65d6e88abe954be714af5c2528e148bf6fba3d39cb2873b801c1e1ca81d87cf9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/EULA/en_US/license.html
Size 75KB
Sample260910-txhpqadr7z
SHA256 65d6e88abe954be714af5c2528e148bf6fba3d39cb2873b801c1e1ca81d87cf9
MD5 32a00190cb8676f849b5af53ccdcf3ad
SHA1 9124c52c0f872bb8695e6445956b26c92c868983
SHA512 de99484bea7b262f0ff8c34c9aeae5bd820ff6224a82cd81d727004525f9595aef19d656d9622313be56c039245c07bb859e978c7f8dfd27edad73aab25c7e80
SSDEEP 1536:0FU96qlGqKsaYsVEhugO2HWTtamTimwZE1Bqo6kwpGIxvgS:0Yt6stsVE0YWUmwZE1BN6kwppmS
TLSH
T1AB73D55773252BB719C303B26A8F9ED4FB3B807862B25684719D809B23C3C64537BAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335314767182268"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{495F49B3-BE5B-4219-BE0F-F0A9F18B9BEB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1772	4584	msedge.exe	85
PID 4584 wrote to memory of 440	4584	msedge.exe	87
PID 4584 wrote to memory of 2260	4584	msedge.exe	88
PID 4584 wrote to memory of 2260	4584	msedge.exe	88
PID 4584 wrote to memory of 2260	4584	msedge.exe	88
PID 4584 wrote to memory of 1336	4584	msedge.exe	89
PID 4584 wrote to memory of 1336	4584	msedge.exe	89
PID 4584 wrote to memory of 1980	4584	msedge.exe	90
PID 4584 wrote to memory of 1980	4584	msedge.exe	90
PID 4584 wrote to memory of 1980	4584	msedge.exe	90
PID 4584 wrote to memory of 4180	4584	msedge.exe	91
PID 4584 wrote to memory of 4180	4584	msedge.exe	91
PID 4584 wrote to memory of 4180	4584	msedge.exe	91
PID 4584 wrote to memory of 4540	4584	msedge.exe	92
PID 4584 wrote to memory of 4540	4584	msedge.exe	92
PID 4584 wrote to memory of 1172	4584	msedge.exe	93
PID 4584 wrote to memory of 4540	4584	msedge.exe	92
PID 4584 wrote to memory of 1172	4584	msedge.exe	93
PID 4584 wrote to memory of 1172	4584	msedge.exe	93
PID 4584 wrote to memory of 4796	4584	msedge.exe	96
PID 4584 wrote to memory of 2548	4584	msedge.exe	97
PID 4584 wrote to memory of 4796	4584	msedge.exe	96
PID 4584 wrote to memory of 2548	4584	msedge.exe	97
PID 4584 wrote to memory of 4292	4584	msedge.exe	99
PID 4584 wrote to memory of 1756	4584	msedge.exe	104
PID 4584 wrote to memory of 1112	4584	msedge.exe	105
PID 4584 wrote to memory of 2580	4584	msedge.exe	106
PID 4584 wrote to memory of 5084	4584	msedge.exe	109
PID 4584 wrote to memory of 5084	4584	msedge.exe	109
PID 4584 wrote to memory of 4476	4584	msedge.exe	115
PID 4584 wrote to memory of 4476	4584	msedge.exe	115
PID 4584 wrote to memory of 4936	4584	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\assets\EULA\en_US\license.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa6ec8c188,0x7ffa6ec8c194,0x7ffa6ec8c1a0
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,7215297501102045186,6776370847551342649,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,18137049602000793977,5141062362402850484,262144 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,10469722544620816585,17475335100489716352,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15420369412478138774,7497812706992193762,2097152 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6341081923556974976,18283568043910845010,2097152 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,10520129755946238223,7216698181328091117,2097152 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,6819575486812760726,12627173572836467698,2097152 