bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260831-nsa67agb44
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326502804517873"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{3A83EB53-A017-4CE4-8264-B787FFBAFFC0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3844	3480	msedge.exe	87
PID 3480 wrote to memory of 5004	3480	msedge.exe	88
PID 3480 wrote to memory of 2168	3480	msedge.exe	89
PID 3480 wrote to memory of 2168	3480	msedge.exe	89
PID 3480 wrote to memory of 2168	3480	msedge.exe	89
PID 3480 wrote to memory of 660	3480	msedge.exe	90
PID 3480 wrote to memory of 660	3480	msedge.exe	90
PID 3480 wrote to memory of 4688	3480	msedge.exe	91
PID 3480 wrote to memory of 2776	3480	msedge.exe	92
PID 3480 wrote to memory of 4688	3480	msedge.exe	91
PID 3480 wrote to memory of 4688	3480	msedge.exe	91
PID 3480 wrote to memory of 2776	3480	msedge.exe	92
PID 3480 wrote to memory of 2776	3480	msedge.exe	92
PID 3480 wrote to memory of 1776	3480	msedge.exe	94
PID 3480 wrote to memory of 5044	3480	msedge.exe	95
PID 3480 wrote to memory of 1776	3480	msedge.exe	94
PID 3480 wrote to memory of 1776	3480	msedge.exe	94
PID 3480 wrote to memory of 5044	3480	msedge.exe	95
PID 3480 wrote to memory of 5044	3480	msedge.exe	95
PID 3480 wrote to memory of 1800	3480	msedge.exe	98
PID 3480 wrote to memory of 1656	3480	msedge.exe	99
PID 3480 wrote to memory of 1800	3480	msedge.exe	98
PID 3480 wrote to memory of 1656	3480	msedge.exe	99
PID 3480 wrote to memory of 4288	3480	msedge.exe	101
PID 3480 wrote to memory of 1624	3480	msedge.exe	114
PID 3480 wrote to memory of 900	3480	msedge.exe	115
PID 3480 wrote to memory of 1600	3480	msedge.exe	116
PID 3480 wrote to memory of 4720	3480	msedge.exe	118
PID 3480 wrote to memory of 4720	3480	msedge.exe	118
PID 3480 wrote to memory of 632	3480	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffa270dc188,0x7ffa270dc194,0x7ffa270dc1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,16784691935323743221,3300723541331443776,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,13365293955353202700,13732918965367754252,262144 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,13558201519500061611,9833543991057343933,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,14801768517989253664,9865366068038194108,2097152 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16079326975400482011,6950514644755668239,2097152 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,2178824024864915505,4979407245376548504,2097152 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8407371871807744582,4998911769733777424,2097152 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14218804734739903371,18081731192334255240,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8558017911821523428,2001000669399226375,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,9234472732624578333,5813576099968820206,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,9234472732624578333,5813576099968820206,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9809333176992062995,2606804599614614009,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,15241155907108733356,10660949608322258205,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,2028658468287388851,10519543588483655731,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,3240881946684474561,11184294716638296481,524288 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5732,i,13433034365773213428,5938116816526108917,262144 --field-trial-handle=2188,i,6681093147151755841,9836236724025568747,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

