a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 14.5MB
Sample260815-c3eftadp2x
SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
MD5 b5e57572cfb5efa08f55f46772a42ded
SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
TLSH
T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1736	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312351711361730"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{7A1A1A55-6818-43AD-8F52-5EE9923C1E72}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 5064	2092	msedge.exe	79
PID 2092 wrote to memory of 2132	2092	msedge.exe	81
PID 2092 wrote to memory of 1736	2092	msedge.exe	80
PID 2092 wrote to memory of 2132	2092	msedge.exe	81
PID 2092 wrote to memory of 2132	2092	msedge.exe	81
PID 2092 wrote to memory of 2576	2092	msedge.exe	82
PID 2092 wrote to memory of 2576	2092	msedge.exe	82
PID 2092 wrote to memory of 1600	2092	msedge.exe	83
PID 2092 wrote to memory of 1600	2092	msedge.exe	83
PID 2092 wrote to memory of 1600	2092	msedge.exe	83
PID 2092 wrote to memory of 2012	2092	msedge.exe	84
PID 2092 wrote to memory of 2012	2092	msedge.exe	84
PID 2092 wrote to memory of 2012	2092	msedge.exe	84
PID 2092 wrote to memory of 1164	2092	msedge.exe	87
PID 2092 wrote to memory of 2344	2092	msedge.exe	88
PID 2092 wrote to memory of 2832	2092	msedge.exe	89
PID 2092 wrote to memory of 1164	2092	msedge.exe	87
PID 2092 wrote to memory of 1164	2092	msedge.exe	87
PID 2092 wrote to memory of 4156	2092	msedge.exe	90
PID 2092 wrote to memory of 2344	2092	msedge.exe	88
PID 2092 wrote to memory of 2344	2092	msedge.exe	88
PID 2092 wrote to memory of 2832	2092	msedge.exe	89
PID 2092 wrote to memory of 2832	2092	msedge.exe	89
PID 2092 wrote to memory of 4156	2092	msedge.exe	90
PID 2092 wrote to memory of 4156	2092	msedge.exe	90
PID 2092 wrote to memory of 4688	2092	msedge.exe	92
PID 2092 wrote to memory of 2440	2092	msedge.exe	93
PID 2092 wrote to memory of 4688	2092	msedge.exe	92
PID 2092 wrote to memory of 2440	2092	msedge.exe	93
PID 2092 wrote to memory of 4304	2092	msedge.exe	94
PID 4304 wrote to memory of 4824	4304	msedge.exe	95
PID 2092 wrote to memory of 4444	2092	msedge.exe	97
PID 2092 wrote to memory of 3216	2092	msedge.exe	98
PID 2092 wrote to memory of 1988	2092	msedge.exe	99
PID 2092 wrote to memory of 1520	2092	msedge.exe	100
PID 2092 wrote to memory of 3824	2092	msedge.exe	101
PID 2092 wrote to memory of 3824	2092	msedge.exe	101
PID 2092 wrote to memory of 3464	2092	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa7ea7c188,0x7ffa7ea7c194,0x7ffa7ea7c1a0
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,17848081270929291504,7613223725020858788,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,5734673865196315497,6824384789272900656,262144 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,6143492999036869786,6342480696588716501,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2373866469213578177,8536736446448350813,2097152 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2203814740517609668,17327478974252976343,2097152 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,11338827700288051724,5105102649394578653,2097152 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,6818518729401073759,16651341310518885624,2097152 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,1538528925856444039,1679821139610790704,2097152 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4308,i,6154972665322749830,5653898770875152101,2097152 