e29263ea5eafddbc69c9b50aba5385cc93f7fcb5f71ca11c39eb1ee6ffe25d73

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_repair.html
Size 35KB
Sample260715-gymc3sf14t
SHA256 e29263ea5eafddbc69c9b50aba5385cc93f7fcb5f71ca11c39eb1ee6ffe25d73
MD5 80775d352ab6a75c9787c943e0cdafcd
SHA1 e94e32a1feee5819b75b24f74bcd16489ea59e7a
SHA512 a9daa14e95ca6ed44c706478b8bed9099be20460b5e4ed149968f34a0d82b44745aa5edb0d976ce440b2f174d3dc4c8e5a535165dfec8b2e16a0e7b44d418434
SSDEEP 768:M5RHm8MxagzHqrqsSodKUBbK6KfjhIEY7Zx/33:M5RHm8MxDHboLbjc1IHx/33
TLSH
T124F2F932FDA5913602678189F7B7A709F2314047CA04CA10F5FC866A6FDAE42CC579EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285695801092373"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B522F59C-2D6A-4C68-B44D-690A39E3DC6D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 5020	1236	msedge.exe	86
PID 1236 wrote to memory of 4484	1236	msedge.exe	87
PID 1236 wrote to memory of 4332	1236	msedge.exe	88
PID 1236 wrote to memory of 4332	1236	msedge.exe	88
PID 1236 wrote to memory of 4332	1236	msedge.exe	88
PID 1236 wrote to memory of 3032	1236	msedge.exe	89
PID 1236 wrote to memory of 3032	1236	msedge.exe	89
PID 1236 wrote to memory of 2848	1236	msedge.exe	90
PID 1236 wrote to memory of 2848	1236	msedge.exe	90
PID 1236 wrote to memory of 2848	1236	msedge.exe	90
PID 1236 wrote to memory of 3364	1236	msedge.exe	91
PID 1236 wrote to memory of 3364	1236	msedge.exe	91
PID 1236 wrote to memory of 3364	1236	msedge.exe	91
PID 1236 wrote to memory of 1072	1236	msedge.exe	92
PID 1236 wrote to memory of 1072	1236	msedge.exe	92
PID 1236 wrote to memory of 1072	1236	msedge.exe	92
PID 1236 wrote to memory of 4464	1236	msedge.exe	93
PID 1236 wrote to memory of 4464	1236	msedge.exe	93
PID 1236 wrote to memory of 4464	1236	msedge.exe	93
PID 1236 wrote to memory of 4944	1236	msedge.exe	99
PID 1236 wrote to memory of 4468	1236	msedge.exe	100
PID 1236 wrote to memory of 4944	1236	msedge.exe	99
PID 1236 wrote to memory of 4468	1236	msedge.exe	100
PID 1236 wrote to memory of 3448	1236	msedge.exe	102
PID 1236 wrote to memory of 3388	1236	msedge.exe	111
PID 1236 wrote to memory of 896	1236	msedge.exe	112
PID 1236 wrote to memory of 1520	1236	msedge.exe	113
PID 1236 wrote to memory of 1128	1236	msedge.exe	114
PID 1236 wrote to memory of 1128	1236	msedge.exe	114
PID 1236 wrote to memory of 1128	1236	msedge.exe	114
PID 1236 wrote to memory of 4944	1236	msedge.exe	126
PID 1236 wrote to memory of 4944	1236	msedge.exe	126
PID 1236 wrote to memory of 3624	1236	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_repair.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff4e9ec188,0x7fff4e9ec194,0x7fff4e9ec1a0
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,3430506790715611696,17895405211034875281,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,8148347339058330665,4665683888992222546,262144 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2563177630103587507,312109967787391052,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1890500733597256397,11698997922745366307,2097152 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16352903824628109874,1460760838358589627,2097152 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,226218270550607779,13385502337697337547,2097152 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,4242612288093011389,6717083814627743494,2097152 