740de6bf-c65a-40f7-a048-6f44629495cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\740de6bf-c65a-40f7-a048-6f44629495cb.tmp
Size 18KB
SHA256 953b97b328f3ceec42240fbb9eee837bc27ecdc87c992335f32ebfab12282f5f
MD5 9648673d7b9b8b3cab01fe0c0b470581
SHA1 8e64539e06c09b3c902fb425e81f0d886ff5a0b4
SHA512 13dd0dca295c46911a6641749af3d1e4fd74d247e297f20e9cde4c02c186398d9b8178a0dbac1d1630d024b7eab09862e17b1eadd9f632f347cdbaebf8af1402
SSDEEP 192:ubm+xasuheOwQxMGsNcSQl7+3vc6QmiU1U4V4atb0X+FA42YyuNiLMgqlaJyGb8r:RZcIhsNcSxrTKa91AlWb65b8vQTSeK
TLSH
T1FB826B711C38BD7659F7A445F98B32038EB880779AD92B50D6FC9F1D01EB5AC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7292b7f256241bc401a4edc6877bff931c1ababf0b845c6d3d2bfbd9a5b311c4
MD5 a0e1cf559d0091554785930a9a29b16f
SHA1 707a2ce00e0865734f0b7d0dd4fe20005423a5ab
SHA512 8ca73508f9d4e3acc2d772abcce89b046ee3da7d7a1a200d4133fe646d1b8c052a5c571f8969c142718350dfb7ac7209748a8bf3cf621a894d697573f6d309aa
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e2f7e0cb4071be8dd1cabac34a1a5fb1d3ce25c7592087e58ff6950bf1128352
MD5 a705fa033969538ab0992d4021653778
SHA1 ff1ada48385b23303ddc9cd1e3117f1d6cb64a60
SHA512 e58fd2b00fb444d3defe92b97bb0cf857e5bdb538cb03b0c40dee3d4ff0c4998d02673d205ed1d0516e40b5bdea8b29626940fe9edd9bb6b492723a52724565b
TLSH
T13D715094CEB2C591F3633C32D2D37129753976B94D13AF160344EC3C6A2AB2D7EA1144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a311.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a311.TMP
Size 3KB
SHA256 d2e7c7dabbf8164af3db66bcec40644f574afa60a2cd15c771c6e5b492ad57d5
MD5 f1b5533fdeaafe0ce8a84e7f3ab8ecbc
SHA1 3392c76c14ecc47e235370d3d2d250b1bce10740
SHA512 e7d3b7aac3a6ec66f0d122d940606f0b4c8480067af8f122cb431b6819a526ea47d593ba440a273bc8ffc24e81d36cc2906d465e982cd8a745c41eb4826e1e9e
TLSH
T1E8714D94CEB2C591F7233C32D2D37129753976B94D13AF260344ED3C6A2AB2E7EA1144
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 fa9408280c80a0673e1ca2589723fec85ae05a1a8620a39f91933188646a49e5
MD5 958bbfa9ccf767d1ff3c3f3befd1b494
SHA1 5c5871edc8e728424f24e95da3f65618501065d7
SHA512 eb305a2d9c6f4b25a1090a14fce949eba0b72bedaca6cf1a9346c1165f514c93da54dcda5ed2430030d2f7917afac8c655bba986ae9c89909fff041cc344aad7
TLSH
T1CF11BDF3C3D586AE891116F09A28AE2BCE1D0601421C3C1AC9D4EF2783E3475E40259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 89aca5d71dbad21522e25e14cf347b6d27762c058f20df79b0ed5f438927fe78
MD5 8ef5066b99c574e54485f84149f566fb
SHA1 67bce52e67652b07d5e9a6690018c14070b19516
SHA512 79e90fa0c423f1f237e3a717c7c1b8deb6a49cc6749c22d611e080a581148235e30af2f60eaafb37b4e69168c3229cae3c598b439e2704803bc3a24463f3431f
SSDEEP 192:sxZmR0yM/jK1Ml8Mk1/fMsOEoIdpd/HW6+WNGYLzf7/bIgrJ:sxZmqM1/fMsOEZJHbGq9
TLSH
T15C42E8116A346A77CCDBC20DF955BF53D6F95572A2900E48A9FCCA1C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3690f1f3977358aee1b1c23e9200335a565e88379b84f8cddad12e8e5a98ff52
MD5 0d66605106a64e8e73ef5787b62ead89
SHA1 fb3e1ad3314e85fbf7b51391c237eea3a0d07e8c
SHA512 bfee7c9354560bd150868d707910e431c67f67c8068efdc1dffcb404927aa799bce6a0b2660675bdce87d0adf970d7b7f5f8465dad16c433431ec710ab7af2f9
SSDEEP 192:sxZmR0yM/jK1Ml8UQG8k1/fMsWToIdpH/HW6+WNGYL/y70bIg5GJ:sxZmqqGH1/fMsWTZfHbGs8
TLSH
T19952F8116A386A77CCDBD20DF995BF53D6F8557292500E48A9FCCA1C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 94b5fc2c10194791f4e19cbb6f9bc90f50ad4f56ff94402cc7fc0d3021de14bc
MD5 87c571a058059e8bd04425423862f68d