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,3925587469594903833,18351515051476932501,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,12426934662900449246,12178140364974125992,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17148093252391250005,15240340720545719040,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3304816988859989074,4269301806343979537,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3304816988859989074,4269301806343979537,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5965554499123811372,12252427332337436253,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,122911035059427523,12582025021887374923,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,7811594025663204760,3388587147589295643,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,7384752479445561439,17271827243431214765,524288 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:14
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,15077244168577159297,4886644912949577312,262144 --field-trial-handle=2052,i,5826980073286510656,2193878086483317580,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a8007805e866030ddef8c0bffd6eec19b553c477bee180584b20c9c94621d55
MD5 f5400134b7975827b28654b3dcb1bdd6
SHA1 7e8ece0707d714e927405149f6d79c09a5c4d741
SHA512 1a774a2d3347b177b206cdb44ef3d8dfa5dc050dc320a393142991f46902ad3f68a035ce5a4ceb798b1663a69be306b2e14c094ed33e586d5db67c58a873f12f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a5912cefe0bbc3a2429449e273d14bc54b7e8d7f57cf2a1dacb1a58f2dd4084b
MD5 cbc189bb09f3d04936a7476671091b08
SHA1 7236c883f1a3d1839f12cb12a4a13c8f8fbd003d
SHA512 6f5c9bc688c01248c26624341f6c88884bd4f607ec6130d467e33b0908087cd2ed79b4cfb3f1fe639169a7d04e1a7edd936448041c69572874e464a6bc10b13e
TLSH
T199616D37CA92C8EFD3B2953994F30145BE3D849834734E5920A8F4B9E42AA27FC12C17
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f30.TMP
Size 3KB
SHA256 fa5fd240941e667ecf98d18224271a5437091a0ba3c57bb9b41b0ad0229b5f73
MD5 cf4cdeb2e88186e21d61bf1be3eed458
SHA1 02b847a83d6d9b46a1ca98e1755b9a946bf3b800
SHA512 341155f8ede40a36d155938650d84631eccf182b28652211ab2f219d025aa3e38fe5a357f343b8fb18c3d1170e5f86c2cbbefbfb0e839f54e20684822e13c676
TLSH
T187617E37CA92C8EFD3B2953994F30145BE3D849834734E5920A8F4B5E42AA27FC12C17
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 18b5556e35dd9866948f9ca30895e4804475a211eb68a6829f4e01689da0a0c7
MD5 0c48f37ed1b780eed28fd07c9b77fb5d
SHA1 4dc4eed225fcc07ac96870ab71d8309e55afff28
SHA512 ec7b4b820582b9645fbc871b4a656cb811eeb4cbde9b42549f24552dea85140be586dd85d7b65f5656c72c154e50c3242bc1d92f1e7bf949b0bc071275d835a6
TLSH
T1FD117DB3C3D585AEC90566F09A24AE1BCE2D0605431C7C19C9D4EF2793E3475D11259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b1d8f90aced03ba7a86fb0e0d0b1b3ff9d7fc8fc86d006cf0a1ddf8761a789ca
MD5 4751b014db4294eb9fc605446aaa9058
SHA1 c2c094935fa68c1dc4c6e9e9a39c063cb1ebc022
SHA512 8605942fa4099b5e3047124ac6a7df5d1c2cadd3130212fe48357c1a062758dbfeeee7302eacc77fb3bd9b40861b4168413450f71448437276fc689f1ef6a7e4
SSDEEP 192:sxZbREyM/jK1Ml8UQlFh/fps+zEOAFIdpEx/W6+WNGY0148TJIg5vJ:sxZb6qDh/fps+zEF2c/bG51r
TLSH
T1B552FA05AA349977CCDBE20DF545BF93D6F4447292900E44AAFCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4672dd46bf64dbf17835d6caa5c1599b9633bd504351a77482774a8763d9e083
MD5 aa4b7efb131820efe22ba918d36cc8fe
SHA1 3f8e5b440c86370beb0f541650228677c5ad9e83
SHA512 db623be7d9d6ab9493a6624bae8cb8c6986f5c25af321b3414bfea105b22a15f7f1f5f354343c7f82caeb6ff4f1dd6cb4787335fe291c5cc201863b3dc3eb32f
SSDEEP 192:sxZbREyM/jK1Ml8MFh/fpshzEaFIdpyx/W6+WNGY01ELwJIgrJ:sxZb6dh/fpshzEa2m/bG5r9
TLSH
T16052E9016B34A97BCCDBD209F945BF93D6F9547292901E44A9FCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 fa26837f1351b9e6a493fa0c080d6724ccfa853c80d53a844335a0f1c126cffd
MD5 6bdabf42500cf382a47aeed5a675afbe
SHA1 13479f165b7e8617747927d024ff09f6fdb83a04
SHA512 18bb2fd348fd6a6241d92af667dd6201ed0402e0e14c39f924ad9076a9f4b7eaf5483a09dad2ef97695eabae95a289f04aec67e52464e590d631348ca6998e00
