hxxp://mollive[.]net

Resubmissions

02/07/2026, 22:18

260702-18altacv2j4

02/07/2026, 22:17

260702-17frfact8r4

02/07/2026, 22:16

260702-16zg6act8m4

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mollive.net
Sample260702-18altacv2j

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275043446427854"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{858E92A5-9D8A-42E2-9898-07746F17658C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5980	msedge.exe
5980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 5560	5484	msedge.exe	83
PID 5484 wrote to memory of 5852	5484	msedge.exe	84
PID 5484 wrote to memory of 5472	5484	msedge.exe	85
PID 5484 wrote to memory of 5472	5484	msedge.exe	85
PID 5484 wrote to memory of 5472	5484	msedge.exe	85
PID 5484 wrote to memory of 5644	5484	msedge.exe	86
PID 5484 wrote to memory of 5644	5484	msedge.exe	86
PID 5484 wrote to memory of 1172	5484	msedge.exe	88
PID 5484 wrote to memory of 1172	5484	msedge.exe	88
PID 5484 wrote to memory of 1172	5484	msedge.exe	88
PID 5484 wrote to memory of 2184	5484	msedge.exe	89
PID 5484 wrote to memory of 2184	5484	msedge.exe	89
PID 5484 wrote to memory of 2184	5484	msedge.exe	89
PID 5484 wrote to memory of 5668	5484	msedge.exe	91
PID 5484 wrote to memory of 5668	5484	msedge.exe	91
PID 5484 wrote to memory of 5668	5484	msedge.exe	91
PID 5484 wrote to memory of 5944	5484	msedge.exe	93
PID 5484 wrote to memory of 5940	5484	msedge.exe	92
PID 5484 wrote to memory of 5944	5484	msedge.exe	93
PID 5484 wrote to memory of 5944	5484	msedge.exe	93
PID 5484 wrote to memory of 5620	5484	msedge.exe	94
PID 5484 wrote to memory of 5940	5484	msedge.exe	92
PID 5484 wrote to memory of 5940	5484	msedge.exe	92
PID 5484 wrote to memory of 5620	5484	msedge.exe	94
PID 5484 wrote to memory of 5620	5484	msedge.exe	94
PID 5484 wrote to memory of 3708	5484	msedge.exe	96
PID 5484 wrote to memory of 2276	5484	msedge.exe	97
PID 5484 wrote to memory of 3708	5484	msedge.exe	96
PID 5484 wrote to memory of 2276	5484	msedge.exe	97
PID 5484 wrote to memory of 4984	5484	msedge.exe	99
PID 5484 wrote to memory of 4644	5484	msedge.exe	100
PID 4644 wrote to memory of 236	4644	msedge.exe	101
PID 5484 wrote to memory of 724	5484	msedge.exe	102
PID 5484 wrote to memory of 724	5484	msedge.exe	102
PID 5484 wrote to memory of 724	5484	msedge.exe	102
PID 5484 wrote to memory of 1192	5484	msedge.exe	103
PID 5484 wrote to memory of 5152	5484	msedge.exe	104
PID 5484 wrote to memory of 3040	5484	msedge.exe	105
PID 5484 wrote to memory of 3248	5484	msedge.exe	106
PID 5484 wrote to memory of 3248	5484	msedge.exe	106
PID 5484 wrote to memory of 5980	5484	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mollive.net
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffedf09c188,0x7ffedf09c194,0x7ffedf09c1a0
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,2254859603192320005,16290761655453558985,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,8130710851670959918,1499558847308863544,262144 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,2357302596275612111,6974104831577964298,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15557412158039241820,17413407230749971511,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,9916710260350548422,4205563174163378002,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,16637995396097773300,2072647330571083443,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,14391451275595122535,1982509605409850828,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4268,i,1084708318157268415,11224188729993275216,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,10605875055659009656,12244010972681107992,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,9163040831660572361,12053534696588881333,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,3812977801103090972,6131449549364597159,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17690770886302825235,5006606279078503076,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17690770886302825235,5006606279078503076,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,8287353632622293257,9685921800958860410,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6200,i,6474657740122735161,8599060088079458118,2097152 