6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.8MB
Sample260804-a39wlsac48
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
TLSH
T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302783160626362"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C65CF531-C459-438D-A130-AE2957D3A4F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4428	4316	msedge.exe	84
PID 4316 wrote to memory of 1432	4316	msedge.exe	85
PID 4316 wrote to memory of 2448	4316	msedge.exe	86
PID 4316 wrote to memory of 2448	4316	msedge.exe	86
PID 4316 wrote to memory of 4740	4316	msedge.exe	87
PID 4316 wrote to memory of 4740	4316	msedge.exe	87
PID 4316 wrote to memory of 4740	4316	msedge.exe	87
PID 4316 wrote to memory of 4188	4316	msedge.exe	88
PID 4316 wrote to memory of 4188	4316	msedge.exe	88
PID 4316 wrote to memory of 1944	4316	msedge.exe	89
PID 4316 wrote to memory of 4188	4316	msedge.exe	88
PID 4316 wrote to memory of 1944	4316	msedge.exe	89
PID 4316 wrote to memory of 1944	4316	msedge.exe	89
PID 4316 wrote to memory of 2028	4316	msedge.exe	91
PID 4316 wrote to memory of 2028	4316	msedge.exe	91
PID 4316 wrote to memory of 2028	4316	msedge.exe	91
PID 4316 wrote to memory of 4988	4316	msedge.exe	92
PID 4316 wrote to memory of 4988	4316	msedge.exe	92
PID 4316 wrote to memory of 4988	4316	msedge.exe	92
PID 4316 wrote to memory of 1740	4316	msedge.exe	97
PID 4316 wrote to memory of 4792	4316	msedge.exe	98
PID 4316 wrote to memory of 1740	4316	msedge.exe	97
PID 4316 wrote to memory of 4792	4316	msedge.exe	98
PID 4316 wrote to memory of 2484	4316	msedge.exe	100
PID 4316 wrote to memory of 4960	4316	msedge.exe	113
PID 4316 wrote to memory of 4968	4316	msedge.exe	114
PID 4316 wrote to memory of 1560	4316	msedge.exe	115
PID 4316 wrote to memory of 4284	4316	msedge.exe	116
PID 4316 wrote to memory of 4284	4316	msedge.exe	116
PID 4316 wrote to memory of 1588	4316	msedge.exe	119
PID 4316 wrote to memory of 1588	4316	msedge.exe	119
PID 4316 wrote to memory of 1664	4316	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe3bf5c188,0x7ffe3bf5c194,0x7ffe3bf5c1a0
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3242603311920055301,17489595267018060451,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,11232227695448791274,10076679006593228895,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15417592478934676636,17469167381626226091,262144 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13609942907124201865,14871589376433575230,2097152 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5830674797835124843,13306244176657743743,2097152 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,15378439470122288727,1933846241259611790,2097152 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,2084538867670626700,17939128376026121222,2097152 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,18231254736440558386,8557886990656489205,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5745445449252282390,5004804010919641977,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,4371818488019439986,1923084400211965382,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,4371818488019439986,1923084400211965382,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,16851954558187534732,2163537914874718098,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,5616053443848494185,11697433768196488789,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11096327764839339453,1716243519108222635,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,10304831815489224661,15836991213958786005,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6346763740870219946,7780239771313758465,524288 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5848,i,4594018882968950769,6790565199352043286,262144 --field-trial-handle=2216,i,14470516668470412312,17475330803703632982,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e895c713b499f7261f324b5fdd87824521729acef59d0f511383df5da893930e
