009f17827534e89044f89a3c99251694e5f8a73f408059832e438e8a86f3020f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/EULA/en_IL/license.html
Size 75KB
Sample260910-txhpqadr7z
SHA256 009f17827534e89044f89a3c99251694e5f8a73f408059832e438e8a86f3020f
MD5 9a47f0ad8b02130373c9f6a086f99c62
SHA1 dec280d13a6694e4aa34f00034a40e77feffd4c3
SHA512 2652885c2f705744c0016f44bb8e427a0d8c206b401995e0a4644e938833999a4142a26460eb19671471e534618a56bed2764833ac79ce168fbaa7cb29cbe743
SSDEEP 1536:0Y896qlGqKuaYQVOhugI2HWTtamTimwDSfXqo6kwpGyxvgh:0Tt6utQVO0aWUmwDSfXN6kwpzmh
TLSH
T17873C55A73252BB719C303B26A8F9ED4FB3B807862B29684719D805B23C3C64537B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335314825794890"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1C56789B-49E3-4672-8488-69DAB5B53C34}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 636	2168	msedge.exe	87
PID 2168 wrote to memory of 4884	2168	msedge.exe	88
PID 2168 wrote to memory of 4808	2168	msedge.exe	89
PID 2168 wrote to memory of 4320	2168	msedge.exe	90
PID 2168 wrote to memory of 4808	2168	msedge.exe	89
PID 2168 wrote to memory of 4808	2168	msedge.exe	89
PID 2168 wrote to memory of 4320	2168	msedge.exe	90
PID 2168 wrote to memory of 3324	2168	msedge.exe	91
PID 2168 wrote to memory of 2868	2168	msedge.exe	92
PID 2168 wrote to memory of 3324	2168	msedge.exe	91
PID 2168 wrote to memory of 3324	2168	msedge.exe	91
PID 2168 wrote to memory of 2868	2168	msedge.exe	92
PID 2168 wrote to memory of 2868	2168	msedge.exe	92
PID 2168 wrote to memory of 1868	2168	msedge.exe	94
PID 2168 wrote to memory of 3588	2168	msedge.exe	95
PID 2168 wrote to memory of 1868	2168	msedge.exe	94
PID 2168 wrote to memory of 1868	2168	msedge.exe	94
PID 2168 wrote to memory of 3588	2168	msedge.exe	95
PID 2168 wrote to memory of 3588	2168	msedge.exe	95
PID 2168 wrote to memory of 4116	2168	msedge.exe	99
PID 2168 wrote to memory of 2152	2168	msedge.exe	100
PID 2168 wrote to memory of 4116	2168	msedge.exe	99
PID 2168 wrote to memory of 2152	2168	msedge.exe	100
PID 2168 wrote to memory of 4312	2168	msedge.exe	102
PID 2168 wrote to memory of 2420	2168	msedge.exe	106
PID 2168 wrote to memory of 4544	2168	msedge.exe	107
PID 2168 wrote to memory of 3324	2168	msedge.exe	108
PID 2168 wrote to memory of 1044	2168	msedge.exe	115
PID 2168 wrote to memory of 1044	2168	msedge.exe	115
PID 2168 wrote to memory of 2316	2168	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\assets\EULA\en_IL\license.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,7425236224975491601,16386977901731031214,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,4118324616133145514,9231250698043302068,262144 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,6159089571221561727,1563899694437881796,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3573660861125515641,434438866195120770,2097152 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,18426822940815557365,6906993873423688590,2097152 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,5099740013930468620,14470324881375652004,2097152 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,3952736579731015030,13337585391083946898,2097152 