bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

user interaction
yes
max time kernel
149s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260919-typjnadn8s
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343091499206552"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{D152EFAE-255A-4DA8-A0EA-CF45FFEE7EAD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1120	4888	msedge.exe	87
PID 4888 wrote to memory of 2712	4888	msedge.exe	89
PID 4888 wrote to memory of 3260	4888	msedge.exe	90
PID 4888 wrote to memory of 3260	4888	msedge.exe	90
PID 4888 wrote to memory of 3260	4888	msedge.exe	90
PID 4888 wrote to memory of 1100	4888	msedge.exe	92
PID 4888 wrote to memory of 1100	4888	msedge.exe	92
PID 4888 wrote to memory of 4800	4888	msedge.exe	93
PID 4888 wrote to memory of 868	4888	msedge.exe	94
PID 4888 wrote to memory of 4800	4888	msedge.exe	93
PID 4888 wrote to memory of 4800	4888	msedge.exe	93
PID 4888 wrote to memory of 868	4888	msedge.exe	94
PID 4888 wrote to memory of 868	4888	msedge.exe	94
PID 4888 wrote to memory of 532	4888	msedge.exe	95
PID 4888 wrote to memory of 532	4888	msedge.exe	95
PID 4888 wrote to memory of 532	4888	msedge.exe	95
PID 4888 wrote to memory of 1272	4888	msedge.exe	96
PID 4888 wrote to memory of 1272	4888	msedge.exe	96
PID 4888 wrote to memory of 1272	4888	msedge.exe	96
PID 4888 wrote to memory of 3384	4888	msedge.exe	101
PID 4888 wrote to memory of 4312	4888	msedge.exe	102
PID 4888 wrote to memory of 3384	4888	msedge.exe	101
PID 4888 wrote to memory of 4312	4888	msedge.exe	102
PID 4888 wrote to memory of 4244	4888	msedge.exe	104
PID 4888 wrote to memory of 3636	4888	msedge.exe	114
PID 4888 wrote to memory of 4176	4888	msedge.exe	115
PID 4888 wrote to memory of 1272	4888	msedge.exe	116
PID 4888 wrote to memory of 1516	4888	msedge.exe	122
PID 4888 wrote to memory of 1516	4888	msedge.exe	122
PID 4888 wrote to memory of 1800	4888	msedge.exe	123
PID 4888 wrote to memory of 1800	4888	msedge.exe	123
PID 4888 wrote to memory of 2076	4888	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa8ef1c188,0x7ffa8ef1c194,0x7ffa8ef1c1a0
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,13132333175433304515,886274154366455992,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,803835799135888811,6340906273241447753,262144 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,11592880537831615387,648412763701002911,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11720437425481754720,14623452079794843936,2097152 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,9086602932727461868,10160679193135509185,2097152 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,3657867653040525442,13410086350003711278,2097152 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11468902702240784763,7822619517228603622,2097152 