ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260820-zncd8sysdv
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317328889388376"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{204E28B2-FD90-4004-8361-6F37AB074B25}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1556	3776	msedge.exe	87
PID 3776 wrote to memory of 1280	3776	msedge.exe	89
PID 3776 wrote to memory of 4764	3776	msedge.exe	90
PID 3776 wrote to memory of 4764	3776	msedge.exe	90
PID 3776 wrote to memory of 4764	3776	msedge.exe	90
PID 3776 wrote to memory of 4060	3776	msedge.exe	91
PID 3776 wrote to memory of 4060	3776	msedge.exe	91
PID 3776 wrote to memory of 2376	3776	msedge.exe	92
PID 3776 wrote to memory of 2376	3776	msedge.exe	92
PID 3776 wrote to memory of 2376	3776	msedge.exe	92
PID 3776 wrote to memory of 2096	3776	msedge.exe	93
PID 3776 wrote to memory of 2096	3776	msedge.exe	93
PID 3776 wrote to memory of 2096	3776	msedge.exe	93
PID 3776 wrote to memory of 2272	3776	msedge.exe	94
PID 3776 wrote to memory of 4000	3776	msedge.exe	95
PID 3776 wrote to memory of 2272	3776	msedge.exe	94
PID 3776 wrote to memory of 2272	3776	msedge.exe	94
PID 3776 wrote to memory of 4000	3776	msedge.exe	95
PID 3776 wrote to memory of 4000	3776	msedge.exe	95
PID 3776 wrote to memory of 1572	3776	msedge.exe	99
PID 3776 wrote to memory of 3008	3776	msedge.exe	100
PID 3776 wrote to memory of 1572	3776	msedge.exe	99
PID 3776 wrote to memory of 3008	3776	msedge.exe	100
PID 3776 wrote to memory of 4824	3776	msedge.exe	104
PID 3776 wrote to memory of 4240	3776	msedge.exe	112
PID 3776 wrote to memory of 4564	3776	msedge.exe	113
PID 3776 wrote to memory of 4728	3776	msedge.exe	114
PID 3776 wrote to memory of 3144	3776	msedge.exe	119
PID 3776 wrote to memory of 3144	3776	msedge.exe	119
PID 3776 wrote to memory of 3988	3776	msedge.exe	121
PID 3776 wrote to memory of 3988	3776	msedge.exe	121
PID 3776 wrote to memory of 4124	3776	msedge.exe	122
PID 3776 wrote to memory of 4124	3776	msedge.exe	122
PID 3776 wrote to memory of 1068	3776	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c40fc188,0x7ff9c40fc194,0x7ff9c40fc1a0
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,16470373837668396026,74542790744025800,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,12244828925512727321,16965235783464453278,262144 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,2288392520421713171,8122795143070302797,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17177364125905986954,9912377784174932352,2097152 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17355771754293372496,1292337325722160397,2097152 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,8039618820464871646,4697620052533158663,2097152 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,7222793325165061712,3409422689529622664,2097152 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,1063025267213207889,11210110772529435222,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,2202174855867316958,12486224866666305677,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,419653718396531588,820045930011199152,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,419653718396531588,820045930011199152,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,11333017390107308969,5830868193944479874,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,4459232625092801633,715172756852834850,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,3385239232189461295,440487515527122853,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,449780042236497198,689918931775057731,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,7759198315409314454,9051686526866914726,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,9480958491994256648,8513703335953648522,524288 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,939711967096165178,5988836596269043743,262144 --field-trial-handle=2868,i,8297219058717079458,33255163198325048,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 015fb3077970e9035a1658d1b1757b5f1151c502ca5aba72322677dd389ba262