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,8877288750545270751,4424785653243548175,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8524306545402238228,5320439871637276342,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,400977395556982958,3130267951013050435,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,400977395556982958,3130267951013050435,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,4973498200987921896,5545707272691294299,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,11792867404204418655,11541156157535910246,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13359768316542700607,9777380646324636791,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,11385889075305754785,18305309371049723618,524288 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2172,i,13722190922305755475,11882573308593802529,262144 --field-trial-handle=2924,i,1843376384495450211,2021220630624079454,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

4a0ce717-e26b-4cb6-bd2c-46c1b3758af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a0ce717-e26b-4cb6-bd2c-46c1b3758af0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7aa8371ed8c187dcdd420ae5afbf43af46e82900f936e9c0eb7a0041660640dc
MD5 afccb5905f7057df8e452c526048d415
SHA1 0184c9b09d568a5fc370fb167bdcda664458c1b8
SHA512 e07f8203c0232658280d9fa8107b8b98122df55186c92a5973f9aa55157b377f076d2b5af7ba5b61c7b06db66c044ed625409f5c26ceb2752250ee2daa1847bd
TLSH
T1EA7119DD3322D492D3600E30F7EF0293B9F141880A8F6D52F208597D6A0AB6E427B538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ca02.TMP
Size 3KB
SHA256 a9bfbdf2fa9bd628d229d7be28fef8cb0ce38c7e94f86e8f2ab7104090c3ffd7
MD5 f31aa6bbd213e751106dc86c20a88c8a
SHA1 af122ffe66958741fbcd227eb04d5843d0773c5b
SHA512 6bebf61ca051bb39fbdc77711e3c793e8c79d49eaa47648cbe2d9336e8a9964aca886421d5ec739c5d05fb118058bb4b1ed57608be20b44ebfa96e9bc7191f36
TLSH
T1F8710ADD3322D452D3200E30F7DF0693B9F141980A8F6D56F118597D690A76F467B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 92e8c3d523017aa06150ee7b78e13683a7596d7be8cf6758d43d38c386e8e853
MD5 066d10e827daad359ca93af18f4c9a39
SHA1 784a890f119f5cf2b6423e08d5c134110e7aab67
SHA512 43f0c6d618ab7561504555e201ae506b50cc324843c817f0a6a5cf91c0634ddfeeb4968284ec42aaf64533af356166b3a957556e7e17ca00a6a627cd12b657da
TLSH
T1BB117DB3C7D586AE895156F05A24AE2BCE1D0505421C7C1985D4EF27D3E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32e924f4e0c96555a01a31f92b05e1aca38faa121d0af6ae10a652d7356981f4
MD5 0b3bcf9ca69dc8cee5928ceb81a032de
SHA1 c7e283b4e0661c2cf2d71bbd3448817fa2f2180b
SHA512 01c10e777cbc89b0add70a1f1eeb2c1d44158dc6dc6ccf0171e15dffc5460e8774113ada56fde7a2001e4731850b667244f58023f7d33fff14d0b93400534f46
SSDEEP 192:sxZVuR4yM/jK1Ml8MWJ/fIsGrIdpdAHW6+WNGYwK2giFIgrJ:sxZVueuJ/fIsG02HbG8S9
TLSH
T1FE42E801AB34697BCCDBD208FA55BB53D6F94432A2940E44A9FCCA0C04E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 15ad04eda89c077288395039310c8d5e16c67397b857f63d2dd356013c81c771
MD5 ad1dcf7c3f562605aaf4112baa14733a
SHA1 63314005fa216d507199046e79ef890fb1365c1d
SHA512 c8acf0fe4f03bdbc47b9aee67dd0cfa0212e0d8e926c3f3a378d64817d80fa2d3ce9f5c8c450551f11a97c1b1dbed96590bda599ce07c1cc4e8e2b4eaadacd02
SSDEEP 192:sxZVuR4yM/jK1Ml8UQgWJ/fIsHrIdpHAHW6+WNGYweDgjFIg5PVAJ:sxZVueq7J/fIsH0gHbGfFFu
TLSH
T104520915AA346977CCDBD218FA41BF93D6F94472A2940E44A9FCCA1C05E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3e968de5dffab2e754ae450f7a321f8293ba6dd4a9a2751f0cb7c29d6d81a642
MD5 7d1e5be35340a03c1df461d66834e2b8
SHA1 ef9fe7a94bdfd057c30a4a14eb9526ec6c694047
SHA512 f3e8246cb9b4b276aa4703bf5ef6a9413a0bfdb96cbb57e3fe862b549481e1e498690f2f84f9ae45f0c8a2f5ab082f483d08c8ddfece4af3f28516a6485f6c7c
SSDEEP 768:+EHM4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dHMrohcc0aY:bs4jeXmWvmKLEu1jacPLZQd3lI
TLSH
