c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 14.4MB
Sample260831-ffdsjsxtgv
SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
MD5 adc1ff1ecd313896455e610d15d4eaa5
SHA1 22180374f927b9132c3963caff9c1f28155010c3
SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
TLSH
T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326256582585201"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{F134AC65-E91D-45D9-A519-3B2A8A8BDF50}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5608	msedge.exe
5608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1728	3084	msedge.exe	87
PID 3084 wrote to memory of 4104	3084	msedge.exe	89
PID 3084 wrote to memory of 2224	3084	msedge.exe	90
PID 3084 wrote to memory of 4104	3084	msedge.exe	89
PID 3084 wrote to memory of 4104	3084	msedge.exe	89
PID 3084 wrote to memory of 3368	3084	msedge.exe	91
PID 3084 wrote to memory of 3368	3084	msedge.exe	91
PID 3084 wrote to memory of 4120	3084	msedge.exe	92
PID 3084 wrote to memory of 4120	3084	msedge.exe	92
PID 3084 wrote to memory of 4120	3084	msedge.exe	92
PID 3084 wrote to memory of 3572	3084	msedge.exe	93
PID 3084 wrote to memory of 3572	3084	msedge.exe	93
PID 3084 wrote to memory of 3572	3084	msedge.exe	93
PID 3084 wrote to memory of 4724	3084	msedge.exe	94
PID 3084 wrote to memory of 4724	3084	msedge.exe	94
PID 3084 wrote to memory of 4724	3084	msedge.exe	94
PID 3084 wrote to memory of 4664	3084	msedge.exe	95
PID 3084 wrote to memory of 4664	3084	msedge.exe	95
PID 3084 wrote to memory of 4664	3084	msedge.exe	95
PID 3084 wrote to memory of 4596	3084	msedge.exe	101
PID 3084 wrote to memory of 3280	3084	msedge.exe	100
PID 3084 wrote to memory of 4596	3084	msedge.exe	101
PID 3084 wrote to memory of 3280	3084	msedge.exe	100
PID 3084 wrote to memory of 3744	3084	msedge.exe	104
PID 3084 wrote to memory of 5620	3084	msedge.exe	114
PID 3084 wrote to memory of 5628	3084	msedge.exe	115
PID 3084 wrote to memory of 5636	3084	msedge.exe	116
PID 3084 wrote to memory of 3964	3084	msedge.exe	118
PID 3084 wrote to memory of 3964	3084	msedge.exe	118
PID 3084 wrote to memory of 5200	3084	msedge.exe	120
PID 3084 wrote to memory of 5200	3084	msedge.exe	120
PID 3084 wrote to memory of 5536	3084	msedge.exe	122
PID 3084 wrote to memory of 5536	3084	msedge.exe	122
PID 3084 wrote to memory of 5608	3084	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc4cccc188,0x7ffc4cccc194,0x7ffc4cccc1a0
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,12800891933568535910,1357536346138645518,262144 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,4306947510811461446,2321480444369039375,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,52611995753098095,7906091499379658126,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10440613118892502927,6279692538503748005,2097152 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12100099449742148826,14768124981635094984,2097152 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,13596792569250978333,14137977527068185218,2097152 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,10568398143572774792,5718727640319865767,2097152 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,2463322979274472975,6768737403635492175,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,359998936818577477,3752803928650050211,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7189242386620989431,7747150225439822580,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7189242386620989431,7747150225439822580,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,12905151810426892559,2317105774241546471,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,3323246121730584671,17878324758766294116,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,10415585720523778593,9779114529338931570,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,6200272600876666616,8276661353558076732,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9360060622358376728,17751405664842988730,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,3833514961711594744,3186772679213556784,524288 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,18303191603232506039,6878408639070198948,262144 --field-trial-handle=2448,i,18202584121767410778,6419175645678045330,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8f38031739f791af29784e55f093e5e48bb5a4e71d07b148ab99118fc535da73