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,11079647904749075348,14811541130163578547,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,16004071439730411635,7004985786684705393,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13270043465386711433,1697771682924527457,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13270043465386711433,1697771682924527457,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,17608800454742814964,6600771044609910577,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,8473495983719696666,1947793128032778355,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,13797747323680108015,4375109749701075669,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6196,i,10775709186468471914,1023653897331204488,2097152 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,12980319134431627546,8553579059411683541,524288 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,15705863527889284016,17172287799908806775,262144 --field-trial-handle=2220,i,10539635682086812614,10456117926892658226,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74839918f64073338c7f8484d0452eda5f9964f6844e1a3d469cd35acf1d0494
MD5 903ac559b02e6abbc42814ccb2c82af6
SHA1 af2f3b5637316251662e53d573b38343626dffd5
SHA512 65ed352ee1cdfe18e02212fae6d53c4ffcb74dda29ba575313fb51a4c3e154570f63c20758bfacd2af24362516f6cceb5a3b9a99f1ed3b8d56488b164d629889
TLSH
T1C4711A30C69204E8C7A249FC63C1834039F0C5E9FD872E60A2AC6AF86C467CC83DD138
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 31d5c5e64933e51599e75e33b72230bae78fbddbee7a639aec023833d219cc04
MD5 c27b2358501ca90dbb458bbaad37ea4d
SHA1 6f2b4fd17557dc80d7765964f2ade37585c8eca9
SHA512 5178a527c4715d066e1d1c0e965ab5fdff458484f593cb66439fd0273174e51733d1eeab9bfd984cefa9d01aff5c986dae077b8327a09f4e2ca0f69916095370
TLSH
T1B861A8B7C3D8877E881152F09A296E2BCE1D055A822C3C568DF5AF0BA3F24B1D10168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e5f8d4a0-0794-48fe-ac26-8eb13cabb423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5f8d4a0-0794-48fe-ac26-8eb13cabb423.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2a3de46f07f3c33b7f7af645bd82971f6464344ddf11ff3aa032dcb556c8b4aa
MD5 92373763f0eb11f74c9b62fc44f76cd3
SHA1 9a00de5995133ab5e60b85b1538492e87687fdc5
SHA512 47fe4f2be55ce8d234b37ea9d7fe3cb1fa41283604856149fbab149f9f0374f92acc2182ad10a91da9c0e6c8ccd8bbe62e99bf7c2dbec99b5bcbd17a6bdf39f4
SSDEEP 192:sxZQRRsyM/jK1Ml8Mkp/fhsZjdwcIdpdDHW6+WNGYzQbJt7IgrJ:sxZQR2Mp/fhsZjduNHbG39
TLSH
T16642D7166A34A97BCCCBD209FA557F53D6F45572D3900D44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f39e6badfa264b754beeeff7a137be67d09de08f2b0e7931181379bb60b03b1
MD5 7feefc9c6360f5b3283d8746e1951df0
SHA1 635c7bb1ed244b499bd3e4254bae17d1110422e1
SHA512 feb1b7042bb40074519e3beb408bc1c386415d1a023d5ecd0a9dd605c009f942005b886ca288151c606a42246f108cd5f040326c06c9ca8aabe6f74d46392ead
SSDEEP 192:sxZQRRsyM/jK1Ml8UQ1kp/fhsgj8ucIdpH2HW6+WNGYz2KGt7Ig5YAJ:sxZQRuq+p/fhsgj8oWHbGR/
TLSH
T11A52E716AA34997BCCDBD209BA857F93D6F45572D3900E44AAFCCA0C04E6BDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6b5a18ca30377cc9d6a67d1982d4f5ccf03915b148f3b0b9d44159991b45c62c
MD5 d54c570b9c5d9ad16c9234121669da2d
SHA1 df8b1b1fa851f98ce775ba7b0ab8fc96868e972d
SHA512 ee48b561b451a7f2ac480bc9e8a0bec8aaf53ba08596c112301b7349dad5414ae8de2244789d3aca64fe435d516720c821f9417899406a18d85b1a83e87899be
SSDEEP 192:sxZQRRsyM/jK1Ml8Mkp/fhsgj8ucIdpd2HW6+WNGYzRZJt7Ig5YAJ:sxZQRuMp/fhsgj8oYHbGs/
TLSH
T18652E816AA34A97BCCCBD209BA857F53D6F45572D3900E44AAFCCA0C05E6BDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f5c292566ae42949e959f544dee0edff6a1795a489e8fbffadce75ceef533e84
MD5 bd5f7bfe1435af220db2c594be5b4c74
SHA1 e00d080544f5551ad85681e96684f3868345a4f5
