bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260702-2f92msfy4t
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2528	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275054972137490"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{165DF109-3E27-435C-A4E7-62A2A9383F1A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4704	1600	msedge.exe	79
PID 1600 wrote to memory of 2304	1600	msedge.exe	81
PID 1600 wrote to memory of 2528	1600	msedge.exe	80
PID 1600 wrote to memory of 2304	1600	msedge.exe	81
PID 1600 wrote to memory of 2304	1600	msedge.exe	81
PID 1600 wrote to memory of 912	1600	msedge.exe	83
PID 1600 wrote to memory of 912	1600	msedge.exe	83
PID 1600 wrote to memory of 2376	1600	msedge.exe	84
PID 1600 wrote to memory of 3640	1600	msedge.exe	85
PID 1600 wrote to memory of 2376	1600	msedge.exe	84
PID 1600 wrote to memory of 2376	1600	msedge.exe	84
PID 1600 wrote to memory of 3640	1600	msedge.exe	85
PID 1600 wrote to memory of 3640	1600	msedge.exe	85
PID 1600 wrote to memory of 2448	1600	msedge.exe	86
PID 1600 wrote to memory of 2484	1600	msedge.exe	87
PID 1600 wrote to memory of 3000	1600	msedge.exe	88
PID 1600 wrote to memory of 2404	1600	msedge.exe	89
PID 1600 wrote to memory of 2448	1600	msedge.exe	86
PID 1600 wrote to memory of 2448	1600	msedge.exe	86
PID 1600 wrote to memory of 2484	1600	msedge.exe	87
PID 1600 wrote to memory of 2484	1600	msedge.exe	87
PID 1600 wrote to memory of 3000	1600	msedge.exe	88
PID 1600 wrote to memory of 3000	1600	msedge.exe	88
PID 1600 wrote to memory of 2404	1600	msedge.exe	89
PID 1600 wrote to memory of 2404	1600	msedge.exe	89
PID 1600 wrote to memory of 2180	1600	msedge.exe	92
PID 1600 wrote to memory of 3536	1600	msedge.exe	93
PID 1600 wrote to memory of 2180	1600	msedge.exe	92
PID 1600 wrote to memory of 3536	1600	msedge.exe	93
PID 1600 wrote to memory of 4824	1600	msedge.exe	95
PID 1600 wrote to memory of 3728	1600	msedge.exe	96
PID 3728 wrote to memory of 2292	3728	msedge.exe	97
PID 1600 wrote to memory of 2876	1600	msedge.exe	98
PID 1600 wrote to memory of 4492	1600	msedge.exe	99
PID 1600 wrote to memory of 3288	1600	msedge.exe	100
PID 1600 wrote to memory of 4164	1600	msedge.exe	101
PID 1600 wrote to memory of 4164	1600	msedge.exe	101
PID 1600 wrote to memory of 2492	1600	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x210,0x264,0x7ffe60bac188,0x7ffe60bac194,0x7ffe60bac1a0
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,5361342944189836523,17786925249910559407,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,9801961955948659181,11681241850322890006,262144 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,15649826799693273255,2345584888003812147,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,18144834973428738200,10153399944588441499,2097152 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,9491737675626414429,582244217373402840,2097152 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,4953592179055137790,11229249768397226947,2097152 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,7513738417217277367,5597436301661817059,2097152 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:9