T1ECD20A3B280CCF7E4F844E9CEC26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f7474be18b26893077feb8c6862b01f2e2c2c60c4b4c764b9af8f3b9c7178014
MD5 9b4c75da4845b29fb1dfe2c79d14436a
SHA1 f4c9c647469f0c8536197034966ca4a27bb37a48
SHA512 c64145b3dfb1a53a454298c739c78aae0d488bd1ba6198b9255bcc5278bc4f1b54591e463b82e61736b12d7af0b8b94aaad0f35c010186eb446d676cf41daa70
SSDEEP 24:Kd9f4LiandPrD4bf+4fP8tayd6qm4a2+NIjQmKilhaum1EY2SmsM18w3yXYlfQDn:K0CFI9K+IgXyp6IfKP6ATkIjKpCEL
TLSH
T16291F101717B52413C7E28489654DB1A0F4272A33614B96B7FA800B71E6BF685DFF8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ae20451e379c115309dae001ac2e548ff4c0f22143b55c2056957bad6a1d83ed
MD5 b3f76c8af33bdf30ffaee7afb0cc794b
SHA1 876b7782d5360f696dd9582ce176c9fadce72ac0
SHA512 28a0ef66cee1aa73bc940bb4be47dd574239d1aca2c88b0f9f371e914836377e340162508748a18f883c5d62b60ac092b17529c2a317b0b6ca4570226c67b6b2
SSDEEP 384:DZcIhsNlQhUVeylf+G8WYWXfF+Vsa+VYUgoy:bhDUXFxdWhgjgt
TLSH
T12B827E326C74AD7A58E3A291F84737134FF89057A6C96F84D6EC6F1D009E66C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 84791877ce5b2de027f7c09250489e48749482c9ebe2a0854cec6938f4f1c7d9
MD5 40c865efc991e7806d824cce3dc1582e
SHA1 fac8b0f6c86a80d37a9bc9c0c8a5eed08fd57a59
SHA512 c83bd66f7a996fa010ad186af06cfc3eacae5c0ab645d8772a4e75ca59a567e63b62c34efc195a4181507ee5ab4c992f494853bbcd5dda96c3529c0f8a4f56fb
SSDEEP 384:jZcIosNlnhUVeylf+G8WYWXZF+Vsa+VYUgoy:7o6UXFxzWhgjgt
TLSH
T170826E326878AD7A58E3B291F84736134FF89017A6C86F94D6EC6F1D049E66C2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f2220011cd373f9b278f42226032ce29ce5d1b1b91e44683abc45747e5e8137
MD5 b1e34e7c05561fe817409c5b825564f9
SHA1 34268af4157809c2acc87fd1cad9c08385d242a1
SHA512 c46a36d002a437af3dcede81f726d2a76a4c9ed2f0fc9a5b8e4fd88394e292196f171fa9498491863456ec7df3a6ec854531929aa6a0a92cd9d9d1f9ef9c4e6d
SSDEEP 192:EONC6hZ0QmiUyeApc/+jV0jzorWYt5wOZ+iU6:EONC6o+pu+G8WYc2VU6
TLSH
T1A102EA35A8686C7B8EE2AE45F48737235FE5112BAD956F84EAEC1B1D00C775C2346832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f7c0c2251a6218b63152533706b223b9456de0be6d835933a5226ad51df16698
MD5 5e274e75e7c2bdaa06d6b0593535e6df
SHA1 51ff6efe85f502396200dde7fe7c9027e3bbca07
SHA512 73e6c0785aa7e9250b9b89880fc6f1166d029990e4e750f0605eabc01f139df3cd2a1d529bcadb1dc7252e2e6c69ba788129ab8a4afca7127b84ea00527ca229
SSDEEP 384:zZcIhsNlnhUVeylf+G8WYWXfF+Vsa+VYUgoy:rh6UXFxdWhgjgt
TLSH
T1F4827D326C78AD7A58E3B291F84736134FF89057A6C86F84D6EC6F1D049E6AC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ab226b4dfb45aa149259a3242dcf9d1d47c9d53b9bc3fa41e8abbc7badd5cb3b
MD5 8c16ece6ce2e296a36283db32eb7e349
SHA1 40167669ba07fd69a3055dd8788c445d1606174c
SHA512 1fe1bc89b087402fbc4f3c0488e49e6200c45fa1a4001a2bba70d3f98586b9d0446f793ad9329df6f9e11d6bc160df5988968ac0ec4dbba02f0d7bb865f0c7d0
SSDEEP 192:9ONQ6hZUQmiUyCAXc/+jV0jzorWYWX15cOqpqtVU6:9ONQ6IkXu+G8WYWXw9+VU6
TLSH
T14E12EA35A868AC7B5DD2B555F48732134FE55117EE897F84E6EC2F1C00DF66C234A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c16fbf5-8074-48c2-89b4-a921c08bbb1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1c16fbf5-8074-48c2-89b4-a921c08bbb1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0febc2ceefa34ae73ac9cad31c09b9fae7eaa27d0f2e8e4e20a48f6983a4dada
MD5 767b1d96b6fb79f781b21410a8bfa936
SHA1 942fb48ef29b05c4a8d2db3899b54ef3fa2ac289
SHA512 8eccdb00336d6dd92ae2190eabdad53c0825f11fadd0395aa9bddb4517c9e674a0750eeee29cf02ca5fa813914c3d8e1376999310004849f2bad157783c6c92c
TLSH
T1F941E65DBAEA1158B3B76E569BF7986D487E7C372F0AD46D00110D8E0723A40DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download