c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 18.6MB
Sample260809-w7twvawzbx
SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
MD5 68bebb0e4b93ed694e4493608a77f457
SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
TLSH
T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307750241425981"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6C3526D5-93E1-4A0C-8D62-C36BEE908AC8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1228	2112	msedge.exe	84
PID 2112 wrote to memory of 4732	2112	msedge.exe	85
PID 2112 wrote to memory of 412	2112	msedge.exe	86
PID 2112 wrote to memory of 412	2112	msedge.exe	86
PID 2112 wrote to memory of 412	2112	msedge.exe	86
PID 2112 wrote to memory of 2272	2112	msedge.exe	87
PID 2112 wrote to memory of 2272	2112	msedge.exe	87
PID 2112 wrote to memory of 4668	2112	msedge.exe	89
PID 2112 wrote to memory of 4668	2112	msedge.exe	89
PID 2112 wrote to memory of 4668	2112	msedge.exe	89
PID 2112 wrote to memory of 4960	2112	msedge.exe	90
PID 2112 wrote to memory of 4960	2112	msedge.exe	90
PID 2112 wrote to memory of 4960	2112	msedge.exe	90
PID 2112 wrote to memory of 4876	2112	msedge.exe	91
PID 2112 wrote to memory of 5044	2112	msedge.exe	92
PID 2112 wrote to memory of 4876	2112	msedge.exe	91
PID 2112 wrote to memory of 4876	2112	msedge.exe	91
PID 2112 wrote to memory of 5044	2112	msedge.exe	92
PID 2112 wrote to memory of 5044	2112	msedge.exe	92
PID 2112 wrote to memory of 1092	2112	msedge.exe	96
PID 2112 wrote to memory of 3376	2112	msedge.exe	97
PID 2112 wrote to memory of 1092	2112	msedge.exe	96
PID 2112 wrote to memory of 3376	2112	msedge.exe	97
PID 2112 wrote to memory of 2088	2112	msedge.exe	99
PID 2112 wrote to memory of 1044	2112	msedge.exe	102
PID 2112 wrote to memory of 4316	2112	msedge.exe	103
PID 2112 wrote to memory of 2372	2112	msedge.exe	104
PID 2112 wrote to memory of 888	2112	msedge.exe	105
PID 2112 wrote to memory of 888	2112	msedge.exe	105
PID 2112 wrote to memory of 2608	2112	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc311dc188,0x7ffc311dc194,0x7ffc311dc1a0
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11732914071185488082,10511205717165122855,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15794592131573851134,2189480488101271669,262144 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,5330114270795998815,6744734665064736673,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2601323470171182590,10407819073826349452,2097152 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7721993126740408745,13324836797315133268,2097152 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,8267514322406317267,9663913659294985537,2097152 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,847969593667861217,7444420801528750467,2097152 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16644521353516655744,16216916448361481589,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7681415097568280370,13979441030041657085,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5275807396522035544,16449743112054656232,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5275807396522035544,16449743112054656232,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,15685139607617724041,9325001340783162524,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,6828599386884037769,12599952087419835766,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,10940951834715171656,4227056819648207667,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,16119793835973453957,9355012913632239348,524288 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4288,i,3858185919418651075,3515229768423000061,262144 --field-trial-handle=2228,i,16306893897130861376,14160888866367943921,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 70ec916fbc4bdc762d303a32b425b3e0261fdf5d4861f31961987ba096c316ad
