bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
600s
max time network
563s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260912-v4htqsfb85
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337900291310675"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{C37185D1-9AF9-44F9-89ED-0120C852B0BE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2920	4348	msedge.exe	84
PID 4348 wrote to memory of 4648	4348	msedge.exe	85
PID 4348 wrote to memory of 5576	4348	msedge.exe	86
PID 4348 wrote to memory of 5576	4348	msedge.exe	86
PID 4348 wrote to memory of 5576	4348	msedge.exe	86
PID 4348 wrote to memory of 5748	4348	msedge.exe	87
PID 4348 wrote to memory of 5748	4348	msedge.exe	87
PID 4348 wrote to memory of 1152	4348	msedge.exe	88
PID 4348 wrote to memory of 1904	4348	msedge.exe	89
PID 4348 wrote to memory of 1152	4348	msedge.exe	88
PID 4348 wrote to memory of 1152	4348	msedge.exe	88
PID 4348 wrote to memory of 1904	4348	msedge.exe	89
PID 4348 wrote to memory of 1904	4348	msedge.exe	89
PID 4348 wrote to memory of 3808	4348	msedge.exe	93
PID 4348 wrote to memory of 3808	4348	msedge.exe	93
PID 4348 wrote to memory of 648	4348	msedge.exe	94
PID 4348 wrote to memory of 648	4348	msedge.exe	94
PID 4348 wrote to memory of 5100	4348	msedge.exe	96
PID 4348 wrote to memory of 3196	4348	msedge.exe	103
PID 4348 wrote to memory of 4236	4348	msedge.exe	104
PID 4348 wrote to memory of 4504	4348	msedge.exe	105
PID 4348 wrote to memory of 708	4348	msedge.exe	108
PID 4348 wrote to memory of 708	4348	msedge.exe	108
PID 4348 wrote to memory of 5172	4348	msedge.exe	109
PID 4348 wrote to memory of 4252	4348	msedge.exe	110
PID 4348 wrote to memory of 4252	4348	msedge.exe	110
PID 4348 wrote to memory of 5284	4348	msedge.exe	111
PID 4348 wrote to memory of 5284	4348	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x248,0x7ffdef2bc188,0x7ffdef2bc194,0x7ffdef2bc1a0
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,13363014231949279211,14677928557408587709,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,3782964616469837552,545375043862440938,262144 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,1292550300594240572,4255926968521296218,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,2232786814580564202,11968462778081124777,2097152 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,1984979061128662392,9357943361462341106,2097152 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,9787757328809523118,3612565265875470227,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,3157875574569664964,193213507128529837,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,11579276620133660407,6682727217735941323,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,11579276620133660407,6682727217735941323,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,5833748029911741787,16086388232466712126,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2357027169354267848,4168947934669897126,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12025783969671339248,6815348308019606266,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,852579857540237225,7208317645062642616,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,17084642794045509244,16470160260571793991,262144 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,10175369620701138513,957641328299127269,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,16747482171827284006,8425478273427052027,524288 --field-trial-handle=2224,i,10658613947795082081,8445620135110757338,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 97a285e9f23227e32fd67da3ab8f7b086fafc6e885b6d36249b82f6b9bf7b8f1
