6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

Analysis

max time kernel
898s
max time network
742s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.8MB
Sample260819-w71dma1amd
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
TLSH
T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316383366772757"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A1502E4E-41D1-4FEC-AD8C-8C7124CBB69D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 5124	1612	msedge.exe	86
PID 1612 wrote to memory of 5840	1612	msedge.exe	87
PID 1612 wrote to memory of 4352	1612	msedge.exe	88
PID 1612 wrote to memory of 4352	1612	msedge.exe	88
PID 1612 wrote to memory of 4352	1612	msedge.exe	88
PID 1612 wrote to memory of 2588	1612	msedge.exe	89
PID 1612 wrote to memory of 2588	1612	msedge.exe	89
PID 1612 wrote to memory of 2404	1612	msedge.exe	92
PID 1612 wrote to memory of 1368	1612	msedge.exe	91
PID 1612 wrote to memory of 2404	1612	msedge.exe	92
PID 1612 wrote to memory of 2404	1612	msedge.exe	92
PID 1612 wrote to memory of 1368	1612	msedge.exe	91
PID 1612 wrote to memory of 1368	1612	msedge.exe	91
PID 1612 wrote to memory of 3968	1612	msedge.exe	98
PID 1612 wrote to memory of 3968	1612	msedge.exe	98
PID 1612 wrote to memory of 3944	1612	msedge.exe	99
PID 1612 wrote to memory of 3944	1612	msedge.exe	99
PID 1612 wrote to memory of 220	1612	msedge.exe	101
PID 1612 wrote to memory of 5204	1612	msedge.exe	112
PID 1612 wrote to memory of 5796	1612	msedge.exe	113
PID 1612 wrote to memory of 6096	1612	msedge.exe	114
PID 1612 wrote to memory of 4868	1612	msedge.exe	120
PID 1612 wrote to memory of 4868	1612	msedge.exe	120
PID 1612 wrote to memory of 2248	1612	msedge.exe	123
PID 1612 wrote to memory of 2524	1612	msedge.exe	127
PID 1612 wrote to memory of 2524	1612	msedge.exe	127
PID 1612 wrote to memory of 3800	1612	msedge.exe	128
PID 1612 wrote to memory of 3800	1612	msedge.exe	128
PID 1612 wrote to memory of 3240	1612	msedge.exe	130
PID 1612 wrote to memory of 3240	1612	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ff97bb4c188,0x7ff97bb4c194,0x7ff97bb4c1a0
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7794603805921617860,6433552405375880785,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,781453018985483114,12726655037446553550,262144 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,17013824486108068701,11642163890557222524,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14911602727290349013,5494579039538754070,2097152 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,1551718191474244629,12417508926491255478,2097152 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,13028376645286201812,15549141931611164895,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2008551313209782477,9041892971154728111,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,14986847601851003508,3088026319833268916,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,14986847601851003508,3088026319833268916,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6987376594593960236,4273863591840429671,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8525305130229542765,5139868720540356367,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9249949309686397057,15530009491510795084,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,16754279152774369892,3112217551463134615,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,11074923111228644901,9848029720650366230,262144 