SSDEEP 768:pG4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4T:plu+68si2y1WRmlzQqju1jaKDILpZ8Uu
TLSH
T15CE2293B280CCB7E4F844E5CEC26AF966ED802DB96684D5447FE494C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7cb60032a8730ee06ed0a50f03f442db6c5ae5959431404b96502a3b45897bc8
MD5 6e96df6d8ba54a8bd628bea7af44ad0d
SHA1 5eea643b79d68bc528f458adfc42b8c5d5d8f85b
SHA512 0996c1c7f522aae9b6140d461410df8c487dbeca84b9ae5fbdacb8c95d0fc6598d58de21d330375d4c6959912e1b3b96454d938d242bd4b04827bd92e4715a6c
SSDEEP 48:K8SI/KLq8DyZmI3K7aYby5GI/KrCgzqDQcSIG:K8SIKLqaam0K7a2KGcKrCAqDQcSIG
TLSH
T16491369272BA46013C7E291CD2648B175E4376A7301CA82F77A858B10F2BE647EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bdd52f55042863170df684940f3d8613cdfc4afa28ff22388c6830e5ceab7431
MD5 027c07cb2ce4d545ba772a52a910dc21
SHA1 cae511cb37ee61af4ce0afa3df6988b802b15685
SHA512 15bbff6d3cc3732c1ad3977c3220c07234b3de8c4648bda365cb017e375a7c8a722862f4a5cb14a02cb3b9e8feb87a048e8f8e531bb36fce89f1c1236433b171
SSDEEP 384:OdZcIX8NeLX9hIwr3b+AC8YbXE+sIOOPrXLpe8C/LB1:iXJokrpGE+1Oi9PA1
TLSH
T10EA26C72A878AD7B69E3E945F58622038FF84167E6C42F84D6DCEB0C05DA59D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d73da98d7a21d634765573f2064ef52e7ea173ab2cca86a8ffc463964513e8ac
MD5 69fd3cc7b86a1fee076f220e118a0e3f
SHA1 1c281947b58b0bb69fda2c10bb2ba38f272fcbd3
SHA512 fe9565ccd9c155518edac03675573f08a76490d0a4834d80836a9f46cadc8cfca5b0db4e13017e56026ab334f267c95d1d00a37ef8eaf0cd427fe7f04710eb11
SSDEEP 384:PZcIL8Ne8X9hIwr3b+AC8YbXEVsIOOPrXLpe8C/LB1:HLUokrpGEV1Oi9PA1
TLSH
T11D926C72A878AD7B6DE3E945F58622038FF84167E6C42F84D5ECEB0C05DA59D130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 55d0b2be956f754e3a02c90b45041839e19b7127f0d53bad42f3fa7114ca9941
MD5 e4b474f409b89b1f8571152ee7d6e284
SHA1 d3e93c8d264f2cef70060f4bb1b68195b573ac48
SHA512 8a91fe9517b12d4b3edec58469e60abbc28bacb66a9842de859f419c6df566c7459c927757a875db0d3fc7f1355d9e9bccc5a03a7d09faae004222ca7a651278
SSDEEP 384:RZcIL8NeLX9hIwr3b+AC8YbXEVsIOOPrXLpe8C/LB1:5LJokrpGEV1Oi9PA1
TLSH
T157926C72A878AD7B6DE3E945F58622038FF84167E6C42F84D5ECEB0C05DA59D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e112ff92acb5b358dcecbe2fe79db714303b5a692798a66b2d906ea7fd9eb30d
MD5 d8eaa3be4d29d31d28f2eb5310ce6944
SHA1 695e69cd4cdedc9e8c6f8e95053b0276554f34f2
SHA512 7fdfbc9af14fb19a59eee411c1f7d3ea9ddbd3737ec4212ad4b841670d31c428d63b455ebeac96751078e60ab257fd5ca7df401ff8ddba907ffe0c72e0f7b712
SSDEEP 384:eZcIL8NewX9hIwr3b+AC8YbXEVsIOOPrXLpe8C/LB1:cL0okrpGEV1Oi9PA1
TLSH
T162926C72A878AD7B6DE3E945F49622038FF84167F6C42F84D5ECEB0C05DA59D130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e97c51640550e803f9e59fd973a4cac3d0875c4baba7b404d2f64ebc1b52aaf
MD5 0b54f5f3154e8d148569dcebce09b8ed
SHA1 1b0233857eba311eb681890681d8548f0c568a5b
SHA512 999aa68747a02a84535771bd7e663a3d7382011cdc1e8082b2f1e17735dfea5e8dc952527ee0060e43d70bde42609ca5eb2c6d8f2ea4476d09cefee43dac5bda
SSDEEP 192:nRGN/6yMQmiUy5Jm71Y3b+jcejzorrsfRNMnA3U6:RGN/6x241Y3b+AC8Y6SU6
TLSH
T11C02E935AC686C7B9FF3AE49B58737139FE4102BE5952F84DAE81F1C00D725C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9eae3475f2bdd706f3382ff1c73636c1d81128f4b6ca4ab5f818dadfc4cfd907
MD5 a43d63bc4aa159615d63c59796376a5e
SHA1 6b8c274590d517af083b698cda539231ef2a2bc8
SHA512 030daec7cb1f5db6f96c29bca3517a9f018e035015a25d31c3860406e81691aa57df4f3f81c013031237c1b6ee7882f3577250d81a6bf3d474efeb2f9b4232b3
SSDEEP 192:AGNf6yEQmiUyX07wY3b+jcejzorrsfR9XEX/4MsgqmU6:AGNf6B9wY3b+AC8YbXEdsIU6
TLSH
T17312E9326868AC7B5EE2A944B44732038FE5012BEA897F84D6EC6B1C05DF65C530E867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

599cc84d-844c-4f57-a00b-e74956ad7fad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\599cc84d-844c-4f57-a00b-e74956ad7fad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download