422b41565266c24ed08ae043ee835508087b7f21fe98a920c664c805b21dbb07

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
grow/tree/index.htm
Size 1KB
Sample260425-pjjyeahw2x
SHA256 422b41565266c24ed08ae043ee835508087b7f21fe98a920c664c805b21dbb07
MD5 b8e9e63a3f36aaccf0058bb67c927497
SHA1 60a3620cbb650c5e2e0586d8f72cfaa2425c9a14
SHA512 7162945234bb512b751827b01bb787000903a3e7e54fafad1b6677cab6784e04e845653e0aff2e135e391aaa9d20e80d4ff2a8727a28d90da81e4c344b556027
TLSH
T15F21BE661F085E6FC621C2BCD636AD99C366DA0792640A7CB977917F11943004CF7AF8
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_722326973\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_722326973\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_722326973\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_722326973\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215942405583847"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{BAD6CDAD-9560-4177-9EB0-F01C0E1789A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 5076	4432	msedge.exe	79
PID 4432 wrote to memory of 3928	4432	msedge.exe	80
PID 4432 wrote to memory of 1096	4432	msedge.exe	81
PID 4432 wrote to memory of 8	4432	msedge.exe	82
PID 4432 wrote to memory of 1096	4432	msedge.exe	81
PID 4432 wrote to memory of 1096	4432	msedge.exe	81
PID 4432 wrote to memory of 8	4432	msedge.exe	82
PID 4432 wrote to memory of 5548	4432	msedge.exe	84
PID 4432 wrote to memory of 5344	4432	msedge.exe	85
PID 4432 wrote to memory of 5548	4432	msedge.exe	84
PID 4432 wrote to memory of 5548	4432	msedge.exe	84
PID 4432 wrote to memory of 5344	4432	msedge.exe	85
PID 4432 wrote to memory of 5344	4432	msedge.exe	85
PID 4432 wrote to memory of 5704	4432	msedge.exe	87
PID 4432 wrote to memory of 4180	4432	msedge.exe	88
PID 4432 wrote to memory of 5704	4432	msedge.exe	87
PID 4432 wrote to memory of 4180	4432	msedge.exe	88
PID 4432 wrote to memory of 1252	4432	msedge.exe	89
PID 4432 wrote to memory of 1792	4432	msedge.exe	91
PID 1252 wrote to memory of 5736	1252	msedge.exe	92
PID 4432 wrote to memory of 1808	4432	msedge.exe	95
PID 4432 wrote to memory of 3504	4432	msedge.exe	96
PID 4432 wrote to memory of 2360	4432	msedge.exe	97
PID 4432 wrote to memory of 5312	4432	msedge.exe	98
PID 4432 wrote to memory of 5312	4432	msedge.exe	98
PID 4432 wrote to memory of 5960	4432	msedge.exe	101
PID 4432 wrote to memory of 5960	4432	msedge.exe	101
PID 4432 wrote to memory of 4424	4432	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\grow\tree\index.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffeae89c188,0x7ffeae89c194,0x7ffeae89c1a0
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,13138755775839381848,11757581307186624457,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11963636774494631913,1950520794765363968,262144 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,1555616532301132892,5182955676394189211,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,4689673716768832163,17619187702624745193,2097152 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,10952145854291467783,2219421466854633969,2097152 