MD5 3484e078171f7e31bb45c0ffa2046b4d
SHA1 de72abb46d177ae03dd9cfd95fcf27808173150b
SHA512 9d646e54b6de9543c97676d2e452aae7d8556549ea71196e008716e2c559a070de653fae8f605bb54a1e023c25557b99251f63b3446b25e8f79847fb916c67d2
TLSH
T1E5E020D514D5C23ED344E8474294570CC2A1374F92CCEE595B1484C9B401540A295B60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d7b0347f18ec406f30025ea3ea698985adbac34d9eef3b5bdf18ed5a39ace50c
MD5 b1e9cc7cc14c8d0b3d2f01b0a0175d1d
SHA1 e869f6a94202f90f4bc314f0b7dc8f0e66910e46
SHA512 b17ef256a3700417a3474051bd873faaea132de37b926a0c39f65fe43ab51566acedaf2665bf0b76635e7d717dcb7b10159795f399ac7f979f9b0e7ba8c0faa3
TLSH
T1DC41C1F3C2E8866EC90156F0AA18BE1BCE2D0954832C3D5AC5E4EF5F93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a0bfc1bca0710dc2e28b90315d1445235805bdb95042ddf4f80257be153a6378
MD5 5055b9e25ba255bb9a24b72cbfc85d35
SHA1 c3bc54e166c6b168bbffc6bd750c02d9011f1e61
SHA512 74cbba80b1e0a4f25bf2f865f4eff680e9dbb11560608d437f9911b2c8c4f2ac2d41ce212afdfd5f1396bdb63c24804749ffe7c38798d9d7c8aa668fbde03a15
TLSH
T11F319FF7C6E8866EC90156F0AA18BE2BCE2D0954832C3D5AC9E4EF1B93E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bf6dbbe885e7f5889feedcbb9d320263329c9f928647c9217dd033697274dbcf
MD5 6ebe2ed7ae492321bc955ef756b3148b
SHA1 357960cdf1129884a697a53eef3e9b6019cf93ad
SHA512 f032f49e7bb611cadfb633678112da2f63e793cc9a15edc13cd5e6b77d0290de2856e4ac920da6bdc2ba6cf9c2d9144ef509594f7c8b962cf4870afd3ace6e88
SSDEEP 192:sxZFRvkJ/fOsEQZLX8DzodpHSHW6+WNGYoX2SPTIg5btoJ:sxZFaJ/fOsEOwYyHbGsSj5tM
TLSH
T11942C6156E28A93B8CC7D21DFB55BF53E6F9103294911E48AAFC8A2C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dfdd7922b2f8748fc7ad6fe29e21fc6ff50b8c5712d1afd1d4765fbe3448b62e
MD5 019e06971b4ea6aee212539d198ed3c6
SHA1 d79f339e0b80448c8aa2912abb965da5fe9dc71a
SHA512 286e2bffcfb9dfafeefa0a1500a4783a898e72972f40babd5ef842fceec4c83c00fb74074ec603a7621dfdffd2ecb7bd032a8140ecf2e81c1032ce8b8d2038c1
SSDEEP 192:sxZFRvkJ/fOs6aQZLX8DzodpHSHW6+WNGYoW2SPTIgjtoJ:sxZFaJ/fOsjOwYyHbGJSjjtM
TLSH
T1D632D6156E28A93B8CC7D21DFB55BF53E7F9103295911E48AAFC8A2C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e4f6db782720c8592ac25b3346d62722eccee3eb795615203c6dfc9543a3199b
MD5 84ee15c2ac1e7e10783847e48c3d72a0
SHA1 8b7aec2c77e534d23e9bc73c3ab1b1c92e30208a
SHA512 69e90525362fa79df33d190f3bf929525ba2451c6482eaf22bffa0626ef457fc465d4d53baa6a1363b4266341b34c2ed07a9aee641516b7f04565ce951ae9b8d
SSDEEP 192:sxZFRvkJ/fOsAaQZLX8DzodpHSHW6+WNGYoW2SPTIg5btoJ:sxZFaJ/fOs5OwYyHbGJSj5tM
TLSH
T19B42D6156E28A93B8CC7D21DFB55BF53E3F9103295911E48AAFC8A2C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86b21e90-7dbc-446c-ada1-b285ae31011d\index-dir\the-real-index
Size 2KB
SHA256 1e3cabd4ba03dc97bf5b24b74c59b8005928174c62af30de2c3f10bb6a7b1bec
MD5 25a5b7ef71fbc45c84a5b0bf348753e7
SHA1 23dce4d7c96e5c585fa598db659e211d9b42da68
SHA512 090041e76e9f0541e77505946667fd27f86d1b1f6735bcdd9284323e546a2d526d0000a8d0c48d80f25dfec510c707d03a35f5caa61eb8afaa815ea82f2871fa
TLSH
T18551B88E4D421B7BFC68177210B51489337861CC13582D1BA9FD9135ECC73146D5DA7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dbf0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86b21e90-7dbc-446c-ada1-b285ae31011d\index-dir\the-real-index~RFe5dbf0d.TMP
Size 2KB
SHA256 24ff181e0aff0f9cf64945178308a8809c87b1f3125516084e72770bac50b161
MD5 c083c7ef2db42931afb3e5b023dd7e73
SHA1 6433f12d14da15c4196c30431e5f3d61db8941a5
SHA512 8659c1dfd28e01154dae56c99b3f8fe1ced59832dd2766ddd62bd59dae173cf65d4f65af1cd5c04b2c0e410bb5f94637172eb68307eb3abe2a20348a7802a3fd
