d323942ce5115ec94f0c400818935883865212a7885696d010d00ca51eca5d41

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ExtPack-license.html
Size 10KB
Sample260723-w4b7macf45
SHA256 d323942ce5115ec94f0c400818935883865212a7885696d010d00ca51eca5d41
MD5 e5c315881ceb72a6188cdbda4517ec1e
SHA1 ff3a623e1dcfad6f03e4af51718a2af3e29aa4ad
SHA512 6fc81ee5121db08d0ba4950009bab91a8426d022fdf2e390a13d9332f2d5781e3bc52ece47338e538a709cf8843fd1826f9b6540180bbfae3074fc1a3f6c3ace
SSDEEP 192:qLayy8KgvxJI3XThbH+cDlprVjcgd3404ErXC6xoe0yDGpRpP7ixYU:Caz8KgMHTbprVj40rk0DGBGH
TLSH
T17D22D9E7B34827A11787037A36478FD5F369883D76BF451020A5C11A2762D7883BF6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293050244757802"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{A641E0AE-EA15-4503-8251-D472A32B814A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5228	msedge.exe
5228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3260	5008	msedge.exe	89
PID 5008 wrote to memory of 2544	5008	msedge.exe	90
PID 5008 wrote to memory of 4932	5008	msedge.exe	91
PID 5008 wrote to memory of 2544	5008	msedge.exe	90
PID 5008 wrote to memory of 2544	5008	msedge.exe	90
PID 5008 wrote to memory of 2328	5008	msedge.exe	92
PID 5008 wrote to memory of 2328	5008	msedge.exe	92
PID 5008 wrote to memory of 1572	5008	msedge.exe	94
PID 5008 wrote to memory of 1572	5008	msedge.exe	94
PID 5008 wrote to memory of 1572	5008	msedge.exe	94
PID 5008 wrote to memory of 2212	5008	msedge.exe	95
PID 5008 wrote to memory of 2212	5008	msedge.exe	95
PID 5008 wrote to memory of 2212	5008	msedge.exe	95
PID 5008 wrote to memory of 2760	5008	msedge.exe	96
PID 5008 wrote to memory of 5776	5008	msedge.exe	97
PID 5008 wrote to memory of 2760	5008	msedge.exe	96
PID 5008 wrote to memory of 2760	5008	msedge.exe	96
PID 5008 wrote to memory of 5776	5008	msedge.exe	97
PID 5008 wrote to memory of 5776	5008	msedge.exe	97
PID 5008 wrote to memory of 4316	5008	msedge.exe	99
PID 5008 wrote to memory of 4316	5008	msedge.exe	99
PID 5008 wrote to memory of 5500	5008	msedge.exe	100
PID 5008 wrote to memory of 5500	5008	msedge.exe	100
PID 5008 wrote to memory of 2300	5008	msedge.exe	102
PID 5008 wrote to memory of 5184	5008	msedge.exe	106
PID 5008 wrote to memory of 5572	5008	msedge.exe	107
PID 5008 wrote to memory of 2776	5008	msedge.exe	108
PID 5008 wrote to memory of 3916	5008	msedge.exe	109
PID 5008 wrote to memory of 3916	5008	msedge.exe	109
PID 5008 wrote to memory of 5228	5008	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ExtPack-license.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,794128890461475310,2335211050722941820,262144 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,15861991601315720564,13762629037509686030,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,3894662844299658738,6001826765237133914,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,16522233137900619219,11500381704395163312,2097152 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,7117386044409479147,10457673781401383080,2097152 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,15926418209560297508,14640582432732128372,2097152 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,4827512910942992239,16006242616490384056,2097152 