MD5 996e8e432c1af85dbbc9617643df9f45
SHA1 d0195d75db411ad1a86b9c76c84c53d5dbfa292c
SHA512 e3b70f66cf03c6c9999788962930b9cabd2ecfa0b384ab514e85ba204c430600ab36e315c9acc46dffdc31af52289db2f445b572d3c1a4cf9868b5e4604b5b6b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1B8B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0a9071e8caeb1c88e4e0923d3c87c66525a1de121cd1b89c6c7d0ef2f1896b5
MD5 27c78c0091a95d8973aef572fb8fd476
SHA1 20bf49f17f673645007062fde0022fa7a18c2d63
SHA512 bfa2e2eba03d7a7b84daf8e000692a7f639b4a46325b4645fa0e611ebb2b05a5bf4d464f834b659d23f4bb61b479895b64c25cdd180d8dc91ea47918e2ee690e
TLSH
T17B7181351286C8E1F3710132BCE9525EBB73B5C9F9A7AEE251D0BC372508FA2960715C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58820c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58820c.TMP
Size 3KB
SHA256 9c4e319a110dee428aa1c13e091a7f2a9b98dfc95d346bea5554d19575283940
MD5 0d789c4ad3844e6e225894335445271d
SHA1 3be439a1c587ca8bf3312ba7008be4a0828eda10
SHA512 b374418b1f3b09f0c0d7660b9d1aac61191c0cb916110e05d51bec84980012703d40e8fdf9c3c9940e714f94e673a3bd1f73a3bdd59076ed8579293b50ec0ca0
TLSH
T1067170351286C8E1F3710032BCE9526EBB73A5C9F9A7AEE151D0BC376508F929A4715C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c0d0e97533b10beb0f158abc91ae13f2ec6968f0e9fb45f445ca0fcc4446f3a8
MD5 c115f6a88e39afdc53882bbb152fad2a
SHA1 b2541f98d5af3b73627267b1e764643b23cc04a0
SHA512 cae8c057125d89284cf1b2496f599500e447f5ea5a16dce279ee7b12404d0542682c185c8330076b6119fffe9787cfcae48c1a6f07e1db564da4345972b33abc
TLSH
T1EB11BDB3C3D585AE890116F09A24AE1BCE2D0606431C7C29C9D4FF2B97E3075D10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 87a811c613600d60473c587fd9c06ae6b4b947fe4f33daccf7af368f7e5fcd7c
MD5 e927b5e71c85364f05b8555bf786be29
SHA1 2f781953532e5c230fc2582cf56a6ccbe0d3e89f
SHA512 db84bce75a1fde981624bde540cf937ee1a98a4ca2dbd1b893e6bfad8b0714d8abc82d9e6fabb52ae4badeca72b75acccd34c942a630297d12dd7c0b8a8b3c98
SSDEEP 192:sxZ+dRR9yM/jK1Ml8Mkn/fdsMULIdpdJHW6+WNGYIkD4+kIgrJ:sxZ2RnMn/fdsMUUnHbGpD9
TLSH
T1A042D6116A34A977CCDBD309BA45BF93D6F54463E2900E48A9FCDA1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 21ccb7d7d63aa46558cbb38fc645b67939bc68e7c189d896cd1a172f01deac57
MD5 d64c7427bb43ba3197c2cdf1f22a03c0
SHA1 56c52a0e0ee964cb7a5dae8d1d03536ab3809db1
SHA512 55730d0a70eac49bd068d02ced2706a1a23c997e30951fce9e5d4f3e746b58d3cd22afca3524c3744f87e128e883640086d430b2cb89989e18eefc56c1687485
SSDEEP 192:sxZ+dRR9yM/jK1Ml8UQCkn/fds/tLIdpHJHW6+WNGYI2+f+kIg5xLJ:sxZ2RnqBn/fds/tUpHbGdDh
TLSH
T14852C5116A349977CCDBD219BA45BF93D6F44473D2900E48AAFCDA1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4defc4b9fc4073516da687daaea0c8a637b5609de67297687a54da38e4554e77
MD5 c4cb5c8947a161187465029c77f861cf
SHA1 fdacb9c39a5c53eee70243c4b29064d13b883d9e
SHA512 df9519345c2784c76adf483945b9314770bb39f3acd53d21096bf888a5370193be8366284706c86e4cc680f67dc72c9041d1b54a145b260f38421c8bcb0d8cd4
SSDEEP 768:r7sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9wroZFW:r7sqxXlWvJD6Tu1ja54LAs9bZQ
TLSH
T16ED21C3B694CC77E4F840E9DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c97609364b66d114f333b6c565b6392362e878c6dac5f273975170bde973d34c
