ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

Analysis

max time kernel
148s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260825-rr3rlazxew
SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
MD5 bd0ced1bc275f592b03bafac4b301a93
SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
TLSH
T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321416807911404"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{5DD8B0C5-4375-4852-AD2E-2F1FEC76BEEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2636	5108	msedge.exe	84
PID 5108 wrote to memory of 5000	5108	msedge.exe	85
PID 5108 wrote to memory of 4816	5108	msedge.exe	86
PID 5108 wrote to memory of 4816	5108	msedge.exe	86
PID 5108 wrote to memory of 4816	5108	msedge.exe	86
PID 5108 wrote to memory of 5092	5108	msedge.exe	88
PID 5108 wrote to memory of 5092	5108	msedge.exe	88
PID 5108 wrote to memory of 1748	5108	msedge.exe	89
PID 5108 wrote to memory of 4884	5108	msedge.exe	90
PID 5108 wrote to memory of 1748	5108	msedge.exe	89
PID 5108 wrote to memory of 1748	5108	msedge.exe	89
PID 5108 wrote to memory of 4884	5108	msedge.exe	90
PID 5108 wrote to memory of 4884	5108	msedge.exe	90
PID 5108 wrote to memory of 2300	5108	msedge.exe	91
PID 5108 wrote to memory of 4484	5108	msedge.exe	92
PID 5108 wrote to memory of 2300	5108	msedge.exe	91
PID 5108 wrote to memory of 2300	5108	msedge.exe	91
PID 5108 wrote to memory of 4484	5108	msedge.exe	92
PID 5108 wrote to memory of 4484	5108	msedge.exe	92
PID 5108 wrote to memory of 1508	5108	msedge.exe	96
PID 5108 wrote to memory of 1888	5108	msedge.exe	97
PID 5108 wrote to memory of 1508	5108	msedge.exe	96
PID 5108 wrote to memory of 1888	5108	msedge.exe	97
PID 5108 wrote to memory of 2852	5108	msedge.exe	99
PID 5108 wrote to memory of 3624	5108	msedge.exe	110
PID 5108 wrote to memory of 4256	5108	msedge.exe	111
PID 5108 wrote to memory of 2744	5108	msedge.exe	112
PID 5108 wrote to memory of 4704	5108	msedge.exe	114
PID 5108 wrote to memory of 4704	5108	msedge.exe	114
PID 5108 wrote to memory of 5040	5108	msedge.exe	116
PID 5108 wrote to memory of 5040	5108	msedge.exe	116
PID 5108 wrote to memory of 3972	5108	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc111fc188,0x7ffc111fc194,0x7ffc111fc1a0
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10787643507605680139,78251486706810479,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,15316812089364406134,9535731388370924994,262144 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,3265188386398227145,3272304054936261721,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17355433951723935771,2513894601014585180,2097152 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,8406237002015229319,11990051267369510289,2097152 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,3789433732630506843,18011506352971186577,2097152 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11994786278999759324,12967998180970122623,2097152 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12871742566911744532,8007473537373310825,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,16825824353939729229,5743906403585501012,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,7289738223960835594,12670077989982086034,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,7289738223960835594,12670077989982086034,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10658096889564145476,12257000919712728021,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,13415077740124220081,7385098931523283965,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,12271433404211649978,17120210408673439125,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,3800686685556083513,2827039641503913703,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,1091906294470214888,13161231182070655377,524288 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5180,i,11549829951144658345,7405560513473486668,262144 --field-trial-handle=2280,i,8421711183835737378,3671565016053901281,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