MD5 a332e5771886514700151487fc0803e3
SHA1 fa223baa69dc6c50019b6b01c0dbdf1c52de150f
SHA512 98ff8ce5a74571dfbd8813fda54fa21ed146df8d130405d052cf93d1536c6572a6b23be98fc604180e5ec939533ad70e021ad455ebfb2f457b79ae2658f84ef3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7M:fwUQC5VwBIiElEd2K57P7M
TLSH
T1BAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 88d997b3a9ae26b1ebf54f760a9b7b33013220e226f340eb1dea6dd9d0dbefc8
MD5 e232712161c7cc5ae83cd563c8ee351c
SHA1 5adce890334eeb458e9db0166905a8069b96011d
SHA512 2a876b8178fd87158f9a6e25c3bbff464df1135e287a4e03f5700bba67f3c18dde6a5adf68881890547e0835ff7a12f115b32c3268fe78e3355a59e567208ac1
TLSH
T15FE0268C18CCCB7EF614698B5178470D8280374EA7C8E92A170589C4755A47CF7AA6B1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3cd57fe00922d363affa61b77460d645d33615a2e72c5aae3297daa514fcc24a
MD5 b65614b6dd9d996b7b4b38d2386d176b
SHA1 8cbe90295ecba40bcbfa916de623883490177351
SHA512 aa9e9a983fb3738dd919c805ef875d11aed33e5e584e9f7e2ac88a33bbd200967f1e38f987f43e86fbe315d14c51620b9c85c83fdc925579f25c9025abf6a97a
TLSH
T11D71E92B06C31859D7605632E4D142067A7EDC9DCF63BD66537C447EFA0A7E28CD64C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590054.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590054.TMP
Size 3KB
SHA256 af0e3b21e72b8b8ef6c9091d20fd62be79d385a695a7d1637c7b39b7a00e1f08
MD5 30ca0d2aa5d0f7a478de179c7879b64e
SHA1 17e6a5fe63aa5f7a90f6135a5ccf97a8e1668406
SHA512 6449ff3c48ba717e1da1d493f299ec5d516d6859d94df33360407a00bdb4312fded02dd2874d29fa1e506863fb1e446345d6f1125347f89a0cec2582cdcc60a8
TLSH
T12271F92B06C31459D7200632E4D14206793EDC9CCF63BD66537C447EFA0ABE28CD60C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 623e91dcf91bd44449c86b3cb5ba642d0c94d4848d4a6cb698bebe23cbc890bf
MD5 46c7544b5e9d44639f8a98993d65622d
SHA1 4575192a44097c8545635848d67f3905ec5ff85a
SHA512 13b9fb33d60b1dccf87f2dddc54049885d182a0b20c8c0032dfea8c610b7319f5608169ea6be3394b4702a396d513a06c5ea706c45b4f20dcdbf5040e64070e0
TLSH
T10C117AF7C3E5856E890556F05A24AE2BDE2D0606422C7C1A89E4FF6BD3E3075E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b69421a37d2e635254b5ce29b6ebb1463e5879dd30fe8d340c0bffc4357f5908
MD5 277597b1e1fdb40cdf44c3d0e9fc8262
SHA1 e054bb032b6e917a2d0404f603b306bd8a9ce848
SHA512 a47c60f917681eb0bad9d95963faba904925c7bd09787ce8d51b64b6019f57f6c251f59d81164395d8c9bf43d63d9df813654f4901fa797e46db00ef6b4ed966
SSDEEP 192:sxZlkR4yM/jK1Ml8Mkz/f1svTsKIdpdaHW6+WNGYwKy07IgrJ:sxZeqMz/f1svQDAHbGW9
TLSH
T11142E9116A34A977CCDBD209FA51BF53D6F94572A2900D44AEFCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 df0948fd7597dc0f32d7fd52e5504b27a09ba25b1310b28cee41a88b2145c818
MD5 402a3bf263c9c89959bc87a3ff86d9e9
SHA1 5c929ac965082c8e1a1fd5cad09e7781dedb370b
SHA512 76531d7f158719f663c281c4bf58e3ce060f21994bf30e81963f2bb779a68c36075be6e693a673b16203be109260c6e4bcd573f3b649b2599e07f3d27882d5d1
SSDEEP 192:sxZlkR4yM/jK1Ml8UQgkz/f1scT5KIdpHaHW6+WNGYw8fH07Ig5xJ:sxZeqqzz/f1scND6HbGlh
TLSH
T1AE52E7116A349977CCDBD209FA41BF93D6F9547292900E84AAFCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fd86fde3c221943a18947279f1b6447c8c24f3dfde3aaae7e24388848e6e29ba
MD5 9a27a2f51b9cba6bdcf854285c135996
SHA1 f79a116ac7f7943eb715c54aa58c00e83408d3de
SHA512 e95a27406ca6e091f7772a2f86b6133690e5fbf0fb7e7272b748810334a2fd7f9987e85835a305be72d7160b1f8a5722b7f7afbd059504dde9224cd6c54b95ed
SSDEEP 768:TA4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dorohPcnIaH:TA4jeXmWvmKLEu1jacPLZQdTinT
