b6c1c20dc962670aa4d2faf2af43d674f7bd26e1dc8a9b2111861eea345550b7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/EULA/es_ES/license.html
Size 83KB
Sample260910-txhpqadr7z
SHA256 b6c1c20dc962670aa4d2faf2af43d674f7bd26e1dc8a9b2111861eea345550b7
MD5 7d6ad948a3b82f8f5d92aaf194fa378a
SHA1 8a846ab87fcc0d9f1926a70369cf03fce2480f2c
SHA512 0f6d72161f1c4cfa00a6e8dfe199f3d72fbcb152aa07c03dc06a226cf20fa0f80d74e4230e47305d8134df8ac75e217b3000bc9a3b90de037adcd7692eac8830
SSDEEP 1536:0dd6CmwDl1fk4m5WrFpIYus44Urz1pBxKt+w/t393Mz1wuTm0H+bxewGW3igHblo:0lDApLU+wlN3MZwuTdGxjdRDmd
TLSH
T18D83B63579C82F679583439DF282C667F9E89194B84DD082E29953AF11CDACCC33EA94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4776	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335314759895977"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{EE5FB48D-CDFD-4EB7-A17A-A38B99BA66F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2672	3088	msedge.exe	86
PID 3088 wrote to memory of 4776	3088	msedge.exe	87
PID 3088 wrote to memory of 4432	3088	msedge.exe	88
PID 3088 wrote to memory of 4432	3088	msedge.exe	88
PID 3088 wrote to memory of 4432	3088	msedge.exe	88
PID 3088 wrote to memory of 1092	3088	msedge.exe	89
PID 3088 wrote to memory of 1092	3088	msedge.exe	89
PID 3088 wrote to memory of 2760	3088	msedge.exe	91
PID 3088 wrote to memory of 2760	3088	msedge.exe	91
PID 3088 wrote to memory of 2760	3088	msedge.exe	91
PID 3088 wrote to memory of 4636	3088	msedge.exe	92
PID 3088 wrote to memory of 4636	3088	msedge.exe	92
PID 3088 wrote to memory of 4636	3088	msedge.exe	92
PID 3088 wrote to memory of 4348	3088	msedge.exe	93
PID 3088 wrote to memory of 4348	3088	msedge.exe	93
PID 3088 wrote to memory of 4348	3088	msedge.exe	93
PID 3088 wrote to memory of 4072	3088	msedge.exe	94
PID 3088 wrote to memory of 4072	3088	msedge.exe	94
PID 3088 wrote to memory of 4072	3088	msedge.exe	94
PID 3088 wrote to memory of 4444	3088	msedge.exe	97
PID 3088 wrote to memory of 3864	3088	msedge.exe	98
PID 3088 wrote to memory of 4444	3088	msedge.exe	97
PID 3088 wrote to memory of 3864	3088	msedge.exe	98
PID 3088 wrote to memory of 1560	3088	msedge.exe	100
PID 3088 wrote to memory of 3788	3088	msedge.exe	107
PID 3088 wrote to memory of 2272	3088	msedge.exe	108
PID 3088 wrote to memory of 2376	3088	msedge.exe	109
PID 3088 wrote to memory of 4212	3088	msedge.exe	110
PID 3088 wrote to memory of 4212	3088	msedge.exe	110
PID 3088 wrote to memory of 3112	3088	msedge.exe	111
PID 3088 wrote to memory of 3112	3088	msedge.exe	111
PID 3088 wrote to memory of 1748	3088	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\assets\EULA\es_ES\license.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x254,0x7ffe0732c188,0x7ffe0732c194,0x7ffe0732c1a0