MD5 d0ea2038299bcdb79f976f2cfe848d2e
SHA1 d9dc84d83325d3463bab6efe2ace7f51b5937427
SHA512 5b9f8124100346d1b2efa47d4d18a8dbbb1a1d8eeca9fddf060d4732f57b73e3bb27d064dce55e9995c3f5af95c2cef713153e7b812a6472d374cdca9a4bf368
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2AJ:ExH3ZFDNU
TLSH
T160E1351B313A0662387E2988B2A6C93B4F4231637018A57F7FB851B55E6EE114DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591dee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591dee.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a00d7ff57ad147e9a1ed8769497e1139f6d1503bca6a093f8238bf54622f827c
MD5 0c7eef5fbafef09a76dfaebead165bc1
SHA1 2c62bfd0cae04803931a6054b916538cc25b714f
SHA512 52a6bc93500873ca0ccc6f68af0c39e63f8ae622432df9f319835192519f534be10f62a166dbb29b7c4cf27606f8d0c982cf11bfb99c706074a2fce81b77b8b2
SSDEEP 384:VZcIhsNsUAhgbQN6VRN5Oj9z9d+2fumjnTKwBODNZOCZKDT:thPNIH5Oj9z9dlmmjnewBKZOuY
TLSH
T115928D755C385C378EE6A615F84732074EF89077E6C92B94E1EDAB1D01EAA98130FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1d396b3f6515a7f325832dae4c178e94a15fdd6898a247368bc9fb9e12e07379
MD5 2401b6beefac0ebd4fa70e5a97aab986
SHA1 a1aea0fe26f0b74d9a0e9e527fa6dae9d9469538
SHA512 84b08a74b2e9fac59d3597f250636e3eaea8966adc7ff16d8ed3f3bdae83e8014237785f523f1344200bf5f7ec98b9d474f0c98f90a5aa433c00292e3df8a342
SSDEEP 384:kZcIhsNsUfhgbQN6VRN5Oj9z9d+2fumjnTKwBODNZOCZKDT:ChoNIH5Oj9z9dlmmjnewBKZOuY
TLSH
T1A5928D755C385C378EE6B515F94732074EF89077E6C92B94E1EDAB1D01EAA98130FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 227fde01857363fd1d230798c0c1a688f133055a23333edddc9b8ce184c37368
MD5 bdd7547b24f043c5cc1a8b3b42476bfb
SHA1 be72e93ff1bc20f35d4f669e4eac7e36d4949f1f
SHA512 04890851a4ba722251e0451559ba0ea82abd4cb0ca560d36f36b43cba7716682d6a107f51cdad6ecb64dc51e48e77de2ed4337817b6ce61f564c3083c72a847c
SSDEEP 384:RiFiZcI5zsNt8TUNTUlIlfhgbQN6VRN5Oj9z9d+2fuVjnTKwBODNZOCZKDT:4FQ5kwg7NIH5Oj9z9dlmVjnewBKZOuY
TLSH
T14AA27C724C288C3B9EF6AB45F94B32078EF850B7D5C56AA4E2DCAF1D00AB59C130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5813df42ad2358399a9220c17adc91222bd21f512b211e52a678a8d980149955
MD5 502a1c9e41be5935c775565ad1d614d8
SHA1 41ee40d1710edeee62af9bcf604f0443119aeb79
SHA512 b77312e90afd3abe6860c049559a3674245e02d48621704aea036b90d334045b93703bdeb870d3cef8219b5c2c1bf86b2abc46f86fb5ece981873ce53a37befc
SSDEEP 192:tONiD6JkRtQmiUyUDW+RN5Om5o92h3oRXU6:tONiD6UrfW+RN5Oj9+gU6
TLSH
T14102D9356D786C779EF26E09B98737175FA4207BE9852F80DAE81B0C01D7A9C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e2d37ecf1afc34ca2fc16a8efaa7854a8e930704b1636d0cf32f47564c7defd
MD5 09caae095f3446a76aa8bf5cd5caeabe
SHA1 9864860487ad61f2085d6ad83a06bb3ff05cb979
SHA512 73cc108cee107c85f8276e523a60c6bb3f8150154ead507cf57c3c677d900339f6c57ac113acae7b8d78bfad506e1703da63efdc48bc0fd37fb764dbf2d4a2a1
SSDEEP 192:8ONG6JkRlQmiUy2Dm+RN5Om5o9nz9d+2fufVcaqRpU6:8ONG6UDNm+RN5Oj9z9d+2fu+jU6
TLSH
T1E6121A366D385C775EE26945F48732074FA9512BEA896F90D1DC2F0C01EFAAC234F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 24c7782d38036d9133a208d57785a0d52c05bb63a6ee81e69d6aa054a032ffe8
MD5 8c986730b7a77a06bdbc11ef6c92528e
SHA1 8c9d43a74eb075a834e39ab02924a65fa62589f3
SHA512 6fed47877e954eb6d468df084dd62a7e51e379f4d25415ab536fbdca0261de82a818a4a84c4f454f70e0c88b6350dba060ad0899587975d3b0981444eace5fa2
TLSH
T135410758B6E91248B3B7BE56ABF6A86D487EBC772F0BD45D00010D4F0A26F40C861737
MD5 SHA1 SHA512 TLSH

Submit Download