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4128,i,1113208319726111692,9947900085477359429,2097152 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4140,i,6550386967015988018,10916867549766084155,2097152 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,8211212530985042053,13521485060227212050,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,13404474537096597319,4908734444640939820,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1933206045928314909,3758896003349560681,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1933206045928314909,3758896003349560681,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,7810119433033215329,15846998568372527476,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,9836355130651952600,13487943451034488537,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,13151319757786639344,17139393846126206765,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,12019622305664522503,10359016813451517937,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,9748400693564371273,17484405800063836331,524288 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5436,i,7279894142733214530,11319322814069046969,262144 --field-trial-handle=2392,i,14731512503459233147,8038190360963664089,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b69af90689cd4a15e7e7bbe34299e877573c1df3b28bcc634c3cfb4ab55f5295
MD5 8866c7273cc69900404b83e6b86727a8
SHA1 d4e9fb0422e5c9f02ff6f92cb9cde3508aad2bc6
SHA512 f6c4e9172bc60eb6837a90093e641ca23b62389e847d445139061f961c5daed38722851d31962f40fc6798393b6a0dedb36bb74b5ca6ccfcfe75f766070f38f5
TLSH
T1C9718E5001CF4BC3DF76153364D242F274B0B09B1A634F15C57C6AB26A25753DCD7518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c6f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c6f5.TMP
Size 3KB
SHA256 07437414cc12c4a390b61e19d9071f931d48c7afa3eadfde397c3499573587cc
MD5 d2daae25100927f684371044dd746778
SHA1 7faad2c475ffc3cd3e4a94e819541018f7e42199
SHA512 7249c84ee33e64e99d3d5688d8ced4a4cb6a7f69483bdc247c05801137c5e8415a08f1ca5388aa67030a2813d055b25ece9cbf2e8ef9955d205c0431ea38bf0a
TLSH
T19C717C5002CF8BC3EF761133A4D202F2B4B0B09B1A634F15C57CAAB26A25B53CCE7518
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 644B
SHA256 0e2fc3332d92d0e96c991b16092e548444340987ae0cfb7d89303c5f40bd0e61
MD5 8f38232f52e26e6089cefc5b9d1ff6f4
SHA1 253af00ef13db765e7d4eb0f746d9716a218c55b
SHA512 db0cda39eb4390baa1bf722750acdb37a8755a117ddaea6b7881556e8ccb0c7c4775ea0358181150ed38ca0d2ab687e1e6e74d3f5fdac324eb0d21830ff4e28a
TLSH
T120F073F783E049BDDB1181F0AA187F1BCE6D0542431C7D5696E4AE1B93E3468E405D5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1435844b7cd0ab549900354931c602266c83cb4027638816ab556eac3147d769
MD5 b3dcc58635a82ee875eceec90d8c9028
SHA1 a557b97b90cc3c7b0350344006256d9dda7d847b
SHA512 ff8da2ae322d687e00bfbc77274f66f691d5bfca65627ea587ca9d0e005ac110a7f7708ca8dd6fda76872da3462f58ead3ec0b40ed9bc6a1186eb625aad45cb1
SSDEEP 192:sxZv/yM/jK1Ml8UQwFq/f8sPdmVXIdpEB/W6+WNGY016LXOIg5YJ:sxZv7qmq/f8sFk4Y/bG5ju
TLSH
T1CA52FA12AA34597BCCDBD209FA51BF93D6F9147292500E44AAFCDA0C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2d076cbf279373655027c270e03a7aa5c9ed9ffd213efe6a8475a26506c0afae
MD5 91096d6331f4f6561dbddc57abd0c6ce
SHA1 dfcd997b2cf316e8c7bc1c6a3d9717eb69c78af5
SHA512 ea956c135f826b68bf445fe13760ff877624da62a719d69e92d1e6fda2ccef714e45b66d664806d7b83053918a0fe3b167e403f85ae3c7958635e3755dba5be3
SSDEEP 192:sxZv/yM/jK1Ml8MFq/f8sZdmIXIdpyB/W6+WNGY01IpGOIgrJ:sxZv7dq/f8sLJ4G/bG5g9
TLSH
T14F42F912AA34697BCCDBD209FA45BF53D6F9147292500D44A9FCDA0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 3fa223f2bc63464829ea9936223469d8b5b56ab8c3465a1cf0dd90eee0c197e5
MD5 7e5161bf092a5e3b21c361e201c13e72
SHA1 f05a08c05263edd8fb62155eec36c4038f09b93f
SHA512 40dc052923fd6d66b8de063f22078aaad7b3767e8f7f15d8870435fb16a0147994918a6370cb6ae134c100c3386301ba273120e4acdc2e70820f25ab0048175e
SSDEEP 768:BG4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4T:Blu+68si2y1WRmlzQqju1jaKDILpZ8Ue
TLSH
T169E23A3B280CCB7E4F844E5CEC26AF966ED802CBA6684D5447FE494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9521e0913e4549a5c9231a33c7fecbaff0517855b8917f255e60f46973543fcb