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,11912001612686564406,15865400254941508432,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,18274939004805938367,5193096893471560489,262144 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,16507716943184957023,4121461443872947542,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4908653456265133407,13996147390314133967,2097152 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,3827981758796791187,15586857005755739373,2097152 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,2628660778824958513,12519652949411359301,2097152 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7874033845403190014,15949142588596304591,2097152 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12668728389733354534,6056025449421672221,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5209449104308530790,9430188288601979618,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15444933302682439951,12179224157625759218,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15444933302682439951,12179224157625759218,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,7136956493065130575,3084677523065947295,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16669287897538450306,260699680975067763,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,858769843092481546,13103876206155337107,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3120,i,6237863836321120104,4553492804021225605,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,9800262575757500892,12037012907079088533,524288 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5136,i,11568029119488069689,6463769747676761084,262144 --field-trial-handle=2272,i,16800608484812803340,12853406622926825812,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

887b4710-ea3c-44f3-b280-ce87c0bd63e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\887b4710-ea3c-44f3-b280-ce87c0bd63e9.tmp
Size 11KB
SHA256 984c7ba4abb1fdad837572d2ba4f778ddb4b055a2d996699518372d78cec4077
MD5 02863753d089f2af90a37c3e7986b5e2
SHA1 0193af361fb9d890bf4d0f69022c08e47d519783
SHA512 ceb64505defe302f6e5655c8567c40f53cb25bddbf0fcc8a341497042658e262096055cef3d9ce0d7eba1d7ba76765a36b97baf4f3b1562bad31af823e1d0ec3
SSDEEP 192:u+LsNFVQ16em+YLeFeQmiU1hxz4e+CGy+FdeL9oCd1FS+2PMJi8qtU8:XsNFV9emziUJ8e+CMdceCBS+2pjU8
TLSH
T1C1322A366C345C3A8AE6B594F54736139FB85067EA893F84D5ED9F0C02DF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 98a6c8df684c1882959bf313a44f4036451f829332c4900086bd1f5938558eba
MD5 e9c38e0ccb1b139a1a1db60855e239d6
SHA1 9f09876d06c7226bb042e13f5687b8899ee3955f
SHA512 6db2b2f649f6a174d62f4908033c01e40408ad0b50a1b7c1d1c4ca2648b17f8de6b12dc42ce32e30f28c3e1d4481b821f01303d0000a350db62ca75844a93ca2
TLSH
T1286108FC176208E1E7694071B0E2064074BC3EEAF53F7E8E535088FA6616F668F5928C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db96.TMP
Size 3KB
SHA256 eb8e74b931a8ccbd91bf64721d1cb44dc2a90839ead66e5d7434bdbc5af918b5
MD5 229ab3dd46b57f96fd6860bc5d3062e0
SHA1 d63c8747d95c3952aaead3eb1c1e43255a69c9cf
SHA512 28211993f9aac3bc25bcd481f2a41ba1548e48e3d2ddb827f09fbd9ad354d4ffe87d4ec739e67963b46eb223e2bfc9062bde288bf1422ebc89902613d81bf8bc
TLSH