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,17258735977445707351,8669661895933027862,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,17803991875258152938,16429946374803632281,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,10448694104008556546,3354164597630182279,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,10308649366962177662,9144124794875156794,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,10308649366962177662,9144124794875156794,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,14363198813176251531,1435127476736152917,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3505634098535223069,14476633033074772020,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,8883817416038894892,5617756998963043683,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,13654051217502546251,10925837793914460739,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,9974882532855020182,17101202524235099372,524288 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5064,i,1089050071462197235,16056246725799484293,262144 --field-trial-handle=2588,i,12464378112032566887,2673592712649160994,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 aee8a94c09c69db44a49f8065a85aec8476c068546454dcceaf15ffd15f7ef22
MD5 68c5116006ab04f6ccd319cd98e4b5bf
SHA1 510b7596e3ec8e85b3bee285cd61cb50a6e347b1
SHA512 73f5f7f73822f64be185b65c4a85b7839c359825ad18af225938a2010282c2aadabbbb6f1e4f3d70a5224a1784a7c735fc4e796fd8f0bc480e07759b75bb077b
TLSH
T1F4E02BFAC86198270CFD472861504707EB51131B1B90864F3B3D820C8FF4A3B46968AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 760115d4f6494b58180b29a38325f3774edcf42d759c99595a3119d79296e13a
MD5 72147f1cc6e4fca4840412b1ec8c319b
SHA1 eae9d1ae48f34ce137df3f65f11862dc253cf7a6
SHA512 8e5d728aa17ac9695f24a2453f3b576707a2d0605771da6608a8b875c95a2c338109d5ec7ae8f3675ddaf4c06d1176a7b7dc59329123f466bdedccadc64a9daf
TLSH
T11241EDF383E8856E9A0196F0AA187E2BDE2D0550432C7D9AC9E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 afa8c17b7d8e4f95db2dfde7774b70661f225eb51139feab0a6f746cf364a804
MD5 0e4bee2f12f0872578838d07b40a5226
SHA1 cc8696576ec6c8aaf82eada3904060399a6f46e5
SHA512 3c480986b12fd9fc6e0045ba7232f04760cd75387d756ca6fd7e6d5e9c88f9fa6550a7623ab5da2d06bcf659043a93299526f0d3e3127234edee4aa0431626cc
SSDEEP 192:sxZCDERxryMqZ/K1Ml8UQBKFBa/fhcsBH565LpzJ0M5IIDPChkwzodpECI/W6+WS:sxZ9OqKU/fes/G9zJ0WtL32/bG5wct5
TLSH
T19272FA1A6A34997BCCDBD219BA45BF53D7F9152391904E489AFCCB0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f579bfc5df68cbf3921b40ffaf987d151be20db95d76f437299e540b8048215c
MD5 96f4f87457f4d94f5650b2c420d0b997
SHA1 844fe3d76a46661632a4bc8c40a24d4af5db8d52
SHA512 aa50bb6bf7aeab14b16564ef118624f4dfa6bd0585f6df966e4e30058baa22045a36a761fe93cc999566278f329b91510f140d47d826ebcb6fe51da24b22ddc4
SSDEEP 192:sxZCDERxryMqZ/K1Ml8MFBa/fhcsq5iLpzJ0M5IIDPChkwzodpECI/W6+WNGY0Ec:sxZ9OdU/fes8i9zJ0WtL32/bG5wLjI
TLSH
T1A262FA096A38997BCCDBD209FA45BF53D7F9556391904D489AFCCA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d6e4774b93045e8c85b6944aba78fe331b5c65d0fb3406cecc639a8cba94e7b0
MD5 8eba9107c483e41dc61b361231f27b50
SHA1 6954714883d4d4a0ab6aa95c664ea62578c895db
SHA512 f69a69c64dfbb695cae52a3f1102480d7705924fe31b133fc94149c0608f63b68d373f13cfdeb9b4be688a3ea84e91f61c84b869842cd96121e9ea7b88a036eb
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3qDwvLlr:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKqDwl
TLSH
T19D030B3B680CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA444C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ca23e94f5ee1f5f2d47ff61889e81fbbadb03fc3c5a2391041b85a63a1539ac1
MD5 26125f5a50d738a99d67db518290fd41
SHA1 6324197450fce0c59954ce49135630452b0531d7
SHA512 1f5c59828a98b50d81b1e5de28cb77067edb23f4ae567f1e439fa10d9e7d09c9886cf9e85ef1a73012b4bd5222899293c8a28fc255ba6059e2ee501f2a92d352
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa20f:ardVTNBbfw8nM9fgzNJ9dvz9pTV3
TLSH