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,6825623332996505066,4141232697137389653,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1028,i,17171936166128617539,17572418999165166894,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5584412888934890843,7660289357330594384,524288 --field-trial-handle=2392,i,14986224531411624610,16866433121645135779,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 3251d80a1a29fdbcf6e7a22651a85229098e3a78fd8a81580f9e0480a882b4a8
MD5 f5533e02fb86c934dbdadb6017935872
SHA1 bf96fb1653bd3865b30de9a2b08496d9d175f0e0
SHA512 fc14af1a497138e4beb777e9987addb497093d7f6dc6a00529d0d56b547f1fdbe56a33ca86e50b6d34fe6eb1b4c110d9c3b9caea32d0d71694bb0293d81b3f38
SSDEEP 192:tjEpemmmmmmmmmmwwwwwwwwwwwwwwwAAAAAAAAXh:tjEpemmmmmmmmmmwwwwwwwwwwwwwwwAQ
TLSH
T18DF1961786D5CA9A9F05618B5AB0675CD1703B0DEBDCEA08038EDDD9308F49EF4A3792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6f4b29bce39ea7d65f3dc94040c4aa2cca970450c005dae84eaeea87dd6a9e9c
MD5 1156c19553b9a00352965abf0bc5ca4d
SHA1 d340cb202d39270cd4d9f1ac72e89e9492c8c746
SHA512 7340c5856e2914abf14cb6bf46dd599a92ffaabe8421b9e1a3547308938e0aa0566afabaf61ce2b9f6f1d7281a396db55a8fbf39e7c1a1cac31187bd643641a2
TLSH
T15BE086EC89C9C76EAE44F54B63B8631CC2903B1F97CCB96F170484957141554A3E36A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b19b7d498e23c9454439909d35318108641d1ae52ffac693dd4a2f2c1937212e
MD5 a7d9400402ecb9370cbe29466a5f090b
SHA1 506d04c30ffeb0183acec538ccc0533370e9619e
SHA512 e3525d9bc1f69c975edc110ad25ea589b45eb28dd3f6368c07791a98b25cd749581d8a29ab3d067e18f4cfeea9451050b676c79441ba616eae6b5c4cb372286c
TLSH
T15CE0DFA854CCC22E9A40E54B6274A30CCA813F4F92CCF92F17008CA83441040B3C36A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 164cf8c5f8e01e9b0edb9f0e19266fd1bcaa6132a724e58b49740fb91bfda603
MD5 31ed2647a0208fcdca019058955fde9f
SHA1 479da87f4cd2c242145e9f797fc7ea4eec57788c
SHA512 16e9ae12417e7c23e9c8310398cc9f3e2fd1a7bc5d9739e2a35072f86006319c69b2a72e7b2a19a92cdf0e8c6c632afe60d2dd553194f27adebee265f21ab0c0
TLSH
T1E8E02B76CD22EC3B18FD0758A4498646EB40231736514A5F3B3D82098FB462655C985C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9e99315981c860d8e10de4a1d57f3fb24082a3cf59506229109bd7c2f4021058
MD5 6fd45344b66152709ac9ec02a1d7b0fa
SHA1 43afee6ca742939e87d1764ca8a542e88ce02932
SHA512 509ddf0651633840fdb6fe4a13b4ac49a48f2b800fa938b1e52cc779831b439bda268c164ddfd52d969c0d8324baf1af0f98172f8f1cbdf095e14ef315a33ab5
TLSH
T16F31C0F783F4856ECA1196F0AA18BE2FCE2D0515432C7D9A85E4AE1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8c6755870d3f091da78ff6cadad4b3699f613786b2f98a46128e58307f068125
MD5 30d160e5b4069902aa8db79d048510a0