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,7293928241716935212,1960327768871656408,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4522827555013920718,10735398007635197040,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,2788499233596381188,11482613635604027165,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,2788499233596381188,11482613635604027165,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,6260552683886346923,3793459511389576340,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,18125781292404036604,15069381556614513277,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,14215550040759911310,311180181202039635,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,11075607357823796728,6890241200980667942,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,7180782130074500477,14377250083578085623,524288 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=744,i,11778979720874454239,9951169664912021820,262144 --field-trial-handle=1772,i,2625214362212447584,2331828371785585089,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5fe288bede36c6dda149f57ec8151215c2d1f1aa1088d4dad06ecd68c492b53d
MD5 9ac4089d0f0fd13c7adcb3250ca92641
SHA1 5b27ca754f8a12fad8f3ba1387ded9c1b9b7a95c
SHA512 c850c346b3d5f1911cceb0e95c5cdb04aea97172bdb2cbf397148392b7268b1d167766730a6cb06767dd68dc832670dd0b0557e02d7d685fb68e7b221284dfd5
TLSH
T1BC6142CA5ED0287BFF6865B0C1FD154B3B3034B045A31F5A28E6F8741E8D7892D96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591592.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591592.TMP
Size 3KB
SHA256 9788e1f4e8aa7e4c84a0c10ae48edad221b26084aed0f442892e2cbcbeaacf62
MD5 5615a391d1af2f059b059d01ded726f5
SHA1 d22b80eb3742549c3fdf781d1684ca013f6b47e6
SHA512 d91a02cb2cd8cb9f1cb70c98efbe98eed3f3533031fdc590fb4b8c4cc9d9a4770487ea1f143c3c8b34517b0eef0f2f1bb5415d1f8e3b0b1f9f70d14bfc2fd4d9
TLSH
T1AD6131CA5ED0287BFF6865B0C1F9154B3B3074B045A31F5A28E6F8741E8D7882D96238
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e3e94a79e63d2d94961106f7ab7882cac4367322e2e262ac1710a42d7b4b387e
MD5 3a2f9bc9fc5849c8882fb69254764391
SHA1 ec150e4cf4b1d3ad568b002ffcb0f3c8877c996a
SHA512 efae09f813dcf004edf2dcb674846016d47bd4fd1d6bd9dab965801a271737b789cc9231da87376fa5105784ff22988224ac292b63ce4d5792ab7117fa7b62b9
TLSH
T18F117DB3C7D585AE890116F05A24AE2BDE1D0606822C7C1585D4EF2BD3F3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 105da6dc5b1fcedcf7bf6d21e3662488520ae1eb01d9b5c6298e59121ba27e7b
MD5 8cb2a59669a035fd9b8a8c450fdc3afa
SHA1 1861b752fec1e6b142ac5a9785d7b3541fc34630
SHA512 60160a20c6357e58667abf7b80c2f20c7825f95b3f7f0a88c33c87ac1fa7a3ab3389e0817f2b18dcbe4a51fe725ea13a084f6ee2a4133e323b94364300c6298e
SSDEEP 192:sxZHRfWvd/fYsWqTVuIdpdpHW6+WNGYaQ9KIgrJ:sxZHQV/fYs/TxvHbGR9
TLSH
T1F112B7157E28A97B8CCBD20DBB55BF43E6F9503251941E58A6FC962C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 29c735835120ebaab71a0921973022b331c4439861cae5c7a4ff68a9a3b096f5
MD5 f6b7d120a84254d12b417e71d493df64
