6bb288835bc59b4550338d8034ef8fb9f05714e890ec08c327149c82142cb4ea

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ledgerfiles/LICENSES.chromium.html
Size 7.9MB
Sample260624-egekssh15m
SHA256 6bb288835bc59b4550338d8034ef8fb9f05714e890ec08c327149c82142cb4ea
MD5 d5b1f4d67bbb923ae30f5d5ac424b269
SHA1 e751270f329f8f5cc882e615157891421f569c79
SHA512 b8c5ebcfabf56c85467b27815d7b2cbb0ff922a5bf08a3e619772644fb53049393134d17a849d3191a29b6af1218feed32895bf26c7b77cf3ef0178552ccede4
SSDEEP 24576:dbTl6Mc6T5kJWSSRKb+oFDwmfL8646a6N6z6fkHuVampem:tGBAA
TLSH
T16386942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267471678737199"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{74E743D4-778C-4B31-838F-AB785742D6F9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 5312	2788	msedge.exe	87
PID 2788 wrote to memory of 2956	2788	msedge.exe	90
PID 2788 wrote to memory of 3928	2788	msedge.exe	89
PID 2788 wrote to memory of 2956	2788	msedge.exe	90
PID 2788 wrote to memory of 2956	2788	msedge.exe	90
PID 2788 wrote to memory of 4408	2788	msedge.exe	93
PID 2788 wrote to memory of 4740	2788	msedge.exe	92
PID 2788 wrote to memory of 4408	2788	msedge.exe	93
PID 2788 wrote to memory of 4408	2788	msedge.exe	93
PID 2788 wrote to memory of 4740	2788	msedge.exe	92
PID 2788 wrote to memory of 4740	2788	msedge.exe	92
PID 2788 wrote to memory of 2376	2788	msedge.exe	91
PID 2788 wrote to memory of 2376	2788	msedge.exe	91
PID 2788 wrote to memory of 2836	2788	msedge.exe	94
PID 2788 wrote to memory of 2472	2788	msedge.exe	95
PID 2788 wrote to memory of 2836	2788	msedge.exe	94
PID 2788 wrote to memory of 2836	2788	msedge.exe	94
PID 2788 wrote to memory of 2472	2788	msedge.exe	95
PID 2788 wrote to memory of 2472	2788	msedge.exe	95
PID 2788 wrote to memory of 5564	2788	msedge.exe	97
PID 2788 wrote to memory of 5564	2788	msedge.exe	97
PID 2788 wrote to memory of 464	2788	msedge.exe	98
PID 2788 wrote to memory of 464	2788	msedge.exe	98
PID 2788 wrote to memory of 3824	2788	msedge.exe	100
PID 2788 wrote to memory of 1296	2788	msedge.exe	104
PID 2788 wrote to memory of 1864	2788	msedge.exe	105
PID 2788 wrote to memory of 4212	2788	msedge.exe	106
PID 2788 wrote to memory of 5980	2788	msedge.exe	107
PID 2788 wrote to memory of 5980	2788	msedge.exe	107
PID 2788 wrote to memory of 5664	2788	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ledgerfiles\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffb5ae2c188,0x7ffb5ae2c194,0x7ffb5ae2c1a0
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16064868424949522887,5708104990832544573,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17070557163913662177,1510686503283839701,262144 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,11046213887989241541,10367924803758792101,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8333234210784682230,12674406371386011281,2097152 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17422435650770361245,4002734946114067312,2097152 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,14192688240374014070,13024847963676370298,2097152 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,6664602079859540281,13602199562986549644,2097152 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16784192775133784445,3735029185696200367,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,6828211198933092330,7103696756109706542,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,18152551824686284058,9517435595718352240,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,18152551824686284058,9517435595718352240,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,710279012752904917,7533264939692084495,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16023439073524037781,2791758561533523544,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8314423139116156112,4249220373899708724,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,16431930328532904721,6671849362123304996,524288 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3048,i,2793418505783423465,7415586910889492080,262144 --field-trial-handle=2328,i,5467909203330213415,13319926199190460488,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a73b32029b5d0c6ff7ae727c0f35079c0207fb5160bb2094317e96e23daf1cee