T1B361F8FD176208E1E7694071B0E20644747C3EEAF53F7E8E535048FA6616F668F5928C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 1d63e2049e21acdcadb8fece401e658344d56afe35d8cf710415edc9e95ba3ab
MD5 7a6a68301d783ef67d74e2077a3dd701
SHA1 8094ed1853cb0d33ff183a6ea4a2b45245b836a6
SHA512 436a9d87a48754577e061038c900b6b26c6f79ae41fb40cc6f771c70c6d6bf6df280ebaf6b1e2a40dac3386ad72141fca4eeb1b2f6772f364fc188f80a7f5c12
TLSH
T1A8019CF7C3E4956E8A1052F06A18AE2BCE2D0506831C7C1AC5E4AE2B93E3475D10189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0af65bee1494f5fd49d70611f9e462661a7e632ee17d5107d0235a2f38e68f3a
MD5 60ed50ee58d31fca4d49ce128e7db4fd
SHA1 5b33bc9dab4af2d24d5b13ba3881ebc2d417ef67
SHA512 535c22e76c576cdd3004a96456f7d914c87575ab1285dfc0be41e49de651151902dba5497129192e7f587cc2f58402d128724b1fdd8cf411768087dea8e3a414
SSDEEP 192:sxZNRSyM/jK1Ml8MWT/fTsMYRIdpdFHW6+WNGY9IKEpVIgrJ:sxZNQuT/fTsM/3HbGD9
TLSH
T1E14208116A34697BCCDBD209FA45BF53D6F95472A2940E44A9FCCA1C00E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 12dd58ecaadb003a9fdb089df286d14e30f735d34737888d7be5a91d985073aa
MD5 ca3c85310ad3e7d59855db6ccd8dd223
SHA1 4b8eaad3a77598401274f9a15d30f86ee1ccf360
SHA512 95172259e9cd842e4789afd30d3107b4c9b86702c982a5401c0e00de262ca1644c50bf6c96f2b815e634a6b9d8c6bd3a2f0263c990f0e16fed11fedfdbc1f6db
SSDEEP 192:sxZNRSyM/jK1Ml8UQkWT/fTsuYRIdpHFHW6+WNGY9IZzvpVIg5ZJ:sxZNQqvT/fTsu/lHbGhfl
TLSH
T10352F8116A346977CCDBE219FA45BF93D6F54472A2940E44A9FCCA1C00E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4001caa7c42907b6eb3e861a41818f3b3b3f03d0167766caa07dbef3b2fd4b15
MD5 ad26a2732dd034c0481e1f5361195cd1
SHA1 c9bb190ea6f38bc16e7ebe76170ed30030576edd
SHA512 3499a21f81d5d76fa1767f7db8126f2930d3d077d4b8ae1309719494178c5f013af7ff2d172a53cdd32024ac340126e164e51b9ed443e73231f0cf3112f4ad8b
SSDEEP 768:licv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNfroEg6w2:licv21wWvu+Z+u1jaeFLeRNMEA2
TLSH
T19CD21B2B280CCB7E0F841E9CDD2AAF8A6ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 129aa04d54aa8b92a845478246b9a81e5b89784853ad58f27eae2459acf99a4f
MD5 9934f3c9fbadb169499549e433182a1b
SHA1 b7c4b3e24fc9fd2fb078795e508d9d74362aadc8
SHA512 8c56d2565ba7fabb5ed7a927ab473ed758ac8083e4a280361bf316690469f79a9b14aa25a8fa02ebfbad5404821eaffeeae627beee9fb74dc48df4219985c772
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+Z4gKhSWeN+Kukz:mTlDBa
TLSH
T1C4915451313B076138BE68889755EB2B0B4132F73515E52B7BA810628E6BF1C6CFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5978ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5978ef.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2006b544710eaf27bf0cdb7a8a2e19dccaf50c16bf4df5fcadd443267dc937f9
MD5 394fd2b752ef1204edb5a73cf3ce209e
SHA1 a0bbc199c518ca4d7aa271320126af087ac4fd4a
SHA512 9ab309f87ef3411a62c41d629940cc67f447129712a0b292d59ba59ac8770654780e8e2eaa3df814c309dc6f67a225383927d7ab043466cabed0f985df1a3ba5
SSDEEP 384:6iFIsNf8TUNTUlIlo9emziUJ8e+CMdceCBS+28jz:xFICwgoemnXklCcl8jz
TLSH
