA1 04a6495ce98b828fbb3f3d6361d5efe5f48a3fe1
SHA512 0b75ca21397d8dbde9d95f5cc986e882a9e290fdfa75d21a2dbda26c590d271096e3b9b50b4e1facb0fdc61bab9c618b6519b6b64dff11334a818a8108508bc4
SSDEEP 384:uZcIhsNphFKbM6xVRNMOKx9WcXK9Li6Uq58bhP+wGSmBuOh:MhbXHMOKx9WcwLwjG5BuOh
TLSH
T178927D7528356C7B5DEAA146F84B32178EF8D027A6C96E80D4EC5F1D02EE9DC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 35cc3be12dbdddf59a6d583815d59acb92ae3460772cb1f0859db4f6237f1af8
MD5 929f0262ab80c67d6cd130d3ef4fa268
SHA1 320cd0f808d7ee128a10ddc541b0d954f02a9510
SHA512 bfefc6795adef5b7dd6441422ed2c0a1976338cbe5cacb170465688095a4994f1df57d31016044b58b6c2513ecfac892cfd60325a0d4f29a87b361600e41500a
SSDEEP 384:wiFiZcI3zsNL8TUNTUlIl8FKbM6xVRNMOKx9lcXK9Li6Uq58bhP+wGSmBuOh:LFQjawgxXHMOKx9lcwLwjG5BuOh
TLSH
T188A27D7218649C3BADFAA642F94B32178EF49077D689AE90E2DC5E0D01EF5DC034BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d149f44980666440b2867a4d6dfc09e63d8319f3281a5d40cb3ec51458cd5092
MD5 5ed68a9549e6068c9f6af294e5fca223
SHA1 9dc2cea2a4e55f62cd7e0043c20d34cf5172cd59
SHA512 3676edfb0df584f18a541683077acb8d93505451bf88960e95766cfda211f046436c8938f21b98659bc7d930e121223e4ff157f07e639a7c2f04a341da4af303
SSDEEP 192:tONI6JkRtQmiUycAW+RNMOmEoIh3qRCU6:tONI6Ur0W+RNMOKYPU6
TLSH
T1D802FA356D785C779EF26E0AF98B27175FE4106BE9852F80D5E81B0C01D7A5C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1a5f74c89e95b7a7552b863687ae3b2c18d9f82cd49bf2141bd15b7afd09dc63
MD5 059df2bcadeda97e2d923683f65f63a5
SHA1 b7d099888db00e894b2decd06c71f2f940bb7b4c
SHA512 d76d97275cf7d08302d99378d083fae9c6e4d730f50b7a86eb1344ab522b8028722883d81b4c19d0f81d5aa53957588d2634028b766e3f9f9c032fb134a029c4
SSDEEP 384:2ZcIhsNp8FKbM6xVRNMOKx9WcXK9Li6Uq58bhP+wGSmBuOh:khKXHMOKx9WcwLwjG5BuOh
TLSH
T13E927DB528356C7B5DEAA146F84B32178EF8D027A6C96E80D4EC5F1D01EE9DC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6cf189ec5c6c86fe411fa1c8d52676be591ee136fcf8d106b8afe553ac3f593
MD5 abc193a400e82d571d4e854b0cab46e4
SHA1 7f91177b74c648016db4bdc4b903d37d4f0a7dea
SHA512 dbaebeda7b6915902f185cb57750909317b2965670fcf6f57d6e8bc023c6567cddb269ea62f377bc6fea039ac2ee40402f6af5311924629522295ca08d211bf5
SSDEEP 192:0ONqV6JkRZOQmiUy9Acu+RNMOmEo9X9jxVcRq8+U6:0ONM6UwfD+RNMOKx9IcU6
TLSH
T1EA121B326C785C7B5EE26546F48732175EA95127EE892F90D1DC2E1C01EFA9C134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

575dd30c-385d-4c71-8ba1-cd90b4857ff7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\575dd30c-385d-4c71-8ba1-cd90b4857ff7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e62454937af4df1c7c8546171a77c379545b4370f926cae71e540a17f3c431be
MD5 3931a375814fa4330435e39f868c2399
SHA1 74f0cdcb15e8c878480435159f25982243a0fc7b
SHA512 c9518aa4044e9bf5197b82fe31a32885be0e0b7b3bee8e32fc6b1b5de80b0dbf3e461f5102744d988179c0f8205a480db66f6b487b8ebc53a7cdad7f9c8f25a7
TLSH
T10A411748AAE91008B3B76F5AAFF7A8AE447F78772E46D49E00110D4F0A67B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download