T1EFB23C11753B03803A7E359A81A5B56F46C230633118E93B3BF841E68F66E24DDFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a568f790b6d338d735cb44b3059f52790f47f9642d7869e2b6aee58d2b0ef71e
MD5 04f0b149caa154c66fac41d43d92e970
SHA1 f8f74378ffad2ef79b4f1612ab853c564eb55d55
SHA512 479a986e1bdd96faf52f3c44f555b3c0ecd7a098ba39be02500372e3c0e6ed495fafaaaba3a676651be6da8d8b01cd1cc62a58cef38dc0bab0d4a08e062f6f63
SSDEEP 768:vFxccQo3BwgEX+pxNsG7EJbdr4ypJmDDkLI:zccQo3Ixdr4yDgDeI
TLSH
T1ADD24A369894CEBBEDFB8E84E75A3A03AFF4425795C85AD8C9C80D0D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7729d703a19b2df0f50e63c6e92e459c924b463334b07b75cfcbf75969169fa6
MD5 42706d574582f28b78acc3a535afd461
SHA1 0d52a0103d891a5c836c17cedfe03b73977d6227
SHA512 8cdd44158299609b111c79eeb1414033a8fcb2a3d3b4105a69731d25c2234f53810f9db22dcb53cb4f33a373f94e59f0bc7e4204121e9427708c40691871219d
SSDEEP 384:nWiFavqMg38NE8TUNTUlIxBvHTDiGPwffKNsGDHE66iDmCpdnS4mtmtcrNlk+5vq:9Fayv3TwgviDKNsG7EJbCpdS4smtU6
TLSH
T197C23A75EC98DAB7ADE74F89E7097A07EEE04197D58C49C4CAD81D0E00D71DE134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6f818db072b9da15a61915acd315f508ad1cb1fcd88e8e1a4ca612c9edac9201
MD5 0437e967c1629c0f5a15a3454cf6e788
SHA1 5ead94b1479665fe647023f8339467f87660b737
SHA512 d050566a4ba23bd744987f3985faccb2a95d6419d6c01fbf73f364909ba48de6588617983cc608c51c95e3b7b2da60b66fd0a371685bdd8f3cce4c7854a46b67
SSDEEP 768:FFxccQi3BwgE5KNsG7EJbdr4yEJmDDkLI:1ccQi3Exdr4yOgDeI
TLSH
T1F8C23A3698A4DEABADF68FC4E75A3A03AFE4415795CC59D8D9D80E1D00871DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fa2c7aea9ba6e22ef76b2bd1587abc53a7d1bf2a3ad83e314c1f7b18c13a24fb
MD5 fdf345fae78db6bbdf96881b3ebc600a
SHA1 8b7f10fb99afd9b57c961fc2c526dd807814af45
SHA512 825110129a6e06c8801200324f1414394e0f8a97a0c3666c873d4e12cebe47060722696fc4b7d71f8d5559ec411a30d7d19ffa675f5e1888eb292fe030a5de44
SSDEEP 768:IFxccQi3BwgE5KNsG7EJbdr4yEJmDDkLI:8ccQi3Exdr4yOgDeI
TLSH
T120C23A36A8A4DEABADF78FC4E75A3A07AFE4415795CC59D4C9D80E1D00871DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 feb72c365d1d6e280a58a8c9e57334fb0a8116f904ce0fe9625257d993127bed
MD5 7c216b48f15b3801e0b496f53efe8288
SHA1 6b94c095ea3ebc6600675c37d04c4205dbc9f978
SHA512 f9c55e7b3382346bce35a90ac7cbdb9deacf6a933d50dbcc40b1f141cf634308b860d02a653245813351e4756f18e8b3b95b02f48e85fe32b925ed35277406a7
SSDEEP 768:BFayv3Rwg++KNsG7EJbdr4ydJdS4smtU6:ayv3Pxdr4y/Bsml
TLSH
T1FBC24B75E8A8DAA7ADE78FC9E7097A07EEE05197D58C49C4CAD80D0E00D71DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d717ea232bbc771232cb2be932511f9eba774ef750172551a0513ae5e5c6d12e
MD5 16cc2b4743ece85fd8b51bc91b6c1102
SHA1 920c082f04405e02903a45175b9f527846d97ead
SHA512 cfef41592cc485e1e82ce02bf3f04ae61bbd2518cf97257bb402461a204a0a6d46eda2d670523ec0ada7e6e1542fa9e14312f4727afbb40319e29fb47bf8225b
SSDEEP 768:IFJccQy3BwgA5KNsG7EJbdr4yEJmDDkLI:6ccQy3gxdr4yOgDeI
TLSH
T106C23A3698A4DEABEDF68FC8E75A7A03AFE0415795CC59D8D9D80E1D00871DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 dde0a44aac28ef6b41691d00cfc85b0180d0ea26ad6cbafed293ce5cace7d316
MD5 1cfb954e75ad11d70d341684b4dfa8fd
SHA1 221b32d0e4a6ae8ddc541782e42d6be02bc60fc8
SHA512 91b96458767d77002bdba1301b9946bb9604b98d426488f3a1f896443eeb6c69bf3ca673890df49ec07d2a728c66dd76ac2d65a3d9a170bac781f4893ea675c8
TLSH
T1CD3123E1583D26D1D4FD0E6EA4473CFC85D8D32AF4A8707D5458ED98463A61EA04143E
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_722326973\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_722326973\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download