MD5 bff76513e0e16b172f2cbaad0aa29d11
SHA1 81b57c00f941b1ebca4c2e521affea72244b4fe9
SHA512 5557c4f46d11a17b0e48121d57dc305bfc0a6306cf68120be1193b5ec7e4c8e3eebdad415e427296158066f10bef9bcd700fc1a79e613b937f813b9ce786695f
SSDEEP 48:KZYBMIamKAmObTI3QAKoVwyA8AQ9rS4NyhCI/KjiY3yF5IlKCgAjoZs4q2P:Kgn2KQA2iC0KjiyW5mKCg2oZs4q2P
TLSH
T1CA91AF4135FA62413C7E2809B294DB164AC2F3633118B5AB7BE804778E67E641CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596298.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596298.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5808bc0d75a2f1699b1a001420e69830b1be8ed463f719d5a89f3f77af8919e7
MD5 be2df7daa7bd84f966d4d57f79b177cd
SHA1 47bab4f56d6c4bc419afb87a4b6833a531967950
SHA512 259320266e9431fb3e1de92b36c5bee08b9abbd3b5f1d580414eee42af1f5a2c4cdb876bd4134a0bbff7ec3b1edd74a96de85f6a149af8e8f41a39608f2f17ba
SSDEEP 384:2iFqtNn/s3n9ST8Ns8TUNTUlIlj6SptUikr3b+AX8uRlmXvrZHVOObjI9G6w7LAJ:dFqj+9+Zwg02grpdRlGdHV29MLs
TLSH
T155A25B339CA89D7B9EE69E95F94A36178FF400ABC6856F80E7DCAF0C019B59C0306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b5a61e6c13f8cc7bb047a832b5158dabb84e5cec72348dfa4f9ec0db3cd4aad4
MD5 039f9a0af39bb4903bfd6b6b16fb3f46
SHA1 51d12b1448cd750ba5aa7ac0b2b5c63c8a4f581d
SHA512 237dcf449b4e5f46db9aba0c4d698d759601804fff08c56fabba05c077c32205633f5f05ae1fcdac93a4bccdc4e723bafea4c9467fc014f045b3f2d9040216ae
SSDEEP 384:TtNn/s3n9Sa8Nkj6SptUikr3b+AX8uRlmXvrZgVOObjI9G6w7LAJ:Tj+9tW2grpdRlGdgV29MLs
TLSH
T1EE929D32AC79AC774DE39995F54B35178FF840AB97882F80D6EC6F0C05CB6AC4316906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fc612c6af517f57faff373b82c6cb8940bd19af321f1a82488f8bee90862c8eb
MD5 afe7c39da53a3ce107858886d4eb1a4f
SHA1 87c8f43634eb1672eebb2231fe921d3cfce44fc9
SHA512 27aefb2a966eb70e4d48ac3f22950b30a34225ae150921fe7de47481c2a163ea235ff709987ece2998320c77b8b318e6c8bbe925160f1b6b482af0473fc2827a
SSDEEP 384:UtNn/s3n9Sa8NkW6SptUikr3b+AX8uRlmXvrZgVOObjI9G6w7LAJ:Uj+9tD2grpdRlGdgV29MLs
TLSH
T14F929D32AC79AC774EE39995F54B35178FF840AB97882F80D6EC6F0C05CB6AC4316906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 eae23cf5ee0ca79ac4e88d999bbc4eaef1afa5a9a8f0452b27fdf08ac0b06141
MD5 5d30c98d1c48e50d67ff20aaf83530bc
SHA1 db534538545fe4307c9d811a1382331c4d7d9015
SHA512 47045eede2b5d6d4e3a6264dee04c61642609b1d1f788a3b86b997ecbfe153b61b6244a957b251f8d81a2b29a41836118e471e7708987af858539fbd2b9ffeef
SSDEEP 192:uau8NkUQg+SX2uPdrd9gQmiU1iTT74r3b+jcPjzorraeoVnmXvrZM3hR+q7rU8:68NkU6SptUikr3b+AX8uRlmXvrZgVU8
TLSH
T17B320932AC78AC7B5EE3A985B54736139FA8106BDB883F80D6EC5B0C059F65C131B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b4dc8090b1dbf40e8fa74abe0f4c86544e2d6e0044c460242545c6f8e65b884f
MD5 f42b07b45d5975b753f7cc180f36ff9b
SHA1 e67361e4500069917bb08d6c0896e065b13c5ac2
SHA512 8af6c82fada5b592263276df5658d3114d921213fb1ab1703b8d6c0e6fe1f159a217ad1cfb64719d8487eb34f82e4613c422474a956592dd98071c86c5d21f6d
SSDEEP 192:nRGNT6yMQmiUywJmj1Y3b+jcPjzorraeoVnXMnR3/rU6:RGNT6xX01Y3b+AX8uRlaBrU6
TLSH
T1F902E831A9786CB79EF36E45B48727139FE4107BEA852F84D6F81B0C04D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1d77276915bf5323fd9c9a13c58f43cf75a8c206e63c7ef5c621259eaaee431
MD5 83834cd78efaffd1f0e8c5d8fad9250d
SHA1 17705c1250658421e0c77d4b8a4ecc13ff2dc561
SHA512 3e5f434655abe847800517ea47db4f8b19875f354d7d7b4508bbda97b7d5f2630a16137828ec89d9adbe0f512b9ee43e2178ac96ad06311d03a8df2755dbe970
SSDEEP 192:sGNN6y0QmiUyT0jkY3b+jcPjzorraeoVnmXvrZX4MR+q7rU6:sGNN6xLkY3b+AX8uRlmXvrZFVU6
TLSH
T165120A32A878BC771EE2A985B48731138FA5116BEA897FC0D6EC2B1C05DF65C130B956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download