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,6088184106045973458,15751555814292317748,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,5556758166882846647,8613546651768295952,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,15579475109803299817,12028261283281607253,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,7790851236567469148,14137388982052309415,524288 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3648,i,5038247113556940348,4835477821230997024,262144 --field-trial-handle=2224,i,389226626913222237,7225507986622538610,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 72e9123d9d89bc5ea150f90425cbc3e77a917d914cfda2f32361fb05f6931e46
MD5 089ac676ff005c1ed021f2eff2e77a63
SHA1 076a125c8f6f7da449e6ce12702e2b10e0ea1a8f
SHA512 32c910e67d6f61ccd31f88fdab446c477b6963398d332ebc4dbce670de6621b556259dd0efb83bce142a9d89811f134054ae531f9d83c4552f6241746793c6ea
TLSH
T14671E8E8070194B3F39D52F390D10A8FB47681B9D9F32D0A4D54B8B6321EB64C9F4E44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59099b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59099b.TMP
Size 3KB
SHA256 9fceb8e53d2c17018278256e99ac2f0df60d385c48784abcc83f68429b1b343d
MD5 a724fbd34200f1292853e567137808fc
SHA1 0ef438bff610a37cf24ae46d6834ad0b4905a4ce
SHA512 0e3b93dea12b237dac551dee51d17c69c7be3bb68e13960483bc23eef47850eee239ec7e480d0b5167ca67ff111c9d95fe68f00c19c12274cb27d7d4d65e99ce
TLSH
T16E71B4E8070294B3F39D12F3A0D10A8FB47581B9D9B32D561D90B8B6322EB64C9F8E04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 268eaa992500eec9854a4f537270b68f92c76c809b0a04baf8497ca2dafa6506
MD5 5f1e90afa82fe82a28ac1cd3896efe6f
SHA1 211191f6e1c959953b288d7049e194f130617e69
SHA512 1125dccfe985976120764ff2326e2ae0c1ddada7a1646ade99a0c1c27a9b2642ed3eedb6f6187435a9e7da949237dc9b786261630a02aa62f9ddebe5c745eb7e
TLSH
T1BD41A0F383E4852D9D1151F0AA282F1FCE5D0916431C3C3ACAE09E1BE3E34B1E105A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 997138d01c5491a3cc12dcaf40fd5d32a7ecd58e48b93496eba7b802fe05bad8
MD5 0a4d24918f3720397b158f612219ffa0
SHA1 3d01e31c7e7983855138ac497e201dbb437c013f
SHA512 82437335d12dc2e71407fe98ac8fb1a807770da43eb997ff085affcf0f4117ed2e3757165c173368970682175333f2ecbecec88446909120b9679f45c5e1793d
SSDEEP 192:sxZ5RfyM/jK1Ml8MFT/fOstq4dgIdp0a+/W6+WNjRu/Y0a4SwmfIgrJ:sxZ5HdT/fOstquh0N/bQ/5k9
TLSH
T18552D8166A34997BCCDBD209BA45BF53D6F51872D2900E44AEFC8A0C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 57972f4df721fbbda884f6cb0d910210e1cf51ea31e4431e3e64dc15fde38ea1
MD5 ab61e52f4f39b4d734365868ae0cbcf6
SHA1 25f05f8f3022fef4fad7eb361b38a166b3dbb571
SHA512 0c77c074dab910372abb88a5607cc81c26135376d5f9da2d05ce66d3a9bd37d63362921408145e9a9f0a7964b56760227bd0304021242ade1c5dcfbfe93971d0
SSDEEP 192:sxZ5RfyM/jK1Ml8MFT/fOs1q4dgIdp0a+/W6+WNjRu/Y0a4S8mfIg5VJ:sxZ5RdT/fOs1quh0N/bQ/5mB
TLSH
T12A52D816AA349D7BCCDBD209BA45BF93D6F51472D2900E449AFC8A0C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 67d3042c285d01ab66d3ceefac4541c929bc6aca7cf9596831f5b1054fc66b43
MD5 698d2144ac64a19c0860eb4514007e46
SHA1 f6aa92797b2bb1bdb4510bc1b342462b62d15018
SHA512 b1aea5decfda7b1459b407a2b9e690b648d1d0f864731b5dd39907096ea8457e2019a1bea3bd069f97f5a0a87524a99d2bbd4583a0f5359ccf13731996ad22e7
SSDEEP 192:sxZ5RfyM/jK1Ml8UQcFT/fOs1q4pgIdpea+/W6+WNjRu/Y0anSzOfIg5/J:sxZ5RqqT/fOs1qaheN/bQ/5qn
TLSH
T1B552D716A634997BCCDBD609BA45BF93D6F51472D2900E44AAFCCA0C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f43e6338fd520231820f317ca9080ffa58f5beea490c95254883d9b6c96a55b5
MD5 62399e86d8d87f8eb98c1d78441a94ee
SHA1 b2b2368e5a0612d2f57fc57a13fad00fd850e830
SHA512 5f80c7d425976a0c4699d6ac94f9a2933dec1125afebe62ec617d2644f3a9e1af88c82b67872d150cc8d6e5b9b576396e240d6a6ac3cd05aad2d241b18216e37