MD5 5fd2ab1b84f4c46ecb80443cacd9d150
SHA1 dd5f53ee71d94f4de7f9196f7dd42d06437a3320
SHA512 80afd342835e5b7c47013c2e8821b8636a9782f5c0541da2d81ad7da7f1be3e061af3ccb4f9143b3b85ff16c6113c3f6bf41ea64da18da643b2cf34c67ef65d1
TLSH
T1C2D0C0303300F601C0CA24B4FC106311123B8A1230E3C21D7020D00DEE940D0EB8B45B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02e83107bdf4cefad04d7dffca4065fb67146265abf734fc1a0a6c97297b321d
MD5 e502aaa276aa06e6296f6ef4749253aa
SHA1 99b55990cdf0fa9357771717d8ade2d2ba1023a1
SHA512 2f9d794c6e91e4888f5f7323dc7b92a27fbabf3cf561300c11be8833a6a0a6f5855daaa7cfc1901faab9b2932d40d1361bee35e50c2951c0e558a06150e71a6f
TLSH
T131D080707755F505D5CA25B9FD146315523B8A5220E3C61D7160D00DEE940D5EB8B457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da6a26645b73254f3d6f93d0b9fce28e504c1ae9281556be9f3ac64bb48f6017
MD5 896085ef58e94f4f93a5195a3872553a
SHA1 84d02660692898ab05241550606a3327629cb10a
SHA512 883585c5153dd48ac5f5e80ada80468eb07947f0f0cadd8cafc7b1755557bc1ef4c24ec4a47f8c30fe813878d5b9be147efd5bbf5f437f4bbf9d1914ec06adf9
TLSH
T19F61EA9E40600F11FB6446B670C264DD33B6E94BBAC7FE7B209490389B55F69A58DC50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a9a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a9a4.TMP
Size 3KB
SHA256 cc3e5dbfcd57162b4aed07577698020a7cefcd3eceabeb022b1d64be1ea17393
MD5 2049fbc4e45a273be7eed15b768d040e
SHA1 05670ed94932322740454295c89b64d76befd7a8
SHA512 9b8c977aa1b7e949fcbfaaed9b9e54a136c595acb35b6635d1c6420d26b46702aa0d1d9a76f195fb7d72a7370b76497dc4dbb290f8fb40ee1851bd7541eeba13
TLSH
T1F061F95E40600F11FB6446B7B0D264DE33B6E94BBAC7FE7B309490389B56F29A58DC50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 42a292feda1999fdac0db16410b216036af4559cb1218ce5c2f927024fc8b861
MD5 1f48a1647b51f12d65e9ad714e3b09e5
SHA1 af950782942e8bbe1173cca27fa89b992b75aef8
SHA512 f93daa0170a5d487724124e1fde031cf6baed5463015d16e1566ac6d4e1087fde227b6ddcf35aac3303422b621ff7c5ab2250c2ac01f6b799b8ed8ffd3f2b1c8
TLSH
T1AB41BDF3C2E8856D890146F4BB147E2BCE1D0954932C3D5AC9E4AF1B93E28B1E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 932e338c5b43542347600198b47ce051f98c109c36496418a8cea0f7249f75fc
MD5 eaa7fc58f8a579e6e8bfadacd7a2413d
SHA1 3de9ae8ec5991a91fe68203cf3687e1ea3a08cc6
SHA512 3c185a2f6a83683a7302c29d40e07684c8ae65411b22a0ac91e35fba594e7dda7236a0ca27adab31e24f40238807e3a28cca1e9787d4d8d48b1992a498ace5a9
SSDEEP 192:sxRqRHyM/jK1Ml8wFk/fusV92sPbozoA8p42/g6+WNIY5xLWGpIgD7J:sxRq/bk/fusV9Zbxv/5I2Xh
TLSH
T19152C706AA28597BCCCBD209FA557F53D7F81532A2905E44AAFCCA0C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 57c3f74359b31f3e3b52736daa34921d36fadb0110cffd9786363df740d8fd9a
MD5 380385bac60a1c530a145d5e66925d03
SHA1 0dc92220da9da5d55bbb18b56b7c08f9ee63fbba
SHA512 0f80fb94feb2818f8f2860049ccc616c2b4acac575099b5963580c432b863dd17a831b85397d16da146e02301105988fcff11b280d5bf4c7787d4235c56b83a5
SSDEEP 192:sxRqRHyM/jK1Ml8UQSFk/fusV62sPbozoA8pe2/g6+WNIY5LLWGpIgDNJ:sxRq/qYk/fusV6Zbxp/5ImXL
TLSH
T19F62C816AA285977CCCBD219FA957F53D7F81573A2905E44AEFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 212859be6f3947c4bfa4ba6258e1e569dc98d14b852aa1d85fe4a657869306b9
MD5 f9d943d6c4e7a0a0de05eb9ad45dd5c9
SHA1 e4fccba9e63c537ff4949ccb26b4b0288c3eaed0