9cb9c1b2-e6b4-40ae-8a97-a15e554cc1b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cb9c1b2-e6b4-40ae-8a97-a15e554cc1b6.tmp
Size 9KB
SHA256 158f4a6de46fd41449c8b040b3ff8745be95c8109c24985ceef213ce92dd6741
MD5 a1720c66dbdff7994b8d942c8c87b89d
SHA1 1ab4dfd6c353c2234a9d3e047c800a3a1c72869a
SHA512 00c5a63203357b508aac858d0868f5f0d528815e0f1de9187a71fcc8a653924888ef8687275fe3f64e35a44eff99ba2d30895d42d8e200c0128abdd50f65d33d
SSDEEP 192:sxZWlkT/ffszTpIxIdpd4HW6+WNGY9IKBB+sIgrJ:sxZWuT/ffszlLyHbGQj9
TLSH
T14722A7126E28A87B8CC7D619FB25BF13E6F9503191951E58EAFCC51C05E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 31b535d1a35474e91ab63f39286aab59ed4e9536cf9562c000127bcec085b65c
MD5 01401144399da7d46a1efa12f2c6d815
SHA1 ccf9a5fc35337284cd760538bbcdc675d734e03d
SHA512 ea87b0606eb5a01fbe66ef46589857a5c0ab92ed11836c5c5bfb131659fd4550cf02404308c4a1493dd80cd96aef235ab1e04f073d565a0dcb37fb673a25e98f
TLSH
T1C0517F3C1A110862EBC00533F0FB9A54717985DDFA13AE73C6B36E7A6B0A321C00E389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c89a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c89a.TMP
Size 2KB
SHA256 4cb81b4012b4ec50ea6da359bbe4c8fee6c917e6812a323f3cd2ac370660b204
MD5 4719bb0c836ebe06e490e70fccc27c0a
SHA1 8298a581ffe88fcc00cca962719c84fc0ae6cdb2
SHA512 7c5ebc0582b041683bc28f188a077c707e0950bfceae3fa9c465fed090395614c3492e31872122ed683859359a4c6bd74a6fe0e83af9062321cf9ce0fd008db8
TLSH
T182516E3C1A110C62EB900433F0FB8A54B17985EDFA13AE73C5B35D7A5B1A325C10E389
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 694B
SHA256 588f3e5a107c6a070b40f1b572b87afa90718ce5d6edc5a3ab0a1c5378064c2b
MD5 0341e7498cecb578272ae1024acc8d1e
SHA1 2cb2f0872604df27e547158ebd9e9f00c2ee6f91
SHA512 1aac330fd6ee08309b794f39010814672986a6276f8aa9d43eff0b8ce4b31bd4a6a5f2cefb5e94841771f54c73ba2eaa7983a2e0c41eb219b43daaa2940d3378
TLSH
T1F9017BF383D596AE891156F09A24AE2BCE2D0502421C7C19C9E4FF2783E3079E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4f328cba32da1bc258c325139316c32641fd20264fbc5d983557de71926d2058
MD5 83f7b62e2d8ebcecb360a060f1e73726
SHA1 63bb5518d0e22ded074efba15841f785b6eece0b
SHA512 b81da5a195143117e30de334b64ea7da634538a2fa64fe2f05856f5698ee17c088e8f77a68c102afc0800cb991d2f640a4555ab66c83e528f94d1b4902a25986
SSDEEP 192:sxZWlkT/ffsQ3pIxIdpd4HW6+WNGY9IK3B+sIg5mJ:sxZWuT/ffsQZLyHbGoj0
TLSH
T16022C9126E38697B9CC7E609FB15BF03E6F5503291951E58EAFCC61C05E7ACD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 59977f35c51ce755c61fd6cf6ae6233a03a9f5b132752c0dcda4f592bff18601
MD5 0a5e7182953f9c3170ab60378b2ec6fb
SHA1 e67dbdbb6749b8f38e89ced151d8da0bcc246a5d
SHA512 36beaeb8752d16d058224cb2e37ab6f177f1c0b4b62203d63d3c1fc69da2ff6d36b37ec4f83a624268d6285a270ac3a406f87bcbff4df5365e063ee740dddb58
SSDEEP 192:sxZWlkT/ffsQTpIxIdpd4HW6+WNGY9IKBB+sIg5EJ:sxZWuT/ffsQlLyHbGQj2
TLSH
T19C22B6126E38A87B8CC7D619FB15BF03E6F9503191951E58EAFC861C05E7ACD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c9d8820a80b1e050eab078a39e09535be26dcaaece4f9b609cedab661caa6160
MD5 b911b8c475a5220b44bbf8715028b4ac
SHA1 00d771a149a7e6a3272dc1119bf4644a7d148732
SHA512 9cf582951882b454d3c89ac9a339335ebf143bd51f364ee4daf0e5e4f5fa7a04cd564aded9516e20b8d96cf928353463d110fe10f547aa8061df7006acb6cfd0
SSDEEP 768:/ZyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7EroWbqw:/ZyvIZwWvu+Q+u1jamFLeR7PWN
TLSH