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,17407107023504987738,13191569420934429910,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1952423137502668103,7872864177401943311,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,5289312788891284257,17400127253425611310,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,5289312788891284257,17400127253425611310,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,5703995492197141387,4970180988284386533,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,8573175901981307650,3428326600233728588,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,10789269129140601014,9099724753689753496,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,17989183737539051610,9777509420835331926,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,4682326603850479332,16214608319702046405,524288 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,7068684409870811641,9686711540919830480,262144 --field-trial-handle=2352,i,16027497662794745136,17301368834243020829,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a65552373cbaeacdf74594d107d23d59d2e26f54bfa67484de891bf6e911310e
MD5 08e9b68f5248e95988ceb4de4e22ba44
SHA1 0d6fa86ae270f8ea152585e2762e0523a38e8297
SHA512 8a061e06ac44ea17226b3a469da57278c65d6ccc5bc93585d1f25f9905c0c0ea4d8a579930be53ac30e9d307d47a39e75c2176dcb963eb6072d7b64f6b2e72ce
TLSH
T184612A28F5320C81E3B12370DAA15A1C38F0CF88DA5B9E5143D864BCC5DA37F85B6C49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7e44b137d8ff5fa7c81682fce3a2579759de0d40e46063b3ed291432ffcea8d2
MD5 3c0f2619b7f086b13255c91202c9a4e3
SHA1 d5ac4da09457be4ba59c91a4862fc785a30d0e20
SHA512 162c0e66c799eccd58d0a0c7e1d557bfcb059304f623f5dac214437a328d2777ab7a8b663d76e375c0a0a3bfd0836f70eff9d1e06fe49d013b87131fbc61c2c9
TLSH
T11111BAF3C7D5856E891156F05A24AE2BDE2D0A06421C3C1AC9D4FF2B93F3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6d615e3fc0def4b5b7f3e9e6fd2a45c97b77a932008a2ceb74c0857bfdc153ad
MD5 d4fe9fa05d0e9e753de7cd774166b085
SHA1 34996fe49a5273fa13bd2dfbed4b7cbe7a973621
SHA512 e72aa672bb88aa03453911fe1358c0b472506ec1b1741b2d70c20208ca57e5d66394575f750ec38abe89b2cb31710c39d6ea634cc94f4eca69db5007ade54cfa
SSDEEP 192:sxZIRTyM/jK1Ml8UQsWk/fas+0IdpHGHW6+WNGYLawD+BeUIg5BJ:sxZIZqXk/fas+tmHbGSAeY1
TLSH
T15E52D6116A345977CCDBD21DBA45BF93D6F94472A2540E88A9FCCA1C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9347daf0e90ea21d35b4c22afb1d6a63129c35b8f24209ecbad52e1d3a8c0a2a
MD5 40ef7a56425de4681ebc1321e07e2e59
SHA1 c2967688357393c56c8c628620cf1e0534f4a43a
SHA512 f1ce6ca23df6d28100095289d226104011f3361b1d435088bf1f1053418c9a3e3a940d22cf325ce8098c89b8367aa8cb4bd3fd3fc279e2108e96bde26f26e497
SSDEEP 192:sxZIRTyM/jK1Ml8MWk/fasC0IdpdGHW6+WNGYLzhw+BeUIgrJ:sxZIZuk/fasCt8HbGRAeY9
TLSH
T1CF42F9116A346977CCDBD20DBA55BF93D5F94473A2540E84A9FCCA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c0e4825eeb726ecfd00977f530321d1125c2b0d14310c2af523e67aeb97779ee
MD5 6e6d1f6de4b2b524a89c4d7fd66747d5
SHA1 8353f12b38762dee0947e3233b241c11922cb2bb
SHA512 deec16cbfe4ba23e4ccb134084c40d7f7999f53159b5dcaa7ca58c0d9d52f6e60d840fea8bc5d2f5d66937a2057b26730e27800c472af752b1a839bee4102a61
SSDEEP 768:GMs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNFroPZ:GMs6pD1WvxzWju1jahILIsN+PZ
TLSH
T198D2FA3B680CCB7E4F841E5CEC2A6F966DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 fd7d10d9ae93007597052e9355fafef8b270b19b2a8d57647c6218c2aa9ac8c9
MD5 cb325966bda49f8fe61bacb02265cd1f
SHA1 c7ff5baae5f3d6d51fc04d5b66dfa38f7336ffbb