MD5 e87e0504bcd183dc5d44a407a4dd2d80
SHA1 0ffd2a7de5f33236d765f56545cba24e018d85df
SHA512 c7c7ad14df6c8e11bc38925cffb618a2041672f2a12ecef1a0979d16b07c1106492873564e2542074a1e3793b13fa403abd02e0f39a1756dbe1fb91a86d0258a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T12DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 3413a8b2b3d660fd2dcec92eacf4c5990b5951b2ae7d04127ae2117a746f4361
MD5 9c9036b590c223be701a552c77fd5a00
SHA1 986202e4f80892f2d68b76b92cace7f886d7fbdc
SHA512 20f7d9410e688f4fcb0df236631cfa858767d8892e74b28b0b22e77da28a1aa59ccdb98ed79fe26cfabaca85fbee09689689a292cd1b6b7b05d72e8acf20cc69
SSDEEP 192:EjKJ4xCAj0HMMHRTTWWWJJttYrrOOU55i//MILO:EjKJ4xCAj0HMMxTTWWWJJttYrrOOU55l
TLSH
T1FBE1590386E4C7AB8F1511CBC9A1635D20713709EBDCE60C439C9DED708E49BF8A9AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a45c78489729d87b439d704c510ca0f1b06c5afdc9bf4552a6708f5f7ac13120
MD5 939bd835d29da08ba2575bca389c9bfa
SHA1 020b148da70faeedbab6bbf063251654ca39c781
SHA512 07aa01046380cb010e79524b6c88a2b9f6c099ea8a133b99e48d1fa0bef1b1c150bbd87e18fce4bd521c02df56f7a4e61314113e3a4788e479e2ce081ccb6f47
TLSH
T168717056B6A13490E32E4239F9D336D133B18C9E96C39D9132905C7F67177E0140ADDB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58de36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58de36.TMP
Size 3KB
SHA256 5537f6e20cf5841b0d7facf9ac94289c8a2e9c865b4d4fe390686f4bfbe19e98
MD5 65b28f03e3e6540343aff39c2ff3e438
SHA1 bfcef0c25732b34d2c300615edac8a28ddcb948f
SHA512 f842fbecac93d5e2895fdf28f6a27f1ce3526a35996152836fb91b6c51d5044373078f3cccbe9face15d7c13f218a4fde9507305aff2891f51c079eef854ecb5
TLSH
T184717056B6A13490E32E4239F8D336D133B18CAE96C39D9132905C7F67177E0140ADDB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 bb9e1239cadc0ab6a1ea5e51a085679a9ad2a1c1a4d9bdc1e9c3e94da47f1f5a
MD5 88aa6ba54a29a791078e2996b7abc192
SHA1 70e1b49d89081abfbbcd4aa5d23507fcd7484498
SHA512 ac494da62b6e44714d9ebda6996fb7d68035d09d1933bd5e9d6a84d786303549cf4a58b844ebf37332bfb55356ac5af56093bee07b10a1a17dd826918ef7a506
TLSH
T16B117DB3C3E595AE8A0116F09A28AE2BDE1D0506421C7D15C5D4FF27D3E3476E00155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ee4381fed23e0cd43304a8bb72c2be52ddd254b24e7c938d9b35a8c769df1260
MD5 a720585290e3c9cf61c5ca3e16b06db0
SHA1 519c26ceb2f22ab14e53527aa2ea63a99b9ca93a
SHA512 6911c7ce27bc056585790c962ca07b863081c92c1e2792f405db5e058cbdfc6776d3747a79f3d32d4b1229bf33b853a579c825cf25aec0684050822fa41a110d
SSDEEP 192:sxZWRwyM/jK1Ml8UQbkd/frsqa0IdpHMHW6+WNGYHGdr/Ig5uJ:sxZWKqwd/frsqatsHbGLI
TLSH
T1DD52C5166A34A977CCEBD20DF951BB53D6F44473A2900E44A9FCCA1C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0cbd9d0e61507d2afe8980bf56f2659a0db1093faeee1f7629391a458a793bc9
MD5 4a087c69385e9b12d1c525e35b96eb39
SHA1 6c9a9e50c8b438935b8d574dedd77545d95ef9aa
SHA512 25dc12e7ee6727db63107e2b881fa6b17221e6909ae1a02e99eb5aa513e69b4ed1ca770248c998e27484592da6dacf853bc064b0e4d69854508e02f3b0a93d15
SSDEEP 192:sxZWRwyM/jK1Ml8Mkd/frs/G0IdpdMHW6+WNGYHja9/IgrJ:sxZWKMd/frs/GtWHbGV9
TLSH
T1C042E6116E34A977CCDBD20DFA55BB53D6F44473A2900E44AAFCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f9557eb57209f607c066271f32b19c1af6d0333d3036f7fee835b3e28abafcbf
MD5 07e40666814d46caa08d4d9c38ee96fc
SHA1 c94b7f15f549dba0dce4f6119fd53fdfa2c24e74
SHA512 4f362a1457354b2646e0ce335fc9d44aae07c1ee1417e03562fb8fee1daacb5a032415b170d4b1ae4131f6d0e6cf22cd9ad92d5c163016dd647b4b3e0dc6daab