TLSH
T12951825B4D034739DC8402B309E96496373AA14887883F0F61FDE236E8C279CBD5ABE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fcc5872b46e712590f68f7b0fb047e72d7505e5fd6f25a31fd137f679349630e
MD5 f208b1b470217e1a96fd1cc087eb83df
SHA1 a84dcb51a4c2ec1afff7e1d91f5f761e563ed92b
SHA512 14baf73abc50d5a575204f08937e8aa8cc50bc67bdf1fd4b4b234fbd7234a1d3e799cd983b926452864c8effa1f1b37a8b08c902fb8767b8df48a6031b04a67c
TLSH
T10BE0D8F729A72810E8BF9BE65031846045427885D550AC8EE12A6697257130664A6C52
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b807f052651ec5d286770e43a34fce854c61e82b633a871f65874e45352a6ea7
MD5 1e030018c65b17282837e1574a667f00
SHA1 0cba9d03c4fbfadbb63feaa74d086a3461f2fcc2
SHA512 67db6b6321e5da285edf2a0f428c96c2ba0f0bf1d6edd31400f6df85579bfe29617e1d81b62777d2616940293b24ab505cba52f5d4ab1fbf248ab7a0fb114ef5
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3w+Z6eME0DE/eeuT04vG+no+nFp:SL29ObJffppdNlrtqfp
TLSH
T196B2331571BB421039FE391892B5976E068231B33119E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a1bc2b2b0dafb5ee63838a15eedd58c9fa72d4eba5173c102ac0382e9e0283ff
MD5 ecb4a642f718a1cb520e385b918bb2cb
SHA1 aa86cf75397cbdc8b0d2b3e935f6c0a90dfbcd80
SHA512 a4290155d0d23c968720a80821ea30d6d98636a316443fce619721857ea349f9c4673c627a456220823422535116a006ee0e7246d49dfb569f668f8360e19419
SSDEEP 384:n0iFiZcIR3sNi8TUNTUlI4baKM7mzw2fiBCauGlAbuBiUsa+VY9lfgL/7Izbo3:PFQR33wgJcMBCaXWWiUhgUs
TLSH
T1C7C23932EC98DDABEDE78BD9A74A3603DEF04153998C9AD4D9D85D1C009B1ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c3bc2cc27e3a526287cab8f01496d7cdff2689f9ddb4f42b30101d800850eabb
MD5 0b3d621cc13d2438a4cc12ecc191c74f
SHA1 2b02cbe1bb6ab9c3dc41eabeff0cd26ede5fd757
SHA512 3eb61aafd9d4bee8803ea40e931ac7737dbaae744141cd8035e1e620f363b473a3a5b8f54bd49c4b37a460267eb90851541db7b1b00364b4a26cc85cd941ffc9
SSDEEP 384:n7iFiZcI63sNq8TUNTUlImZaKMi04w2fiBCauGlAiFpsa+VYYrgL/7IzdoC:WFQ63Dwg/7nBCaXHFphgPJ
TLSH
T192C24B36EC98DDABE9FA8FDAA74A7603EEF00153959C99D4D9D81C1D00971DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3bef6a1abf55015793055a1dbfe566bb2857cb893b6d34c742e539a19c60c638
MD5 2074e16dd09a7a53c8c4b773a1d9a4b0
SHA1 c2e436666c373ebcfa530cfd4c0db6226a098c3e
SHA512 e87bc2d82df2d8a0da63908e0e02ca345f9c8f53387f0e854974640169ff0c74ea8452780d379e9b19114938e2229dc46be2c1e755b10197150ea8af7b7612d7
SSDEEP 384:nRiFiZcIR3sNi8TUNTUlI4baKMImzw2fiBCauGlAbuBiUsa+VY9lfgL/7Izbo3:4FQR33wgJpMBCaXWWiUhgUs
TLSH
T1D0C23932EC98DDABEDE78BD9A74A3603DEF04153998C9AD4D9D85D1C009B1ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e05a215d32ba626e871cdbc3628a293fba9ccb823d5d571fc1965d0387877852
MD5 4898c089a06dca942aca843a497150d0
SHA1 54270a8a4fcc2a24e32fc22b74433043955419e5
SHA512 16ecd5a6152b3096e35bf9ef43d788e026b6b4f22c986d57a618e7e6c91ecdbc7dafaa3690188f3046713b3aa88dfb4898bfb1e8fe80bb0b4284af7483767985
SSDEEP 384:n4iFiZcIsL3sNi8TUNTUlI4baKM7mzw2fiBCauGlAbu7mUsa+VY9lfgL/7Izbo3:DFQ+33wgJcMBCaXWamUhgUs
TLSH
T171C23932A898DDABEDE68BD9B74A3603DEF04153998C9AD4D9D85D1C009B1ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 60811f2a0e57ae954d078d46d455ee1ab78fa240641eee281d2846e49d9a051b
MD5 61ae16b8f590051a9531fb5c552c0a98
SHA1 0a4bfb306c0ff082fa013d85dc551082524bdb33
SHA512 128db4284e34c72e0318142e44784dd426b3666e162aa861a26614afa17e44031d340de3ecdacb137a702f8fc242524a2a8b79243ce2e250888d5ea522bdd171
TLSH
T15B412768A6F91148B3B36E1A9BF3A89D487BBD772E06D09D10110E4F0A36B40C861777
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5100-195-0x0000025580000000-0x0000025581000000-memory.dmp

Download