bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
149s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260807-bp638sysfx
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305397222540296"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{56B8FA14-F26B-48D1-B057-BAEAC5310D27}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1028	3756	msedge.exe	78
PID 3756 wrote to memory of 2408	3756	msedge.exe	80
PID 3756 wrote to memory of 5492	3756	msedge.exe	81
PID 3756 wrote to memory of 5492	3756	msedge.exe	81
PID 3756 wrote to memory of 5492	3756	msedge.exe	81
PID 3756 wrote to memory of 5456	3756	msedge.exe	82
PID 3756 wrote to memory of 5456	3756	msedge.exe	82
PID 3756 wrote to memory of 6056	3756	msedge.exe	83
PID 3756 wrote to memory of 6056	3756	msedge.exe	83
PID 3756 wrote to memory of 5480	3756	msedge.exe	84
PID 3756 wrote to memory of 6056	3756	msedge.exe	83
PID 3756 wrote to memory of 5480	3756	msedge.exe	84
PID 3756 wrote to memory of 5480	3756	msedge.exe	84
PID 3756 wrote to memory of 5288	3756	msedge.exe	86
PID 3756 wrote to memory of 972	3756	msedge.exe	87
PID 3756 wrote to memory of 5288	3756	msedge.exe	86
PID 3756 wrote to memory of 972	3756	msedge.exe	87
PID 3756 wrote to memory of 3088	3756	msedge.exe	89
PID 3756 wrote to memory of 5460	3756	msedge.exe	90
PID 3088 wrote to memory of 1484	3088	msedge.exe	91
PID 3756 wrote to memory of 4444	3756	msedge.exe	94
PID 3756 wrote to memory of 3012	3756	msedge.exe	95
PID 3756 wrote to memory of 3052	3756	msedge.exe	96
PID 3756 wrote to memory of 3768	3756	msedge.exe	97
PID 3756 wrote to memory of 3768	3756	msedge.exe	97
PID 3756 wrote to memory of 4936	3756	msedge.exe	99

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffe29a0c188,0x7ffe29a0c194,0x7ffe29a0c1a0
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,2569984036397422920,12934823994079585822,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,13285591928508946111,15206394306507439856,262144 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,17578310088740219500,4423923024643417441,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16142101800500868841,1049442580659754068,2097152 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7440720643401315319,6625278608241798120,2097152 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,11950120839219264372,13922228271449781624,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15966253160739760245,16723255741914641349,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9261824686406378093,2057209801717943695,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,3850520220195359055,14564528393734656489,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9261824686406378093,2057209801717943695,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,16952294368104153104,6727301124979529324,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,14473245048046805339,7201638811817714404,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12265069897910045140,4080470851185677129,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,6053784766334106592,15262791276185580963,524288 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,5190407296731502405,17064830070933061578,262144 --field-trial-handle=2524,i,5323101581329192,4487352267999054588,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ab409692acaf74a79d07baa15b59d76fbd597f91289660257352c2a13943609d
MD5 618225c10ae1473f4dc6881d27df4b1b
SHA1 2b932e970d32122e2a089f9f0d57942445938a48
SHA512 e560be1b88456e636eb5b3c2a8041ca92adfd10b1a2133b7ba5385b5345432b921eddf6cdf2b54db9d201ed216bcc2d34728f5d46b1fff7133138dbf1b225789
TLSH
T163E0E5E5C961AC3B09FD2B2850516746FB0513572B424A0F3F3CC10C8FB163E454685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8fc230a63de97c6b361458798c37d23f1c044018e36ec788952ac447f7f0366f
MD5 151d7cbb302a7e08ec63b1e027699e81
SHA1 55c243c0a37cfdd53ad29c14e339eefa64dc85ab
SHA512 d79eaf6a2b3a21c641bebb465e4e9edbd5f10c1b5f5a645111ecf4a8f41090c4a22649eef08fa8f21a278c949ee06d07bc4c3928c2e505a9d0a01edb608a866c
TLSH
T1F831B0F783F5856E8A1196F0AA18BE2FCE1D0511432C7DAA85E4AE27D3E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fa2ac0835447eb701ccc8e85f049ebe169992f754a70808d416b5b6b0815adf9
MD5 b442dead60c035c9f5b2e904b4588bb8
SHA1 a50fe41e070f6b647436da7d1f47a06e9678c72f
SHA512 d5bd0fe56fd42a6cc7109f943a0fb486420e58f7c25493c5e5abe77ca5ce80b6a992bc4084df21efea2976cc0c8246fa75fd94ea7cad6e0598b4134ff1cd1191