MD5 855cd69f46ca80eb69346c8a580ca6b8
SHA1 edabd216a3773be95b50c047ece50793ca1b0403
SHA512 3eba5699e57eb3f6a05ab94cd60ae66b60f73621303363a5393ea34f2b8a556e243a128d41829e64f21b76f4c24cd5978cf832f4255309101adc2b7bbcb1babd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef0e031e851f201bff256c155c000714277265c885f7860d8284cce4e578f7a6
MD5 e9868b0600841decfc1a2958344bf216
SHA1 04e4329755de6c909401a0546f2a90e9f46a6c91
SHA512 3a47c9ea8f733a818a7090ce5e953495a38d0effdd24741e1cb0e884814dcf9a1446a7c27b23c2d51c784e595ddd03ff85b218c37c657fd153fb0733c7c8afe0
TLSH
T18471A434013540ACE36042B1A4ED65457DF481E8FD375F12A1DC7AB7AE0EFE4A76AC49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cee4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cee4.TMP
Size 3KB
SHA256 ae79c4795e8511aa64bfcb0e59e1f5dd02ff6ffcf2737d54732eb790ac62e44b
MD5 847577619511e26fbc8b75f44f1bf3ad
SHA1 6642d465c7f240ccc6cc09fcd72654553026fa62
SHA512 adb1d9b62a2ebe5684b794ba1c2a533e51b2a044cea4b465f864ac45b1b6f155abc85fd7214b9e76716c3a02ed6ecfb862d9c813533150835790cbdc4b21e409
TLSH
T1EC71B734013500ACD36041B1A4ED66457DF481E8FD375F02A1DC79B76E0EFE4A769C49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 43348624f2439e5d843fe41c12a744834a938ade566a0d9f20f34cf82ce26e41
MD5 e015c52553593f63db80a2ea05fe3da6
SHA1 b237b7faea32dc845fd172f4c7472392aca256cd
SHA512 ab15716f5e77dd38157d4d72327de8c339a2fca5b17fdde3a8b51f458c17d4f91d99370af54b94af1730fb8013e668c808d5fbdea08c08ccb3b78185cf3b01dc
TLSH
T1F5117AB3C3D585AEC90116F05A24EE2BCE2E0A16432C7C2989D4FF6B93E3475E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bd254ed1ce3327096f264fe74670065dbe26f5221087a4d60912939a9dba232f
MD5 368df01876535f15a381ab17c46a4519
SHA1 f8ddb8a0dcd0d2b4bf015ecdc39569e71f0cce7f
SHA512 e239dc9bee5aeb406fef74b86ca0519f8e8db26fcab2d7f9b89060562ec295fea9d5b27a95f33d3b720012a04fa284ea490a6e8ed6cb55f8389a47d6fb0ed4a6
SSDEEP 192:sxZKR4yM/jK1Ml8Mkq/f6XspXjnnIdpdrHW6+WNGYzQqtFIgrJ:sxZKSMq/f8spXjo1HbG49
TLSH
T18742D811AA34A977CCDBD20DFA457F53D6F4047792900E48A9FC9A1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 85c300953164598cf01757a9b1404350d86e0d3893e30ff258b1a5ca5f3dd940
MD5 c5519bbbc1e047f263ff1863e3531f0d
SHA1 949eeca7557d7a4e877d4e17df4c81203b984954
SHA512 c8c6ed2ddf14a324d10323d0627af3b4327d2bd96c8401845c728cc181f34019cfb44005bf45c131e0180d477ee8329ed8e18fae8a175705abb7601a615c6e91
SSDEEP 192:sxZKR4yM/jK1Ml8UQ+kq/f6XscXLnnIdpHrHW6+WNGYzfZtFIg54J:sxZKSqVq/f8scXLoLHbGoq
TLSH
T14E52D712AA349977CCDBD20DFA417F53D6F4447692900E48AAFCDA1C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d40f75f79594fb7dcf4a782fd978d65c981b58eea0febaf2c6f513257c332f97
MD5 ede5551aac33f8f11ce963b29f3caf0a
SHA1 abcc4bfdcca4fdce1801734f2833ef45134b5d41
SHA512 94c435c06e06aed7c2a04b57e104d9b5d9b914734f664a3c7ae0c9d089aab4b313e39b31446705a726bf935a108b2d1ab33336f2ba1741d5c1df94d6b83041d8
SSDEEP 768:nuW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjQroIniqYx:nuW7kf0Wvqidau1jaa5LA3j7Px
TLSH
T1A4D2FA3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3af6fb6bf19f551ea611e5770d0e4eb3d8400f7823a74ef2ac37a5dc1aa7a0ba
MD5 569a301c7308963b16dcbace72826614
SHA1 e484725c463524e8d737e73e56848b98883a4d13
SHA512 dd99f730df8f108369486d97ace6e24acfa874e340b1b1c3c98d5f3f73f79eceafdf581774d729f2f2a77c8e71edc54fbeaf00d6d2bf1e3552c19c8ff751cb98
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTT4IHKVG8jyJCIfKLagDuInKbF:KIbCKcT4wKVGKaCMKLa8uQKbF
TLSH