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,5170716450154351914,14744460844339432766,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,17452985517604631870,11903827071673830271,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,6422504810951210564,11412662470470499804,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,6422504810951210564,11412662470470499804,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,14748041361589316384,6557497453279534313,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,15371869268007401753,10076365969199507610,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,11143145094286914089,473335777369027603,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,11268578882160258153,13112707815936491357,524288 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,7301856161428493733,6632464352543871435,262144 --field-trial-handle=2716,i,1904760751799372613,15615307009067979066,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 02ac1e3613b083ea8cfcb052d3bbf4ee04d9784345cd72942c18d457223588c9
MD5 4bcd642b7f3d3c25dc94e18e7c0e2c2a
SHA1 737e5a29b63853431ccc044ae03ab67a5c14d092
SHA512 04a8a0a78ef2bf44bc526451f83c7a2ff245997df51cf42ad4b891e62b86101de33aa0128a123f4d5a4b2f56cba458b0888391ce74643a161058a7874db4855f
TLSH
T185519EB807B129F2CBA446755AD1E60A32F8889500B3DE5B40401DB55B07FAD16D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c114.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c114.TMP
Size 2KB
SHA256 b0dc8709c7ed56ef25b1b0fbcd85c1d176756babd148abc9d490316fd1ef8811
MD5 5c54357d9959565b9cedb06401ce98cc
SHA1 21df8f8b5635b566ab05cd3163bfb37a844ee627
SHA512 8120f2a692b202f210f0a2a2b759d2860e6c3f77d3779642d20e57bd2e4335364181039cbe3dcf166315565904b4a73a330016c48075a1e771211c09de5f225d
TLSH
T11451A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D1BD2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fb36090-5178-4770-8ceb-9f12e1802f41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3fb36090-5178-4770-8ceb-9f12e1802f41.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6e688cd801179059ba751e62cbfc898b7d196cc861ae857309ebe0a7764f32a4
MD5 0dd791bb38718e9517c1f3fa05af41fd
SHA1 c474c32453a5e7ee8ed60ee4cd1659f4361dbf4a
SHA512 0c8e1b09d49b9d6ea1580e8e698fb54832c81c19b1ab09adbbc9e83aa41258c7c67ec4537ad2fe2b50f4b804d7835bc439d43a7e1a81060c91aeeefb283bb087
TLSH
T12B41BBF3C7E8892D890146F0AB147E2BDE1D0914832C3C5AC9E4AE2BA7E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 65f1945ced9355c2cb4142f45d0f96a190582dfbaed340223cb4015650600e61
MD5 5512326c91488e35b53794d1552b58a1
SHA1 11e33a52b85c1c92392bbed2ec05a9fe362df2a3
SHA512 a4dc029dbeb98c002be41e43eeef15eed70d81509bb93372ecb17a602793755c73ee05a04aa42933a0733620111ab21c1cdde7e477a2aabd829b3388229a7675
SSDEEP 192:sxRyRkbm/fcsRaDde5lSszoD8p4y/g6+WNIYCPuOUG4IgDHJ:sxRyQm/fcsRac5lPH/5ILkd
TLSH
T11542B7166A68993B9CC7E20DBB55BF53D2F95072A1902E48B7FC870C14EB6DE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bf339a4b03198bf538c6892097110091e8781d4a956ba44d33021c780ac1ddd9
MD5 6deb36ba7cd34f4df08366d36bd52e24
SHA1 217adb2747d3a03075a9962db6e7ec952f0345ff
SHA512 17433f351b7da3823395d8a428503ed08e5884b01e55109221af07f1436ec442100abe2cd9cf70cd2dff5fececfe95c415ab83dc9be0e60b93a9b5926e4b9909
SSDEEP 192:sxRBRkbm/fcsJXDde5lSszoD8p4y/g6+WNIYCyuOUG4IgIJ:sxRBQm/fcsJXc5lPH/5IQks
TLSH
T17B32A7165A68993B8CC7E21DBB65BF53D2F95032A1D42E58B7FC860C14EB6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9bd049380edcf0434a5afdba390f46fe7174091263a395ef82f5d1217ecd56c8