SSDEEP 192:sxZURPyMqZjK1Ml8MFj/fKs8BKTGkwVzodpEa/W6+WNGY0hfMngIgj+TJ:sxZUwdj/fKs8BUHL/bG5lj+F
TLSH
T11362E8056A349977CCDBD209FA45BF93D2F9557391944E48AAFCDA0C00E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0828296c6b57e5426cbf26843fd8ce80c5febb5c36f1e8fc33db6a5b6fb8adb4
MD5 fb6f033e4741e3efaf1e1461c67f8e03
SHA1 9358185ce23c424e445f8932ab17b4fc59eb02f9
SHA512 698971a5781f8547dcf344844446aa4b2f802337eb131268da3ef6b0c5826ca0fe11451d089c045fa51203ba48314eecc73cd0df5851ed4945577e23e2e273a1
SSDEEP 192:sxZURPyMqZjK1Ml8UQDFj/fKsgGKTGkwVzodpEa/W6+WNGY0hXflgIg5W+TJ:sxZUwq5j/fKsgGUHL/bG5MM+F
TLSH
T1046209456A34997BCCDBD219F645BF93D2F9557391944E48AAFCDA0C00E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 ef03690e6cd4506212e451d6e593d0f8d517c44484344c9ee99488c4f6fdd6ba
MD5 fa48b11defe8327c59f98bf39881a881
SHA1 782c558196e57f9a2d27a059322f89e62921a0da
SHA512 b82e476833b908ad88b03d11556505e54abc3662159cc174c44335f61ba012bda67b3e21e6fa099d3e51e64ee322178df11443715474bf71bc36e25b853f985b
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F57:GZLVDJjEDPV0/ZdE9a
TLSH
T16BA24A1232FA02023C7D3908939697674A41F2A37469EC7F7BA940B54E67E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a269f8e7ddc119f573b944f3d74628f6a98e3db39923bf4eb47f0790a4eda69c
MD5 e67668374dd708cf07b1d63ba3f5d34b
SHA1 c399f2d36da79c12e19edae7c2c97d6d22e7fc04
SHA512 3ee000b9290c00a2e329eac62dd45cb8da02ddbe66260829f325dda3b1e344d38d51ff259cd95d7ca82a3cce2cc1f00d8ffdabd912616ce021fdaccb6b39ccf2
SSDEEP 384:ndiF9CcmyWCs38Nf8TUNTUlIxBPm3ek32nn9rPKSuf+8GaTjKzxwI6Nje4KV8p0J:UFccps3IwgPKekmxGGYNjI8p0J
TLSH
T11DC24B32E8A4C9BBECE68FD9FB4A7507DEE04263C68C59D4DADC2D5C009719D134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d7e081ca9edec46e98fff02d72d024a7b9ef7066d0cc540d40746d9e4364f8b2
MD5 dda1ccb7d4bade0e19c18a59d8b389b5
SHA1 c325baa285040031f3bb57c88062e0b534e10352
SHA512 186e67656d098da460a9d48200217cd9a5b0b9db742e63e504163929891361a7249250bcbbfc01fb7250a52195106952c0efe40de7ac145df25ed6d65f94bc9a
SSDEEP 384:niiFgZcIh38Nz8TUNTUlIRbPm3ek32nn9qOZSuf+8GaTjKzxwIONjf5UrzKKDjtz:pFeh34wgRKekmnfGwNjSKo
TLSH
T1F6D26B71ECA4C97BADE78ED9B75A7607DEE04163C6CC2AD8E5DD2C2C009709E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9896e0d00e1af587d9ccd76105633bbbcbeda328db138c2238c8b32887a7c0d3
MD5 0321e79409684d7c768353221e03c077
SHA1 7c7b7ee0e8e6db73c63911507ce7d30464908f65
SHA512 95794c10641d1bc31e8c24420ce153c259f85a623f5708db3a02f66954ee63d1b10fde4874b313b3b3cb94bda0530dea8fa1d8cb02d0958579216a1221f2ab4b
SSDEEP 384:nOiFgZcIh38Nz8TUNTUlIRbPm3ek32nn9qOZSuf+8GaTjKzxwIONjf5UrzKKDjtz:lFeh34wgRKekmnfGwNjSKo
TLSH
T1E8D26B71ECA4C97BADE78ED9A75A7607DEE04163C6CC2AD8E5DC2C2C009709E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d9eada676d926bfa5c84d0df660381622ae7562a80cc2ad2569bd58e493a09e3
MD5 1f29682c31f1dc4e356135286395d909
SHA1 cc990876e0770ac6afa948de2f6ba5775e59f43f
SHA512 e5d4826b5693f1c793ea437943f72fdd7b042328331d594b23d5a7e5d6f4a54c1ad44db5c0f91163cd880d2c2fa948170a7911dd2a22e84dcca978298825edf9
SSDEEP 384:niiF9CcmyWCa38Nz8TUNTUlIRlPm3ek32nn9XOZSuf+8GaTjKzxwIxNj5FFty/7i:pFccpa34wgDKekmcfGXNjD
TLSH
T171B23972E8A4C9BBECE68FD9F70A7507DEE04263C68C5AD8DADD1D1C009B09D134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e488db920616e80be145f0a7db5c483727980fda884d7bdc6daf17a04cc304ad
MD5 5dd38aba3a9e916bf3e8a0bffc076cc0
SHA1 5fc70104f39a9e0d4fc21357534819a6d1e04b30
SHA512 5ad31a50764ded280da708672fbc9b10298ea102943cfb46850ce84dc6f7f13f079fe15224e7d9f88e96081693055f6ba4dc579710c5199bc837c981e5dbb042
SSDEEP 384:ngiFgZcIA38Nz8TUNTUlIRbPm3ek32nn9qOZSuf+8GaTjKzxwI3hNjf5UrzKKDjF:7FeA34wgRKekmnfGRhNjSKo
TLSH
T1AFD26C71ECA4C97BADE78ED9B75A7607DEE04163C6CC2AD8E5DC2C2D009709E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1e6df61b18d66b0a5db95c7937fb060675bd66e9264b6cb41d32ce60234ec952
MD5 c77ec89e083b94a613fa92c7659e0821
SHA1 70d90fa13204cec8f4f5995d3db7fb661035aef4
SHA512 4f1c7cfcb7760b8f43c0b4f825203779feb7cb865d9d2b8cfd94f1a3a93fa68d3df17f1650145e44d68786a229bd52e9fd6f81e37ebfa351bcf6b1c443146ee2
SSDEEP 384:niiF9CcmyWCs38Nvb8TUNTUlIxBPm3ek32nn9BPQQsSuf+8GaTjKzx6Ie4KV8p0J:pFccps3GbwgPKekmHzYGMII8p0J
TLSH
T1FDB26B31ECA4C9BBECE64F99FB0A7A07DEE01263859C5DD8DAD81D1D009719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5460-201-0x0000023080000000-0x0000023081000000-memory.dmp

Download