T149918951323B0A413CFE6908A26A9E378E9335633418B46F7BBA11760D6BE111DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59699d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59699d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 10dd6dfdfb1d7b0021fcc56af140bacecce6338a9f70dd4cf07f6cd8c662586a
MD5 dadffa5795320e4ba0728d7aa9dc5e71
SHA1 8cd569a338f29de2fa5fc42b41a14f54b3582951
SHA512 372af248bb13b7e7af5c26f37fcb947c3c51462d9569a9d4659984ff21e092a3b77a6f68874f9add62badcbd2f04df0da8e7378df4046ab214f55e927117efce
SSDEEP 384:9ZcIhsNnWczVGQbKdXrdV5+2KmBeRs9JKgqijU2C:lhcB27VlKmTjKgqmU2C
TLSH
T101929E349C79AD3799E2B545F0863B075FF8802BF7C06F98E5ECEB1C02A66982317516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 38b714e7b2bffa20e8516cc04d444d15b794ef6bfdb03fde79825dc79f69ac0b
MD5 a6791730e3aedfd28fed6fdb93b57832
SHA1 c5e6d6377c11775f282af0eeb9cbe0f32b495c17
SHA512 fb65d8fd7f580256863259c4181216b5c072a6207c183dba7ecb6bb2b7265cc9eeaf2339011f6c3447cd9b14e9ef9835e52b2f38c84ed7f1f6e1dc0a55d7c1ab
SSDEEP 384:jiFiZcIqzsN58TUNTUlIlnczVGQbKdXrdV5+2NmBeRs9JKgqijU2C:OFQiowgUB27VlNmTjKgqmU2C
TLSH
T13BA26D324CA4DA3BE9F6AA85F54637079FF4406BE6C0ABA4F7DCAA1C01A71DC1307915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b5107ab53d3f512683a30e8f36925a2b4e0d619748d8d09025fc284b2575c3ef
MD5 78ed9b2395a1d57589ae2f8a85b18e57
SHA1 fc91f5934734dba793bd4a5a94fa4abd92c9ed05
SHA512 b011c27c477e1c3785afceeb91398f36151f6721b1b2202e9c7f1b8898f112c8c69d7548f2d0ac9de23f0a96d312bca36f5198dc7b0514bef467f4188892125c
SSDEEP 192:uxLsNnKCQ3RNVGeBb+bQmiU1/To4aGBPKUq+FdGe5AMV+2wdNpq3U8:UsNnKCczVGQbKdXrdV5+2KmU8
TLSH
T1C1322B35AC786C2B5DA26545F0473703AFA4416FABC42F58E6ECAB1C06DB7EC2317906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c90405809cde7273886396a5c94595cd6b1de812cd420a50c0f94acd4180d7d8
MD5 6a54eeaebf80368e4026fc5ff8b09190
SHA1 573a0b36b87dda1024756dd89d86ae6d510859c3
SHA512 645b38f9daa09586d4f4d9279c831b5b0b5004f0341e5cdfe42041c33fc5911c4cf8174bf50567f190211379638905f5a2cb7166eb86b7a6d4928bef5ea0854c
SSDEEP 384:rZcIhsNnnczVGQbKdXrdV5+2KmBeRs9JKgqijU2C:zhBB27VlKmTjKgqmU2C
TLSH
T148929E349C79A93799E2B545F0863B075FF8802FF7C06F98A5ECEB1C02A66982317516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ea999cbc965264933ca4a020335357c38c32f388bf3ec1c6044e3ebabc0c334
MD5 f80521f2142c67592d95fba6394cc861
SHA1 41fd68270a976348fadca2f3e06d8a92a541de8d
SHA512 ec4910759d62fc90aa6cedd6bef7ef3f83163a6b11ff2601a798a9d71319be17bf3447c307f2e27ac567baa54a49a737b3e458467d55f6fc3efbdb43cc6920e7
SSDEEP 192:eONa64B+QmiUy0Bl5GBPKUq+FdGe5AMV+2OWwpq3U6:eONa6e6/lUdV5+2MmU6
TLSH
T1E7120A359CB96C2B5EA16545F08737079FA9412FEBC86B54E6EC6B1C02EB6AC2306406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c880f5528d7b60c18b1a6574717c2a2e8d97eaf8e920d2694b637c9d90e55766
MD5 30c255a959e8d00b5e3fd5ff2c665ba3
SHA1 86a1e9ca905808b2487acd9183e5f8eba26b5c8b
SHA512 88f6f521e0a181020c61edf6c0b60d81542f26a936337a20c13cc869bbfac28b7f3cd803e4d15f86c9beb6aa241e43199e4a50972b3af9b717af6a0f85cae437
SSDEEP 192:MONM64BAQmiUy+1BW5GBPKUq+FdGe5A0aDVxU6:MONM6eAdXWUdVsTU6
TLSH
T17F020A39AC796C6B9EB26E45F58637175FD8103FEA942B44EAE85B0C01D765C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88f7b953-f5e1-4b72-9e67-91fb60e1cd87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\88f7b953-f5e1-4b72-9e67-91fb60e1cd87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 93d0603e3172f5342b15441a193538c37e7ab18663d0652973df2b44f4a20e34
MD5 45db86f81e6848aca9bc2493498708f5
SHA1 faf02dbd9c67a944bf3dc2b3dc024cbee54a29e9
SHA512 459cf75f64512a16a90381651b8c021d3227d243a1bfd6d70e2cc85fc08b91ff394af64aaa45abd27b0d4fb59858e0c7da49e3c9e5ff8d005df9f5731508ea74
TLSH
T14841175CA6F91144B3776F5AAFF6A86E487F7C772F0AD59E00110E4F0A22A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download