SHA512 4f6bf8506454a24e9ad8bcaaa22fd7c632cc7375a894ad72f8d8c65b964f0aa64b7d762bcca90999bb3edbddcf8f19416051d57e31c12646e9a74378e3548f0b
SSDEEP 192:sxRVRHyM/jK1Ml8wFk/fusv92sPbozoA8p42/g6+WNIY5xLWGpIgIJ:sxRV/bk/fusv9Zbxv/5I2Xs
TLSH
T16552C715AA28597BCCCBD209FA557F53D7F81533B2905E44AAFCDA0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 81d453c200ca3d38744882f5b533b24325cd99d41ead1763f4e40090e4ba6bee
MD5 90459b3262528cab2e7a0dc1a9b744ed
SHA1 5f4f360399a1ff3988bc12dc9964d5dc5ed1e3a2
SHA512 0465e5593695d21c83fbdaa162d3235a2c91b1ad41afcfca03046d0c1671c67b289edee5425fe84a0c09a3f8a7adb3db53d65b6a591f48dd1c0d3afdd797160c
SSDEEP 768:QMUhBCWgmcfXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY2oKPro2Q/UihxL:QMUhBCWgmcfXwu1ja1dKc2Q/HPL
TLSH
T117C20B2B640CC77E4F844EACFC2AAE976DD801CB57988D5447EE890C03C67EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1a1af43c-2abd-4bc2-a607-33d4b440bc1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1a1af43c-2abd-4bc2-a607-33d4b440bc1f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6ccf1f9e3322c9ac11f0e6becbc977654255ab532f4e4faa9cc1afdd67fc0b20
MD5 8b1e281a9f8a2036858c79341dbcb352
SHA1 1453fa2c470e6685a71b6f02f922b584f6288b79
SHA512 f99e25d61a0b2ad02e3c9f72c8bb8b65d11561473a0f9431f794bd1a915b0c5fa4537bdbd25daea31af786e117bd9872509468b14f9d740b596235f359d4d3a0
SSDEEP 768:wF1j+9m3swgp290rjfhfhJf5qZ0SEbuRpag62Dai+fAhPhG0fL9:d9m30nfhf3f5Zijag6E+IdhG05
TLSH
T1C703BE728CA88D779CFB97C4B91A36426EF04693C6D16F84AECC1A0D05EB6ED1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 aa9848a79c73b8efd79135f513155a6a444ef70d608cf26614d003ad316eda06
MD5 c7514df48bcc95913a24993f5f0f43b2
SHA1 e35b51f35b6c19a84ad9ca657986201b0a204060
SHA512 95cec4de120ff4be0ed3d608a03926a8027697cb74eacd316630cef2f501520db7004e27a6e0cfece91880b416b6d407b18d28e198efa533ca23aa7645f74663
SSDEEP 768:jjaeqD4MlshiLdMm13E90rjfhfhJf5QZ0SEbuRpag62Dai+fAhPhG0fdT2:jqcjhIdMu3Rfhf3f53ijag6E+IdhG0c
TLSH
T17213BF75C8B85C738CF7A285B51739836EB04697C6D53F889DDC1A0E06EB6EE1207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ff2fa53a31687cf55bcfbfa75484b8acc29dcbd1bca1b80561d335b29605ee1c
MD5 fcd74ac770962b6d914f9a46057ebc1e
SHA1 7617c4dd9936519f5f80af65131d4d68ebf1eeb9
SHA512 8a181ba81aa278931fb3682f607950acd9e6fbd3a20fde2e53519fb504b248de109e477fffcafd1ecf41923f33c36b920c9d753100a33af1a8b192c26493aec5
SSDEEP 768:Sj+9v36290rjfhfhJf5QZ0SEbuRpag62Dai+fAhPhG0fL9:h9v36nfhf3f53ijag6E+IdhG05
TLSH
T14EF2AF7188B98D738CE793C4B5163A866EF0568396D12F889DCC1B0D0ADB7EE1347917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ec88fc37856e05ac5641306f63b8b87dd842c5dffdfa7060c4c85f22d41a206e
MD5 c5fa296db696f857191ebf2719208c21
SHA1 a6bcf99ee48cf40dd6b7e0b52d7932d05d24e595
SHA512 dc2223809151c5c918c4af6b959ce512d0c045400fa220e0ba5d54603cc729d72bb1ea315c411868dee16453edadc4630c35a80e4be4a2e352b956e32c2fa7df
SSDEEP 768:Sj+9v3b290rjfhfhJf5QZ0SEbuRpag62Dai+fAhPhG0fL9:h9v3bnfhf3f53ijag6E+IdhG05
TLSH
T163F2BF7188B98D738CE793C4B5163A866EF0568396D12F889DCC1B0E0ADB7EE1347917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e9cabcc57c0be8a90efc1bc73dad4b1cc5f987e174300ae50d81d709d7a5883b
MD5 6bf5dfdee284684cdf7c046291e163a9
SHA1 5703ffd8f996775c24f2fc51490033604a9b32c1
SHA512 e89f90a645fb0a8a7cb7af671897813556b82c98e5017816feb21a5f500ca5f09a11bb6f71098ba28d2d9799ee5517d1fef4d58532380a68ef47812f8c7dbf68
SSDEEP 768:GjaeqD4MlshiLdMmi3Ea0rjfhfhmZ0SEbuRpag62Dai+fAd2yjWtUkTu:GqcjhIdMl3KfhfHijag6E+Igyj2U
TLSH
T1AA03C07698744C778CF76385BA173A966E740683C6D66F889DCC270D12EB6DE1303417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

852ac9a4-e70e-4d24-b5eb-cf09a1832368.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\852ac9a4-e70e-4d24-b5eb-cf09a1832368.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download