SHA1 ee41e7a0e41d7dfe755100327f2931d427247bb9
SHA512 a1fb8a10b925b9adaf345069ac39fef073c5e1891881a3224ea7e94df24b23ab017d6cc8b2b71252ebba9189c590325ee91d46be9c7b2cd28ecefb3c18d338c7
SSDEEP 192:sxZHRfWvd/fYsDqTVuIdpHpHW6+WNGYa69KIg5SJ:sxZHQV/fYsmTxJHbGzc
TLSH
T17722D8167E28A97B8CCBE20DBB15BF43E2F9503251941E48A6FCD62C04E7BCD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3f0cab8ee548d2eb299e31a0f476c09eabe76a85a9a33706f19a31d0ffb952a2
MD5 296ad124a8eb169f75a2a4841eee2d53
SHA1 1db776050382565f1328d5380b1ce3f07a14a73d
SHA512 135cbced0d6e80683f7ee3c3793413f1432bab4437f81e932daee1af7e410e3c71fa6e612cb9b4aa712f97556479be377afbce3f96a9bc562c9873dd3c2e2364
SSDEEP 192:sxZHRfWvd/fYsDqTVuIdpdpHW6+WNGYaV9KIg5SJ:sxZHQV/fYsmTxvHbGyc
TLSH
T1E422C7157E28A97B8CCBE20DBB15BF43E6F9503251951E58A6FCD62C05E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5c84bb2f63d3cb862386a84b6f28e8658c4e4fac7d436e39e409bf451f4125f7
MD5 12b995436c1af4a242e79e225b6fcc10
SHA1 188a9d708c2da01092865c2a0490d209fc8fb3c0
SHA512 801adec4cad3f67fd7e140143ed0fbe9c82590b11aa21ec4b6bec9f6e50c7674994f8fe9b197dccbfdeb8318a5efe4bd56fcceaafb25e8fd84f90835c1ce2021
SSDEEP 192:sxZHRfWvd/fYsIqTVuIdpdpHW6+WNGYaQ9KIg5gJ:sxZHQV/fYs5TxvHbGRu
TLSH
T18B22C6157E28B97B8CCBD20DBB55BF43E6F9503291941E58A6FC962C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 98ea42c600dde4f7a96744247d7fec3a1f0c6b16e435fd6b8a3ab38f9a7f96ae
MD5 99658bb70924a723d665134ceffe1c21
SHA1 3d15d43f5e5b2ff698dbf38ce818638c22cf3276
SHA512 876ef84eb6c114a1bbc4a3b30ba3b12bba34b4c70e6f24a49738a1634994814e5166c49e6fe29624ab08775ad20aedc4a47d61d90c0169b3fabb5fb049435bd7
SSDEEP 768:jcyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH34rolZZi:jcyQRbrWvvlpZu1jaXKLf33DlZZi
TLSH
T1E6C2F92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c2e5c1d787a0a8f8f20342a692b61f5b87d2ae4ff6e7638de89badb68dd594eb
MD5 475b4d7dc5fb15d8a5d3a2804ce0e5da
SHA1 54ea7c13ce1ada3e9dcd2e1b17b5809b4d5e28d7
SHA512 afd0a7e04e51bf3d0141a0bdde036623acd9f11684d12593fba2ace217becead83804a20c62eb68becea5a280df4c3bb7a8de9f1e0f28ca2ef396ee22e1720a1
SSDEEP 96:KgHmKQou6ucK3q8t0BdnDfkvDePh1kKJBhRO0KDt:AV3lt0BdnDfyDeJ1pBhut
TLSH
T14891F451317B064038BE69989276876E524132B33015EA2FBFBC01E55E6FE085EFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 070c7635cf8d33780a11ee285ad28953048a2af17928b6691655a9c76b0a10d3
MD5 930fb08d1e611c9dd28be8b5e097058d
SHA1 c2cb37523465aa292d3ffc46d0b41edc105bb9c4
SHA512 ca2e5c3fc6fa1dbd1c94ea98cd9a1f36fc901d94486d27e3b1f12c042077bdb8f6a6728c2b8de5043448e0507673da60c335ca170d1468a204646de9d1d0925b
SSDEEP 384:wlZcIarsNFa6gnVL6jp5u8ijOBdjBkwc0aUKoO:wdqcg4LkmjBkuaUKB
TLSH
T11D927D7668786CB768E3A541F9473B038EB88167D3CC2F8095DDA72E05DA2992307D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cd76da4d72fe569465bf0f2cc0263fdfc87b3ffcfc6b3b3ee09f37420162d3e6
MD5 460a0fa5ea153ce92b6ef815ced2d69f
SHA1 7ff0d98466724fa1783e64f45235130b71dd6079