SHA1 91fcdb8d47eb64a1af81176ea1ac3493afd40db9
SHA512 9a876fa7d58b002594fa243d659e30506696cf01c03da09e61ae9708167eb92f93b1f5fed04e23e45ffd65d82799c44b25751ca9ee908161238f04b63eb95903
TLSH
T1AE31C4F783F4856ECA0196F0AA18BE2FDF1D0515432C7D9A85E4AF2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8560026dce9823ba1865f44b48180392ab71618bb3148eed8a4055df29adf55f
MD5 7875d53617cfba2e0100227ad42a17ef
SHA1 770a51753d0ab316b75128ecb0bb521ce91b338e
SHA512 0dd90be6be044b43db72aa035f6b0c1c4faf2434af5583578ec16fd47aee6b4ac9e73278ac14a3f5891c88c1ff63c4a1c79fcebe1526a5dab77d8d7c3597f6ca
SSDEEP 192:sxZmRQyMqZjK1Ml8UQJkn/fUsXsE1oZd3zodpHpHW6+WNGYvi/4n+BIg5OxJ:sxZmJqKn/fUOsE1ozcJHbG4n2s7
TLSH
T19062F9156A349977DCDBD209FA45BF93D7F80123A1A05E84A9FC8A1C10E7BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d44e34f6cefc129f928b81a472c066d70d9557bac499543c73a2fe3a1daae53
MD5 786e38245cc024ca673edc39a81498c3
SHA1 15255db2cb18a13e75743a309102e99f329fec2f
SHA512 8aa51d0ba68954e240001f0d55df5e6f1ae473565e7bbf2fdc915d3469570acd5a6cb28728df01d137c3138a0e3ad870d237c72186054d13eba44102d895af21
SSDEEP 192:sxZmRQyMqZjK1Ml8Mkn/fUsXssq15aZd3zodpHpHW6+WNGYvIu/fn+BIgjxJ:sxZmJMn/fUOssq15azcJHbG0n2j7
TLSH
T15962FA066A34997BCCDBD209FA457F53D7F80123A2905E4499FC8A1C10E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 7744c34337bcce4aae0e90f22a08c5fc866d853c9d14a47b3a2bf42e52f0c42b
MD5 949262f666ea3b35bfcc2726eb04018f
SHA1 880f353134337333e2eac4f814f273d12936f970
SHA512 d4da77f16ec36e9aa3757bf04b8c7e030bea61c281967846b2041161b3db91cadb60e1d22fa90c9cc7093cf3a5bd64549d56bf79d20ce3596f36b17dd47e5299
TLSH
T17451A28E4E228A6EC99442B200B260D037B4D8CC2B11961348FC2636AC9361E294F6A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d54ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe5d54ca.TMP
Size 2KB
SHA256 571fdbb2d1335e0b3ccc542e562f2d613d64f039cfad17f3be5a615e2f3b2cd8
MD5 de181e853b2ff417391b8f9d73f2129f
SHA1 86ccd4fcacc02824106dae24304770f740785938
SHA512 e2f07684b829fc7d3bcbb2b3f815a8144d479bd87dce437b5f470d1c2d9764784c78f0a6d71e6ec719afec1cf3b93911d7105b7fa23cb31466c68d2b94792d90
TLSH
T1C251B68E4D42863ECDD440B3099364A4333AA80096167F4374FC9636ACD23AD3E4E3C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dc93c0c21db238990e9ebe52b9d5b89ad701c5025fed4ac24a2f69e6b426bcd2
MD5 fe67b529947b6e90a09dc435b9d2d8f5
SHA1 348335519b22f7a57960a9fcb4ea1bcb9701b6eb
SHA512 96fa04f101d6c599e0c98b2806fb8b0b0024e7ad2af8478eb3a6d4bad39ae5687bf28bf1984d3803e824146973a91c75312e791a6ee19043b539cd9ef56c260d
TLSH
T1C7E068B33EFB2850FC6B93C6203048A00049755098409D0F242AB2C724A13192016CA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5154538f9c3e1edc15f3dd805b393058bc11d5668bf113d6118607b93cf70d4a
MD5 e8f9502ef714d5832e895f97d96d351c
SHA1 5588066fe1d66687bef4e3e1d0f63f40bb8276d2
SHA512 a19dde8280ecebcd237f0f288bed03604336fe238f3db8c7f6c703344f8961ecac0347a445b23fc2292b17efbfa27171d3f93e3398cb7fcf6c5d15548931bd03
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrw:0LppY93PBZJPtN53JpL
TLSH