SSDEEP 768:ShUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RBroVB0/:ShUZYTMWvg0Pou1ja7eLZmR6A/
TLSH
T1D3D20B2F280CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA894C03C77EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 134751968ec1f36ea122ae02582fd462d685cc9b8e52a9c8446746b3cc2a8ab6
MD5 a16a43d7ed047a1b5f1f967853f439b0
SHA1 1d3fa727d42a1af4cea000114295bb1598042ad3
SHA512 ef6fc4bb3ee8a0915ba8619112ee1c854ce88ccdb9d1f454704717ba715abf1e2d63d5a8130c0b89550589ece412b5910a4016fb8fa2e7edb4b497eb5761cc44
SSDEEP 192:ERRKNx7Dz4DExxBTz30pR8nRnXkXNizuS8w0hwl2qWBOUxySF8k:EW3kdizuS8w0hwl2qWBOUxySF8k
TLSH
T107D1090271B70A053DBE2B0DA2958766074172637019742BBFE840B65E6FE385DFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597b22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597b22.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 602f726954b056b888eb23fc8d7bc73c1114779c30f34ab42c5b5bd66287cfc1
MD5 2fd8ed73180ef3f2eb99a6318b67efc8
SHA1 2f73b308f28e309d488eb947a715fc1bc626e017
SHA512 7b9d231b6551cfdd7400b0c24f8091c3a1078255727f2b72d547c1e3e0db704d1b57141d8c2c9a4a024934271d50cfb39efa5c081e776a280c61fd22a8347f6e
SSDEEP 192:yONH61VWQmiUyJmgGX5Obd+jbjzoryyRAb/ak32fU6:yONH6WpgGX5od+P8y6ZfU6
TLSH
T13F02D836A8686CBB8EE2BE49B44737135FD4206BEA556F84D6EC1F1C00D765C230A837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90ee3f71de3730ee7e116d45eddf7fbb7da3f0b460d18bc48f80ecac017e9be8
MD5 1f425b399dbc56b111a8c3cd6be93df5
SHA1 b7b1914a53e4ed7b97111637212e82584b2d1735
SHA512 abb22bb6911d4aa52f9dbea821dadbb77232ac7cc866723acd3b55b5d3868c2c64cb86c457478cc549602a3aa285377b36d45c42f09d1f22fd5a46460242866b
SSDEEP 192:VhJONH61wrWQmiUy+mxGX5Obd+jbjzoryyRAMXajJdqRU6:VzONH6eOoxGX5od+P8yQX2AU6
TLSH
T1F312E936A868AC7B5DE2B544F48B32139FE55127EA856F90D2EC1F2C01DF65C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 94082e00685813aa83796815ed4dcc74cf90a7eec831aebb62cb4c4bc67ee649
MD5 387d03156049d1662a5110ffa8b8145f
SHA1 1a19d896d90888ddc2af044b287a6d9c482e56fd
SHA512 136cdeddd5edf861e5f57f74382b835b265cf4c0396e9bd6c0f271c772cb9158f5be9dab823c98749b87ed664573b68cc4c46450fee996411cb4efafd153fb9a
SSDEEP 384:YSZcIhsNeXhg46jzX5od+P8yQXqA5b8v6de6:YghQxnObqAD
TLSH
T162825C729C75AC7B59F6B555B40B32139FB88063A6886B90D2EC5F2C01DA6AC130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 52c3f472af953130ba373db069ef73ce090e06f89e9b9944f1e3ba4f7c29f8ca
MD5 4cc23aaee6c16296caa6c38b0a7e4dbf
SHA1 c24a88bba1b2d09e47beb30f5669434f352c4eaf
SHA512 407b70b93d2b284ac6413734ff97863f902dff65f89eb18aa850f068d3ea6c13729705e01913f7386d5e5cc4cf957b0910e8361eadc2d2a29c1ff91fd26ed92f
SSDEEP 384:5SZcIhsNeOhg46jzX5od+P8yQXqA5b8v6de6:5ghHxnObqAD
TLSH
T109826C729C75AC7B59F6F555F40B32139FB88063A6886B90D2EC5F2C01DA6AC130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd3e452f-482e-4052-bf3a-f0cf35cd7bbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd3e452f-482e-4052-bf3a-f0cf35cd7bbf.tmp
Size 21KB
SHA256 4c4fdfbe70505ace5bc8fe1a0c56e91d30c6180d5a06a8a0c693d050d9e2d5ca
MD5 ead13e267e2890fe08fd6569f301ff74
SHA1 f6bd472f8191ac79a8a0170656c1ff7c745754a1
SHA512 9d6dd1738a8bb022ff28bfdf98c7d38652791033309f972eadcc8731669615c28921b3695c98c52996fe667cababcb6aceeb3f650d300c0db4372e94c1ae52c7
SSDEEP 384:xAiFiZcIesNu8TUNTUlIlOhg46jzX5od+P8yQX0A5b8v6de6:xbFQePwg3xnOb0AD
TLSH
T13DA25C735C64A87B5DF6AA45F94B32139FB88063D595AA90D3DC5F1C00DB1AC130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6609390390f42df2535c85d4e5c5296716182db519d4b9a610b550b78f878a8e
MD5 5af413903cb1c474194c7a6a79e29c30
SHA1 8afaa5567ad0efd3533c655c6c7b4aa1ad1be8cb
SHA512 42feee3ba7d66c77428716dc1e08aa7110a4fb3d72b919ceebd4587e44afc2a50336d658a6b4f7e85e08426a657a9bee6b61141c96f75e7642d7d4bc45aa4a1f
TLSH
T1CE41EB6CA6F91158B3B3AF5AABF7A86E547ABC272E06C45D00110D4F0563B41C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download