SHA512 85a5cf34efba4b1683a7c5d82cba7b521145b50317db717d6ebb9851a0cfd34a5c682e1cf60cd81b535591846e834aadba6fa488b1e2522f92cd988b482071d4
SSDEEP 384:FZcIlsNFr6gnVL6jp5u8ijOB6jBkwc0aUKoO:9lXg4LkjjBkuaUKB
TLSH
T13C827D7668786CB769E3A541F9473B038EB88167D3CC2F8094DDA72E05DA2952307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cacbf1a3095b5b7776bfd5427c4ea1219ac936bda725705a2c8600d09b8c88aa
MD5 3dba8755dfd352e68564dca9165d927b
SHA1 db388a1d0b054c6e9d8c2dcf25fb2428ceb4d1ae
SHA512 8d26bd0d606612b790abc89d7ed6673af2d1d0be0636d4f3efa1acc8ecd8217824b8372f313b9049994227a0fc06e39f756ea5b5f1ff7d470e0b1806248f1a7b
SSDEEP 96:PqONkNQsjpfwDISp5ih/cIPURHl8h4otop5qmDxBfPGxvw45RxmJm78lFUxFqsej:SONV6iDCQmiUy9HHq5u88PjaSq3cpLU6
TLSH
T15E02F739BC782CAB9EF3AE05B54B3B175FA4017FE6942B84D9E81A2D00D729C1307522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 710f25ec4fea32770b63ef9b6a9a0da17c06499fa1c5d795ca775fadb944d737
MD5 a12d6f7efdd688262f1372b95e48f18e
SHA1 eeba1d39fb7b30260543ba997c6a89660aac7332
SHA512 56eca6d835c276551d7352c8cc8b7aa71b76467be3ee85fad7526e86a4599be11749eeb4ac379d4decec531fe54705fe8284c7b5079ecdf32a944dd2034b8192
SSDEEP 384:xZcIlsNFr6gnVZSjp5u8ijOB/jBkwc0aUKoO:ZlXgiLkojBkuaUKB
TLSH
T1A7827C7668786CB769F3A545F8473B038E788167E3CC2F8494E9A72E05DA2A51307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1faeac7158e5511579dd8963a4d0f42f1990d0f915a3e1ad04cd8f0aefb0b356
MD5 a3caab12be1f70af4403b8db57ccd763
SHA1 8af538656dd6ae8379efbd75d6503dea72b1ddbc
SHA512 2e719b173c2441e2bf98d1cf5f66b8c48e77e5ecbd486e8c9f7d66298bf6dce1bfcfe507d3c3b70bf2afb7ee19ed5004c508b8dbefef0751ba0c4de40b648cc4
SSDEEP 384:fZcIlsNFa6gnVL6jp5u8ijOB6jBkwc0aUKoO:3lcg4LkjjBkuaUKB
TLSH
T1D4927D7668786CB769E3A541F9473A038EB88167D3CC2F8095DDA72E05DA2952307D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c3ab8543b8af35170ef6cb313ab55afb7b396123f1cdb8cf6452f08d158d4e2a
MD5 81aaad2b6d54eb52bc058cb19faabf58
SHA1 df5a800e2b3c931d0d9fe0af3602adebd432ef30
SHA512 3bb65d97d692345a2d5fbdb64bf487bc5ac8a8352a13f038c6209fdc6a2d095db456fa533a8b7e5458053513276f32548b9ae415a6558979df34f17fb10d6cc9
SSDEEP 192:SONo6iDRQmiUyjHxq5u88PjO7FauZ4/CU6:SONo6aAxq5u8ijOB9jU6
TLSH
T1A5120936B8787C6B6DE3A950F5473A135EA5422BE7887F84D5EC262C01EF29C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4ad1f1f-fc56-4daa-be4e-9be2eeba59a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4ad1f1f-fc56-4daa-be4e-9be2eeba59a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c088c4c96f4c9b261ae915d85e25ce13e295ae2cdd5083d259d530aa52b38b14
MD5 21276076f47d530b020850661a96ca1a
SHA1 5e933683f0e7c7b9fa378bd13be916cb8f2ba053
SHA512 40dc62f53fcc1861b3346d2632b0c3c2dcd50c72f205b329f82c1be7c945cc6b0526b0cdb8ed2367f0e45b6ce5c877f1edf8d5c3d8bd6121239b39e03dd73a51
TLSH
T12C412958B6E91118B3B76F66AFF7B86E847EB9372E4AD05D00110D0F0A62B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download