T1C7B27A5A703E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c622f88939441539d5fda5ba2199ebbbf5e5da0fd767a530c4d0c3b314339901
MD5 aa7895f35d23aeb08b54e05013766658
SHA1 49b9e79bd8e2d8fe73b109219d78416b04bde295
SHA512 8212186ee66a8149553e6e1e3d19245139c5820517d64292d5481b2199204517f635cd1b19a476b45455310f66671473b250054a3acd461048d4f484cc87a65a
SSDEEP 384:nKiFiZcIf73sNl8TUNTUlI47QckCr+CTpvBftGp+Mgj4Q4LJ9civRu1ty/7Ig1:BFQf73IwgEkodjGPVQg9cipuq
TLSH
T159C24932EC64C967ADEA8BC9E74A3A13EEF0416395DC9AD8D9DC1D1C109B5DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 372396f84bae717a576dd2b66e8c894b76cd9ee0018ec594a3064eb044011dd4
MD5 3960331221beb91c13736bf2a9d1f2e9
SHA1 9f545b276494a5264078ab0333082c26d6116adf
SHA512 628c6aecc173d282afe637f17568ca918cad5a9921da1242d504bb4c163b98437fbb0198c85d698353d179adedcbe64f781e956de829e363bdee629707ce480f
SSDEEP 384:nRiFiZcID73sNl8TUNTUlI47QckCr+CTpvBftGp+Mgj4Q4LN9civRu1ty/7Ig1:4FQD73IwgEkodjGPVQK9cipuq
TLSH
T1C2C24832ECA4C97BADEA8BC5E74A3A13EEF4412395DC9AD8D9D81D1C109B5DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8ccb2ff1c7628b5fdbde40b9d682b4867890277c70ba0d1cef2e55f1e51ad882
MD5 15f6b3d2b234f6125eb85658b5fbc754
SHA1 7ecb9a153732a849c99571d7b3fe2050779d691f
SHA512 14073283379ea9aa81aeb1af31f0bf8915ddb971b291e2085c9f324b0d4c9e7adbab44047f89a6d1e51bc9024972b5ce8641f1ed1d5b0a8284250bc960079a36
SSDEEP 384:npEiF9CcmyWCB73sNl8TUNTUlI4sQckCraCTpvBftGp+Mgj4Q4LJ9ce4KV8p0PHB:pfFccpB73Iwg5kcdjGPVQg9cI8p0PB
TLSH
T108C25A32E864CABBECE64BC9B74A7903EEE0526385D89AE4DADC1D1D10D71DC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d92f350c2c75fd0d8f538108152ca3d17634a4a3e470d8b3274115790798c3e3
MD5 6f9532110dd4c7727e581cc1807ee56f
SHA1 b2b493f753c731d8a3174a56b8135f9a3e7c40bd
SHA512 98d0a942351f46b028b94eb723b41e3e67a7ee5b47b2cde4f26abced52eea87623c54ee6b1d5dd13a7a26852783e92650cd314ed669e5d57be7ec141fa89e457
SSDEEP 384:npTiF9CcmyWCs3sN58TUNTUlIm2QckCr9GcgpvBftGp+Mgj4Q4L59ce4KV8p0PHU:p+Fccps3YwgbkUVmjGPVQ29cI8p0PU
TLSH
T167C25B32E864CABBECE64B89F74A3903EEE05263859C9AE4DADC1D4D10D71DC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7eab4bc549b5e75c6aa0af022532a864ba5cd0e0d4dbf3bb5c74681c286e0372
MD5 867d7e3fd4bf0801a2c6a296fcdc2687
SHA1 3d1016e1d9bacb48ee87151669c492bd540dfe62
SHA512 c3078a1fee5a376c930ca17bc18ef03738b4c2b4aa1c0e72f58de46a0f0760a4ae27e67d9d01e6ffe7f6f13b86c7f9989d8831eebec543243c0fb985465a7734
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9leKpvBftGp+Mgj4Kbphe4KV8p0PHTt+:pAFccps3iwgbkUIkjGPVKzI8p0PU
TLSH
T1E9B25C36EC64CABBECE74F89F74A7A03EEE0126785D859E4DAD81D0D10931DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 067d709a19e44fda215e27493eba180786b6c014a68fd9089fc65ddc3bf6197e
MD5 82158799e2e1911a76d000bd80cf03c5
SHA1 1ca02fce22e62eabf281c5b7a7348ae1ca7bba04
SHA512 c4d8604840c01f4604a5fb490a21e7a6aa86a9ac7539527f55ef9c2acdbb61039fdfe6b06f06044fa79c422e3515f36b965c54e30dffd65531b6c6911364c327
TLSH
T1A5412C5CA6EA1158F3B76F0AAFF7A86D487B79732E16C05E00110D4F0623A01C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/220-196-0x000002250ABB0000-0x000002250BBB0000-memory.dmp

Download