T1FDC2E92B240CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fbf01b3a504641040aa3ec0795f9d9c7f47bfcf06be231b3bef49349aff1c487
MD5 e3d8baa32e1c2c8eb1ae38849230eeaf
SHA1 02933cdb8caa9b7953898facedccd8a3250b734d
SHA512 0db19e42472fdc64dc5bab9014cd76ee8c92e0673200efcc7a1127c1ee380a770870fb27e7c95de9cdd7d52f0a92f7656e2b6ea21929b746837545bf3e3bc8f2
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDiQSJWCA8oMQsPXeaMKGZeoMyyCPQSRu76H:mTT99T
TLSH
T17A916F4634BB02C22CBF680CA692D5265B423066789CE97F7FAA00A10F67E211DFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7cd1e25-2e5d-4446-85ef-a5d99ddf1958.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f7cd1e25-2e5d-4446-85ef-a5d99ddf1958.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74dcebeb6e6333d5192453f58bee7cfddfefd8d7a3dd3f1a21d57599025892ff
MD5 11ab07069afcaa9ec0cd42c0ec0ab19a
SHA1 9c44129ae8ab63595212cfba7ab2b9945f27a108
SHA512 6282abb34c21398929498d901b5cebc7b435dedcee62728150f8fbca9bd180d93295d5ccff0f795ff4f4a98af4c7e443ee8a668d6596d455221f60f695e8e213
SSDEEP 384:bZcIhsNLUHNozi1o0e+C9d6NXeKwyivr+aDom:Dh2f/Fo1iTlDZ
TLSH
T1BA827D325C785C6A69E2E145F54636139FB8807B9ACE2F8095DCEF1C01EEA98130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 baefa404be24e97828613e08f40cb1a0e783034ce001d375b24a78d788b2dcec
MD5 d75a52d47134d39b5b8d36c8580813cf
SHA1 c2cc6a4c60bbcd65a2b8c75b52edac2e729d1fba
SHA512 633d26ea078c82f38a4cae2c9315f1dcf7bf424ebb2aeacd5f97570c9599e0a339c9371602e7fd7346f436ca0602148c382a79acfa457f2d4f440706e65fe7ec
SSDEEP 384:SiFiZcI1sNg8TUNTUlIl0Nozi1o0e+C9d6NXeBwyivr+aDom:ZFQ11wgLf/FL1iTlDZ
TLSH
T138A26D334C688C7BADF69A45F94632139FB54077CACAAA90A2DCEF1C01AB5DC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bef7c3a1edb6dc4ec6e124a55aa2b8b8f1c9e59326a2f9f4bb29c82936bb6f62
MD5 7eb5827d94ee87c965eda49a3b54c350
SHA1 b6bbf28358cd6400b90f2838d0b3733910983c5e
SHA512 f1f469e249f4fc56a29fc948ad0464c5ce9585f3d7e005ca4ad682020f3b36f98d69f82b85393b5da7376fac090281d7c8251fdf0888b02ddfc89da13b5940ab
SSDEEP 192:JONWS6v+YLNQmiUyG/Zh+CGX+FdeNNmus1pU6:JONT6vz/HZh+C9d6NI7U6
TLSH
T1A002E935AD382C6B9EF2AE05F48737135FE4117BE9962B91D9D82F1C01D764C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 13d25438ac3da9d257d885e85618a46a601a70fe35440ec373712b770f94c6bd
MD5 db1767f01bbfd446016bb1af9a24fecd
SHA1 0faa70e601f8946bf1ce12fd47494cebbdbf14a3
SHA512 cc22e2fbd0e06ea728e972ae8c641eab839155b247b2cdeb58f97324b74a42c69ab4c7bf213d48999829eb6916710e6c3d3d78085d9a626f7d76e9da8b16415c
SSDEEP 384:aZcIhsNLU0Nozi1o0e+C9d6NXeKwyivr+aDom:YhNf/Fo1iTlDZ
TLSH
T179827D325C785C6B69E2E145F54635139FB8807B9BCE2F8095DCEF1C01EEA9C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dedaaa57c20f76e1624698b654d253c398365678da9d5701194919e8f36cc60c
MD5 36c1c13d98f65a24b93b51d2bf68d97a
SHA1 258c11afebb0eb90073c6d44443223e41aaeb954
SHA512 448d386051e17bb11264eba629c934a0b05b50b57e768c404f466ea7116b322bb3a5f2869dbe90ce927f5e98647c53f0ee2e94b3a9edc0a51c0436902c43e852
SSDEEP 192:mONx6v+YLnQmiUyu/Uh+CGX+FdeNNkGQNbCH4qWyU6:mONx6vzFNUh+C9d6NXeowyU6
TLSH
T1AF121C35AC785C6B6EE2A941F48335135FA45137EE8A3F91E5DC6F1C01EF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac64bb68-38fc-4f28-84db-3ba5e92aeb57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac64bb68-38fc-4f28-84db-3ba5e92aeb57.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d02ce270f3559977e3257ab820bacbc081b247b35b3945ad8ad8e53431a91f8e
MD5 fe92f8e85c67bdbc5bce585cc8e80024
SHA1 88a677f90e94ae8884418e34db9ba202ae5080a5
SHA512 2f00c8bb9b89aeaf320fc77b25986a204be53df983357848c43821c6de5ce227f97811ac825c2ff99069dd26d2812971da2afac85a7fb769d55816671cfcfba4
TLSH
T159410B5CA6E91148B3776F56AFB6A86D487EBC772F07D45D50110E4E0662A00DC71B33
MD5 SHA1 SHA512 TLSH

Submit Download