SHA512 e82cc16ad0fbd16338ecdfd5b4ffd172f74ae008fadd33b4d5dfbef4de6258019ebbeef15468d2b43be212a2f0b0d5c676ae24efc6d246c4c424cef193592018
SSDEEP 96:KUAAKtePtYhM46SS+4iDlqY+KyLqO+2QYr+ofuVKKOAJ+IKHKS6eUKryj:iitYhM46SSPiDIYYLqOzQYr+ofdxXv8
TLSH
T120E1D65771BB43023C7E2A4C9794C7268E42B6633024A42B7FAC01765E67E209EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

577d0bbd-f640-4c02-8637-6b7b16179f05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\577d0bbd-f640-4c02-8637-6b7b16179f05.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f298df7137a3983bef2e257e41db005a45860935c0fcf45b235588795ff93f4a
MD5 0b5e2113a2efc3673e27bce457a984de
SHA1 695e50c4f28ce2b717f75292c22522a5f50ba792
SHA512 8d6862989e30eee32d7e411541dcb6d61e3952f8dfeeffeded699db834fb67c7fb452ce3ec09aaecfb51be73262c464ba12bd5bf89898777356202de9e51e5e9
SSDEEP 384:fZcIhsNIU0/QdVga9lOaaR3iBsa+VYyGDol:3hT6JvOaaR3iBhgbky
TLSH
T138826D726D64AC7759F7A285F98736138EB88067D6C96E8081ED9F0D04DF6A82307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9cb64b75f9651dffd90bfb34315dcf602566cd660565e0de1af42423afd724b7
MD5 480e7ca03e0217a93da28657e25eb6f1
SHA1 669cea079f20cf9ed132fe98d5868401eef4474e
SHA512 457873d667a7c5e92ad3cdbe7d2630045f0d0f437c02628d5d9d56e73ca0f8e8c3bf11e59e7e99b7c1cad53abfdc63f8e412355a94043fb9cc0658013d0280a2
SSDEEP 192:qONy6O7+3hQmiUyoUGttb0cO2coGgGA26U6:qONy61AGt9lOa4J6U6
TLSH
T1F602E7356D686CB78EF2AE45F98737279FA9103BE9962F40D6E85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cade7375069eefb20540729973e8a7bbfa2b31860b1a72d643cfb1500ea655ba
MD5 b9357edf80a0927362294bebf87dc7d7
SHA1 2816004039e65a5a8138b4b900e242a4ba765cf2
SHA512 74047b80fdf9a7c598cbf0006232987764fd800aa0f32cd1fa17002c557bca5ad82948786add448855ec1f76088e6f36e9a117dd7ff617c4973997fc913a5e4f
SSDEEP 192:wON66O7+3UQmiUy7Ul2ttb0cO2coaR0EPcNuqscU6:wON66qVAt9lOaaR3MBU6
TLSH
T14312FB357868AC771DE2A545F9C736138E694137DA8A6F80D5EC5E0C01EF6AC234B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6507378a6c4915bd96048337d4762b7bdd0411e26246dba2208271a0385a32c2
MD5 d69cfbac819af002723890b480090169
SHA1 a5c8e66ca0842003050ec543615980af0e2b7195
SHA512 80ca95900d04fb0a90bb824c25a88308c5ffdd0c59eb559decbe1cbbdeb16dfebf0a55758bd9a9591518e7be51d0b259fa6faa70699026e5ba00b9b1738267ef
SSDEEP 384:NZcIhsNIUN/QdVga9lOaaR3iBsa+VYyGDol:Vh86JvOaaR3iBhgbky
TLSH
T1B8826D726D64AC7758F7A285F98736139EB88067D6C96E40C1ED9F0D04DF6A82307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 bc2c16a9921e2744bf91bf29bb22ce12414ff842f28177e4b931a81df052458e
MD5 f5976a7f93c9b4196d1ef34525bbd2a0
SHA1 cd42ff2519fe94972a9412637da983db66c3d181
SHA512 15e3e1a1f2ea9ba09465584c0c9b3c33274e11732b9dd5ad5f8f7e673eb81aa6e1fa0ffcc1ffe927a621bb6955bac3221bb7c489dedbe1a264f6ecbd68168ad0
SSDEEP 384:7iFiZcICsNJ8TUNTUlIlN/QdVga9lOaaR3vBsa+VYyGDol:WFQCEwgf6JvOaaR3vBhgbky
TLSH
T134A26D735D54DC7B5DF7A785FA8A32138EB880A7D589AA90D2DD9E0D00DB2EC1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f13bda1-ee33-476b-b8ef-bcb517e4c7ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1f13bda1-ee33-476b-b8ef-bcb517e4c7ce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ba2c12e3c4a0279e3c64ebb2e4828965929721698959d80055e83d96400e4b1f
MD5 ef9f476acdd01d423b57591653e719e6
SHA1 f809148f5d08007b3bd14ac52726ff9f59965b56
SHA512 a37f51407766915611aaf8b8446a3af2454c5f1bd8d6ecc609f2661d6e4758efaa7502694e4775fe173099a8a9944c181b800bc006e265c81ae804eefc692071
TLSH
T1D841296CA7F91148B7B7AF5A9FF6A86E087B78772E0AD05D10110E4E4A66F00C871733
MD5 SHA1 SHA512 TLSH

Submit Download