TLSH
T187D2093B284CCB7E4F844E5CEC26AF976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a4547177c8ecec35b2d38acc6c24b918e0b8b69e4b63cc3b9eaa95f42e710308
MD5 bb45cf8d767c086a1d7e8cc196b3eb3d
SHA1 9f3680da463a9771b59ccabacaeb0154e269c79b
SHA512 a35b80827f75bae69b631d452eec61d1d7c01b3fedd46e128577e74df2182577dc133919beca3ef92d335ea8b900ac1d2473aec49f3309c5a81fe923a406998a
SSDEEP 24:KdZ5fZUZ/ZmaZjdZLZHZv4Z/ZD+ZmIjZTZvKiZIhaZNZv1EZZZ/SmZRMZE8ZXZk3:Kk8IXKdOcfyl5IFKagIKCIfK3KkXyU
TLSH
T140915E5576BA42113C7F294C8794872BBE433163380CA46B7BAC04A38E6AE544DFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599d5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599d5f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 36849139fd90e93b87ac91174e305d4e6f9b51fbe061842064670d12a6733e62
MD5 3dd28e959e1b3508bada33b68cd72bf1
SHA1 85c2704820d42ccf151a3e3f61f8cc4f9b55959a
SHA512 6c84eaffa8f91c8c3db3c049b94a5cf53b31f14aa3bf0f3485ce251113af3c1ec2b8ba6fb839ffec68c59a2dd16f5527d7fae8ed7db1a301619e8a7409690fb8
SSDEEP 384:WZcIhsNkl+dA9Ef+x82YEX2tFJivnUPos:EhB9E62HJiAP
TLSH
T160827D325C78AC775DE2E245F44625139FF85027ABDD6F84D6ECAB2C009E6AD131BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 1a5e6e92311ca5794bf490b692c80b9913c94b0593830a89a69fc35275740690
MD5 5615ba5b4fc955a2de645936ac5d3a0b
SHA1 9fc33fa57724d2f8a442bcb2362bd324589b1416
SHA512 8343b65a2abde82d58e501306f0f1d04786fdd353de245ebacd7317dc90b524e59bf32c3c2d9324f3ad1af27f4669c9c38237a12e35bb19be8f06d9f5bb6a706
SSDEEP 384:WiFiZcIlsNs8TUNTUlIla+dA9Ef+x82YEX2rFJivnUPos:9FQlpwgy9E62ZJiAP
TLSH
T103A26C334CA8987B5DE6EB45F94A25138FF54067DAD9AB90E7DC9B1C009E5DC130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 235cc90fd9497932fbcdf50ab81e35960a7acbe487b3f3a03b113334f42aa2a4
MD5 9b1149b77232c403f34b349227a4d78d
SHA1 0f01cd26d33c603e53fe8a2dd1a82861b134fe1d
SHA512 1392e8e90f4f9a389c465f226502023d0bba2b68852fe1d0c6df8b7a5b67cb37fb485fc5745adb9e87f826fa7cb3232ca41540a2fbeaddd2d9e8791877179609
SSDEEP 192:EONs6hZ0QmiUyzHpc/+jVLjzor2Yl5wOZPjU6:EONs6ocpu+x82Yk27U6
TLSH
T14D02C835AC786C6789E2AE46F48737235FE5112BAAA56B84DAE81B1C008765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fbadadee818c0eeba16b080a9edbfea20c4088ffb9131dc80ed27ca2ae78ac88
MD5 18ef9b62b9878660e38385fcd681e192
SHA1 c1089b90bbd046754de40a78d0197287b9aa7980
SHA512 4bd0ccaf97e2c6151ea06db9fc50b85f0d616fc9c7a8669901e5785e75b4b2385189eaeae58c1975bc347f2f9ba36119160f7c9f7ff1dc293a9c9d30996afec7
SSDEEP 384:IZcIhsNka+dA9Ef+x82YEX2tFJivnUPos:2h49E62HJiAP
TLSH
T17D827C715C78AC775DE2E242F44625139FF85027ABDD6F84D6ECAB2C009E6AD130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ac25777e3ede91e23f40d947190d5be5a38df6bfe3a3d86014f19beed2bfc67
MD5 71bf0cc5bb9370340a501aa12f82f572
SHA1 062fb9938aa852fa00719cbcc784ec39e9a2174f
SHA512 cc7fa3319ebbc0c483552d276df50370b43589b27a52b4969d4712621fed982d6881961d7e26cdd78ccdcd89f40bc41a66b604450936d31139c59b65ae520108
SSDEEP 192:MON16hZ1QmiUyKxHEc/+jVLjzor2YEXxEUmr5cOq5rqYU6:MON16v3JEu+x82YEX2g9JU6
TLSH
T186120932A868AC675DD2BA45F48736135FE55117EE897FC4D6EC2F1C00DF6AC130A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ae7271c-ad1c-4868-9799-202485a2a9e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6ae7271c-ad1c-4868-9799-202485a2a9e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 87acd130dc86474cd26c46a7fe12b709a9e9f18e0315f664d9cba2ab55423200
MD5 efae314100feadd97f6b26808ba327e6
SHA1 8bfd051d21c599673a3fe64fd8bb1730cb4c1c6d
SHA512 22e98cc28c3eda926304b4284b6ed48707ff898daa86fd8b8b04b0fd5f655a620ef3f424a72cacf8fe5b746cc1052ba31ed60b7b21eef8a421aa1ef60d810a37
TLSH
T18F411858BAEA1108B3B77E599BF6786E547E78772F0BD45E00110E4E0B23A40C962B33
MD5 SHA1 SHA512 TLSH

Submit Download