SSDEEP 768:Rg/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0Vgeros1:Rg/zh8dF2PkWRmEcQXwu1jaKWjLp2tVR
TLSH
T13CE2092F284CCB7E4F844E9CEC266F966ED801CB66684D5447FA894C03C77DB521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d639ab0090207f7fb7a4ad79b87671995b2fedec74258753c74c5f4982877b9b
MD5 3091e671237c2eb6a3d70112a8b3be19
SHA1 72fb851c377524d83aec89872086551022de25e1
SHA512 4158f2a837dbbd5ab22b54f7577a4b05f7b488197d30104281ab8b5b9f255e2ad6fc903ce68d03d8a5d484fe365cc0eb059f4ad9f8d8cbb6c84f43dc69191541
SSDEEP 96:KEWgKv3XeK8kCaKwK76S+1uK2cOjFjSjrjOjojR:2C9Pnh9hevSkd
TLSH
T118B13F5270FA56113C3D290DA29497575A4273E73068E92B7BA900B20E2FF216EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d26e4d10-45a5-4764-8362-b12b6f873c16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d26e4d10-45a5-4764-8362-b12b6f873c16.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e865e74b3d530c5a8975db448681735182ff58205f4a005c606d65fdcf1be208
MD5 6bbf8bc8d088a68dd10d797f909b8526
SHA1 7868cfd7393f202a89cef74096d54e41058b4f9a
SHA512 d3abb30c1902b24d7f7f647c8c3bbb4261a1fe09c3dea5367d2f44cd828f37e59a35a2824141c9a74ecc1110408245ac2fc4368039e9693a4c02690e228cc14d
SSDEEP 384:RtNn/s3n9S68N0sGZbupxRAunsuOau/WW4B0jw:Rj+9prZb0tsuOau/WW4B0c
TLSH
T199927B7A29399C3A0AE65588F5473A0B5FF890B7D3C52F80D4DC6F0D01DB69C1357A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 774ac59913e11a9061c45702aa98aab40ccfc5e6aca8f92a49c4cf702f127372
MD5 526ec52c9c15e3231effb77089bb911c
SHA1 6f58c7f141cb85cc46c7fe01d2ddd2134ce1697a
SHA512 c5cf25cb943e9f677fca259cd3a431a95fdab0c1bbb19a5e12ff6fe052c59594268d0546013c0823994b1e31c36b1e7f68a371df8a2d16e467fbf008942e2a95
SSDEEP 384:StNn/s3n9S68N0oGZbupxRAunsuOau/WW4B0jw:Sj+9pnZb0tsuOau/WW4B0c
TLSH
T167926B7A28399C3A0AE65588F5473A0B5FB890B7D3C52F80D4DC6F0D01DB69C1317A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 64daba10b27b0002210dd6f1a1a2367e4127fffb1a97958008e730a9cea5afe6
MD5 4296225c55262b8eb9dbb576befab7b8
SHA1 9cbc068f5fa37e45478d5c646bcde2448f0cced8
SHA512 dfc191f1bb7a851629f770061e46b636a85c93607e6d860239103a1bc669505454291bbe8da2c6cc856099d96829827e3d775eb0d89e27d8592a37a06cee0ed9
SSDEEP 384:miFetNn/s3n9S08N88TUNTUlIlPGZbupDRAunsuOauGWW4B0jw:NFej+9VVwgkZbytsuOauGWW4B0c
TLSH
T1ADC21AF718E7883ADAAD4B47A73E2E064EBCC0A7F5851A40B398590CCD971BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c141a664c827946677bb84e18fa00aba49c6394fc6d569b0f3756ec754bb8ae2
MD5 d1da9ad6883248abf720d07a9522bb59
SHA1 89218aa305e64a0d6e513a0ea3aa468805e67e7c
SHA512 466d6f1cec9598ba2692da30a7ef80ab02a2aa5ae825bb4957b1ce6f93c2d160193b80df0db1bedb38f72ff6e2002a343b456cddade3647a2fc4cb2cabea171e
SSDEEP 384:ItNn/s3n9S68N0PGZbupxRAunsuOau/WW4B0jw:Ij+9piZb0tsuOau/WW4B0c
TLSH
T17E926B7B29399C3A0AE69588F5473A0B5FB850B7D3C92F80D4EC6F0D01DB69C1357A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0df19cad6faf5f9b76c026c16cb242d4c57f3204f493a4d4d1f88cfe59a5642f
MD5 49a210f266cebd88d2004f7b21b452f7
SHA1 4a83609cef2db469663710645568caf3f38db8b8
SHA512 0d1f633e2153442d4014a06760b9eb00c7da7729e12ef98425c46d48e4983e8d0c4c22a2594e9f03f187120b66ff34d85be3cb89251943c1a02f7c1c791aa028
SSDEEP 192:BGNpx6P2UOcQmiUywIUnqGv0uOAwSBOU6:BGNv6eXsLIkqGsuO+0U6
TLSH
T10302D8396D686CBB8FA2AE44B88637179FD8107BEA952F80D9E41F0C01D765C3347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a01d867fbab940896731d6d4c8c383f3964d6c08d79c26582392f3df27069c8d
MD5 09e989a59830b9a0add285e2a2f36b76
SHA1 df0b29ec87cd11151ba1f50202691aba6492d11b
SHA512 2bfefe685e8731d6bddbe090f7d1d8b0afa05163bae4d9b383982fdfd646830459cdc2fa1fe86181cecc03de40d6c44fe7eda11293b4abd3070d87bf07ce26e3
SSDEEP 192:hGNN6P2U5QmiUyQEn7Gv0uOaut0BoqkU6:hGNN6eU5U7GsuOauSWU6
TLSH
T16C1209366C689C7B5ED6A544B48736178FA85167DA8A2F80D5DC2F0C01EFA9C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bd15c37-3eaa-4940-b296-1f334a7c05e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1bd15c37-3eaa-4940-b296-1f334a7c05e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download