MD5 a2fb40e74bc74a77522d5db635322c17
SHA1 d030fffe20e5323c84b05648ed676976dff1968f
SHA512 7660307ca33c85ed4694f6fbee4d7984d8d235108e3ea7583d64aa317189024531595166fa42238e95fd74dc83afed7365018b777a1eaea60b41e8987250e336
SSDEEP 192:sxRyRkbm/fcsRXDde5lSszoD8p4y/g6+WNIYCyuOUG4IgDxJ:sxRyQm/fcsRXc5lPH/5IQkv
TLSH
T1DA32A7166A28993B8CC7D21DBB65BF53D2F95072A1D02E58A7FC870C14EB6DE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8a43591dce92ba70eff04f95654e0c25bc84595af764728cea0b4026a20ff14d
MD5 81eae609cf5b45dc2a719aa4a27dde8b
SHA1 b180bf692f6dd995fe326c914ad240f60e9bd36a
SHA512 7b891c941067d717821a95f5101650f436841506af9d7dffd91f8520279bb7b3974814568ad004134314515adbad8d30e63abd7b0f104d34d77271e0457fd3d2
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvWroZSb:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vf
TLSH
T1E8B2EA2B600DCB7F4F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6b0cd97b7fd3d5fad475ab8286223e40bf5c7f7f90383c297cc2fc907cc44a3e
MD5 d852c9811fc4dfe76f67de055c537423
SHA1 e08575e9009aa52ad547e9dc033621adedb370c8
SHA512 d1eee5f28d550fb1269a6879a023cd29702e11a2e64f37932d7a41aa7eb6913245d3e88278d45c0db5263da8bbfa757ece4989e78447f32a7c3588fbf7be7286
SSDEEP 768:8rv+4UNbdc3YYKoCp8+p3bd66j+4BRv86aLIWc8D:8bsbu3Zc8+p3Z6n4yK8D
TLSH
T1BC03AE73E8A8E9739CF6CA84B14776437FB810A396C01ED4D9DD6B4E119B19E130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2df7bc340bb1fa8da4f4203f0aae5cf3a5a3502c06de27fc2bd7182a37bb9175
MD5 2ba654f33717a593b266f384eab7500d
SHA1 3104fa45afdc5a1ce4e89db8a0d4079da8050d87
SHA512 3e7a701e6f42aad201b20627d4cf8aaa0c5cf1225f9b046191aa9d3a8a177ac1251210b937dbc02e4ca33e5723714ee18fdaf68b30b6f81d26215ad0743613a3
SSDEEP 768:233VYKoZp8+p3bd66j+4BRv86aLIWcb9MI:233aH8+p3Z6n4yKb+I
TLSH
T119F2AE72ECA89D338CE5CA45B29A36436EF451B3D7D00ED894DCAB0E05971AD570B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a5dfeff2d9690269d66f5044839a720aaea87610ccb75434453b9b8cdde0d6dc
MD5 8816768d8c94bd7ab6d00da1a06986d1
SHA1 b4c36048fe66f2288f020027c66aabb48b21e44c
SHA512 2604c1eaed105998c5ca0e5f2ce19fe61c4414824be77cca6ceec2dae0e8887fee01eef5775024c521386b74c38681815c5380c813e48669cbd1cb5d927944ae
SSDEEP 768:Y33cYKoZp8+p3bd66j+4BRv86aLIWcb9MI:Y33VH8+p3Z6n4yKb+I
TLSH
T130F2AE72ECA89D338CE5CA45B29637436EF451B3D7D00ED894DCAB0E05971AD570B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ee16abc4af0b9714782a401f7f10060f7e52967fe1f062840dd94d0b8d467dc2
MD5 cd2298e31f2701a10e73ffd607728d40
SHA1 a571681c930707507b305a82ac4090db6836e2b9
SHA512 3553e1ae2477d93b8e1081c69a4cbf71c08ae561b8d7c1e53f6382cf2bf78b4deead034fbeaac040c94cb91fc1829648498c21fb2a4b00342747b989b2f2984b
SSDEEP 768:Irv+4UNbdD3tcwNp8+p3bd66j+4BRv86aLIid2bwCl1:Ibsbp3TL8+p3Z6n4yf0ww
TLSH
T16303CE33F8A899739CE6C644B2467A837FF851A396C10EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 46dc2749ab8ff03c67fb697619148e1f0fd582fa0fe41306b4b046b3d755df3e
MD5 bc9c10172a9ed5d4e6f8f8c95974f917
SHA1 a609a3f55548d7c27dc88cb70f75a9dbf470d4cd
SHA512 7d95b23132a462e80347c94f8b89592c8f440269acbe2bb99ffd88fe068fedeb68582952c8add5cdee39e9c8c5ea8a6a77cb516babbb5af46d8d0576daa44322
SSDEEP 768:yFQp3IwgyYKNp8+p3bd66j+4BRv86aLIWcb9MI:Jp3z8+p3Z6n4yKb+I
TLSH
T14F039D73E894CA779CFACB45B29A3643AEF451B3D6D05AD4E5DCAB0D01970AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download