SHA1 bb6a31c19f2dcfe0abbf33c79df12333ae6a7400
SHA512 92daf46fca65fa7162cfcdc4d14b6cb70ca680468c74914e69a957d6af109d2eb927f45eeec737aec2a5527d726c61900c08d4d96235b44d1d9fb6af01677f97
SSDEEP 768:2Es6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNNroGf:2Es6pD1WvxzWju1jahILIsNmGf
TLSH
T1FAD2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 58da1f69570cee97bc962a92090b660a515433ea38b9b8bbf0e939d29c1ffd02
MD5 e4cfddadb156b1c5dfe14fbef4035276
SHA1 598e4a87984547075049b8a336b664d63fa53560
SHA512 5865e31ddd2c3ceecfd5f9a50ed6ef0164cb883d684b9195156f63c19491eb75ae2cee58582dcfe0186c7b8685f52d939aac7ab01cf9b02ff1d5a21e434fd6ee
SSDEEP 96:KUAAKtePuV2Ku8SKy0K3KE3SKAUeqooK529:iixdf+ZjO
TLSH
T11FE1191272BB03033C3E6948A2658B274B86B1633118B42B7FE905B60D67E355DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5941a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5941a3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a9b861d0bad93e105f9f05417d59c07d139bb8e40f48b79dfe1335dd8cab294c
MD5 0e90c7b852ce8fbcf0467391746de8c7
SHA1 0b2d3a3f367070f6d3fd3d64902a5daa49533de2
SHA512 8703cb828e00c7dfdd9f2d1f56d181019b16af834b46035a9bfda1a2c3092ce7345ad4b9bc3b2c3d0f7354cdbb4c9ca8a1638571c21e59c96f981c2980ed3d8e
SSDEEP 384:piFiZcIOXIsNU8TUNTUlIlSxrTKa91AlWG65b8vQTSeK:AFQTRwgKr7Y6Bw
TLSH
T119A26D724C68A97B6DF7AA45F94B32038EB480B7C9D5AA50E7EC9E1D009B1EC130FD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 160dfbd0d372183d278ce5d50eaa27b8eaeba36c45dd035f1cc5583bdc0b6208
MD5 a855c86443333292c7e5888adecef964
SHA1 cfe19debaadda5467786ab7c1341080cf45636b0
SHA512 02ef187312a4b0455da6915f389a901369d98d41601a9b5a21ce67e60c8d9041ed898f2c10050ee216043af4b18a8a7e964b80a127b0a6ec24dddd4b69c1e13b
SSDEEP 192:qONc6O7+3hQmiUyJLGttb0X+FA42YlgGQAU6:qONc61eGt91AlQFU6
TLSH
T1D902D8356C786CB78AF2AD46F58B37135FA5113BA9A62F80DAE81F0C00D765C2346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 16676aae79874d8f14647797e164989b2007c8d068a6ea2632ddc8a4168c2bea
MD5 656811eff37205b993d654b6cf6d2531
SHA1 d76fc3fea06336bd3ed0ebf031064cde05975736
SHA512 0342546a40ba2b2c3c8284d825808b5ada34e7b609fcc66bc7fca75410c306e29776d754f38aeeb244d2ab5327d6ed6d22c8a8a62249c328554f2b6314b37f51
SSDEEP 192:uqm+xasuheOwQxMGsNcvQl7+3vc6QmiU1U4V4atb0X+FA42YyuNiLMgqlaJyGb8r:4ZcIhsNcvxrTKa91AlWb65b8vQTSeK
TLSH
T163826C715C38BD7659F7A445F88B32038EB880779AD92B90D6FC9F1D01EB5AC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9dcd3b6cedeeafdadb51397943444f42d4975e9eba4de531a0f39c11fda527e7
MD5 ede5166134cdf5c33b2e89d37dfefe30
SHA1 84717eaa6ec4f4a76ba46c04be57c3058da0e2d9
SHA512 78f73a67541a89fa3b84cbf4b71f37c5483f4caa471016a03c472f143bd1cc985c9942774ca80922f9a32bce0d7162f615936fa843d666f44d9e8fbfdeebd3b4
SSDEEP 192:hONV6O7+3NQmiUyBLWttb0X+FA42YyuNTcNgqlaJU6:hONV6BAWt91AlWo6U6
TLSH
T1BD12EA356C6C6C675DA3A541F48736139EA5413BDE8A3F80D6EC5E1C01EF6AC234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b489922e-505f-4153-aa1d-00308034fe89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b489922e-505f-4153-aa1d-00308034fe89.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00b832455bbcc72947fecf742578270a74683f02138c03e702e6ca721fd1c01c
MD5 ee4a4364935c94cadba6904bf4342b25
SHA1 e09f085d828631730db073910c082b575ac06487
SHA512 e5950fa1241bd77751929020867fb43f4f72efae5df0adb3f5f4c98ebeae879e2b9164c1a3277b72fc1307dd21467e64cff1f16951a8b4222a0a64fbf2533c09
TLSH
T14A412D58BAE91148B3B36F5A9BF6A85D947E78772F06C45E00010D4F0663B40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download