T1236219335C648C7BAEE7AB95F54B32139EB440A7D9897B90E6DC9E0D02DB1EC2306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 450f18d0c346921293c0f1a578fe31ba2ba17e2ad3242ff569c035df4b91b775
MD5 288a92b9fdb8be153e3fa4046723d6a3
SHA1 a46e3cd1a7a30e69673c06af2505454e86b0e026
SHA512 779e23ee2d148b1987ff9428c7ff1f8e6681e4b98cc5a7565924b7f45e1f88ee44f02b87403c52b04e5b1ebc714062718d5b2ecd79365f872dcc35db97604344
SSDEEP 192:JONU6v+YLNQmiUyC7Zh+CGy+FdeL9oCXusHfU6:JONU6vz/XZh+CMdceCD/U6
TLSH
T1B802E9357D382C6B9FF2AE45F5873A235FA8217BE9952F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e1d86243aa47837b0e59243d1a3d9bee13379a45839f5bcc3acc072982719757
MD5 aa0262c133731c3df1e8068c2872a245
SHA1 d16d9cefeacd71659e7982c95f5684188e11478b
SHA512 93f56055e94e8e71c715ec055523e250131f3a5dcb4ae030d385517dd122fd59d7e2ca74bc9d5b39602e5a7cc937c11412a23a084a753b9de6a8c4dcf4bae9a6
SSDEEP 192:uxLsNFEQ16em+YLeFeQmiU1hxz4e+CGy+FdeL9oCd1FS+2PMJi8qtUt:asNFE9emziUJ8e+CMdceCBS+2pjUt
TLSH
T131422B366C345C3A8AE7B554F54736139FB85067EA893F84D5ED9F0C02DF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86141debb24ca61ef876ceaaebdc8d025903060715ece979c5b09cb772a6386d
MD5 63777061fe0e0133e9fab391a58c3fd1
SHA1 e762a3d82a3d0380503d06080f5444906f9bc78a
SHA512 4325f3744b90a1603c12c6d3e5522a5cbd150a8df4d537c9d6440878c401de9d3cb34f55edd43a81ab0d8c79c53e22545eaf816a9c2062e1fdd138987a062f1e
SSDEEP 192:8ONY6v+YLFQmiUyH7sh+CGy+FdeL9oCd1FS+2ACH8qtU6:8ONY6vzvgsh+CMdceCBS+2hjU6
TLSH
T157122C36AC385C7B9EE27555F48335135EB49167EA8A3F80D5EC6F0C02DF6AC234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a96d7b07f2385a84d92a7f6de6e56c824cc2aebbf8347c1c724785b5a3fdf709
MD5 95776e90c34561f14a9aa068b6add499
SHA1 2111e8bf7e421e9b739605781ed38352a35968dc
SHA512 722712a4571b408dceafa93a606fa4686413778ceb19148a521abe5d0e2d35e7d57bb28ca8509861e5690332dbfae44a663a64ffad04d6083fa4c16252234550
SSDEEP 192:uxLsNFlmQ16em+YLeFeQmiU1hxz4e+CGy+FdeL9oCd1FS+2PMJi8qtwo:asNFo9emziUJ8e+CMdceCBS+2pjz
TLSH
T10B523A366C341C778AE7B695F44736139EB49067AA893F84D5ECAF0D02DF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3b6ce879345644fab3cc5c58c56516634dda451b4ab536bae72e369b5787a001
MD5 3b21e339fdbd38a258c17c02158c9cd9
SHA1 879fafddcd22773e30f174a09ab0613d4a983af1
SHA512 ac3e0ba260743a1461f971276faf1a7e67c30852552671cda866f258a293bb78ad898e1bd208de033ad55fb0a04cd4a3fb5dd21eebd66f66605d322ddb14b5f5
SSDEEP 384:6iFiZcIMsNf8TUNTUlIlNB9emziUJ8e+CMdceCBS+2Ksjdon:xFQMCwg73emnXklCclKsjdc
TLSH
T157925D334C64887B9DFBAB95F94636039EB480A7D5C9BB90E6DC9F0D019B5E81307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9fca59b9c5c93e4ffa7a6c721ba85198ece552f7e04788c74c48422a9e0f02e4
MD5 72e3fe24c6401602b96345c5da409f8a
SHA1 703813ee804c239a1d55fdcee6150bd79653977b
SHA512 42307a0f61162365fd06851455853dde4a94059a8be022025b951c1dc5d8219323977aeb277fa2c6f5ca5c661031280e1fe1302ed2e32898367625122766fdc5
TLSH
T10C411598B6F91158B3B76F5AABF2A86E497FBC732E06D05D10110E4E0632A40D971B33
MD5 SHA1 SHA512 TLSH

Submit Download