SHA512 1936e0268c0bbae0d0f7bc6d37c311bddb6e9a589cc202840c9f2ad82c750ca2287ab38465107dd703dd26386abcb7c4e13945eb994ba2a87cd4f6f7e45adb87
SSDEEP 768:X+W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjAroIAiGYE:X+W7kf0Wvqidau1jaa5LA3jLUE
TLSH
T14FD20B3B684CCB7E4F840E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 35b9627be1940ac8aa47f596cd6bb85fff9dffdce88488fcbcbe8448a4da30e9
MD5 8e5493f749f9a314dc496a8fe78e3016
SHA1 a1ad4337c309483a47ff2c355caba46ce6d0d0cc
SHA512 6f4c57212581932df19ce9a9770f73ce3c4119edc4c3306aeb92f568d36c7120e4fc06720bb0561dc7d3c70ede3fa9afb6b78cf53b23ab9459fe293be12cbe2f
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfrIRKsY8HydfIFKEcA4uIvKHKsi:KIbCKcfruKsY+WfmKEcPuwKHKl
TLSH
T1CB916545313B465238BF2944A296863B9E8235A37414EC6F3FB914A14F2BE110EFDCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59adf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59adf9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 88f4b8c35d37eb035cf4ca24f1ff354c6a3b5e7ce86b3b5204c1b764d585691d
MD5 269877df84d3fe68afe63b667b324945
SHA1 7ad7705dda4c46de6171a9b6b28703bff72cc8f0
SHA512 c7f9f8324707167c1a2c65757a7fe42ffb024670023212add6d6990b2dd5435c3f00ad4c35caa5f659f85ef5081cad8e64c690d8d4056fcac946424a7cf1198c
SSDEEP 192:wLsNfzQ2MyM+vBb5QQmiU1ek934aGBPKm2+FdGr5VkE8dNgqJ/U8:GsNfzVMypZbCwsotdMbuj/U8
TLSH
T1F3321B366C74AC2B5EE26141F48736139FB44177EB852F84E6EDAB0C05DF6EC231A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a1cdc62274f6a12db48b619a10db0b89b5fa3a5637174eb0d0379150c99db8cf
MD5 70725bd5c20c3b8adec129e9bd024051
SHA1 ac8f173665c1a99a481bf5312728c07ab7877bbb
SHA512 fd3780cf6a9495867af9c668c8d3830ca0cb6add5000c48e484499167f3649ea58a0fa688a1982f4dfd2b34a744e0d0a204722305aa6956ad87110ee3caebec2
SSDEEP 384:liF1tNn/s3n9SAzsNB8TUNTUlIlXVMypZbCwsotdMb/j/Scjmwzi:sF1j+9/8wgnMylsYk/j/1jni
TLSH
T15EA26B335C64992FAEA65A85F94A3617CFB441B7CAC16E94EBDCAE0C01CB2EC0317D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 010689fec701dfa6eea96a464464f19d546edc5a13fb41e1145eee2d54b54ae2
MD5 d7de50f0f870a9744e9a33f4fff2528f
SHA1 d226c8cfdf28df2192ac44bf484bf9e0bf81a20e
SHA512 2cfbb4f522f0bfc9b559fa49f5c766aa51c9ce9f2fb68a7a081eb62671a08876e85d6d0ae332eda063029d9716ae4cb2772b2a15d97700e259bf34af8c7398ac
SSDEEP 192:uzLsNfZQ2MyM+vBb5QQmiU1ek934aGBPKm2+FdGr5VkE8dNgqJ/icSa:6sNfZVMypZbCwsotdMbuj/Ka
TLSH
T1C7422B366C746D2B5EA26545F54736039FB48177EB842F84EBEDAB0C01DF2AC1317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b7ce3d87d78a943157047ffeec2866b31e62ad237ac45c9f470a9049e7b9ce14
MD5 366167d6c9dcd030028d26c2c9c68f44
SHA1 f4b2f07d211e93d7ad838364a32b01d38b09b564
SHA512 16b95b3156beea14e272729d4b8440dabb621c8f14abca87ab5ed6a3863638b9308469ba4e72bb3560222d4498add7c4e51cd536d81974389e075c977e522e02
SSDEEP 192:XONq64BvQmiUyYD4Y5GBPKm2+FdGr5VkEOWwgqJ/U6:XONq6expEYidMbMj/U6
TLSH
T1B3121A366C78AC2B5EA27541F4C736075EA44237EB856F84E7ED6B0C01EF6AC2316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 35f03bf0b08e20e6fd64a3b6d66d19d48a0f2b805c727b4577015ec14bda3ccf
MD5 c7c66590c816eb5bc1d33aaa3d067428
SHA1 891d5619a68a98b6483f464992ab55f7c6959c2c
SHA512 4901d9cdb667e8ba5c3295784479385d55209b663a68a6c4062f6f5750d2321d96b49abe31e111f43718409d2751a56b60313ed7488dcab86af530ce215c1706
SSDEEP 192:uzLsNfgQ2MyM+vBb5QQmiU1ek934aGBPKm2+FdGr5VkE8dNgqJ/ScjmqYoJXmgdO:6sNfgVMypZbCwsotdMbuj/ScjmwzO
TLSH
T1AD725D366C749C2A9EA2A145F4873653DFB89173DBC41F84EAEDAF0C01CA6EC1317916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 762ac28da91defed04076c0f5b4c17eef8a4bbc2a0a57986c1ae27b2f116ec85
MD5 905846439092bed67ad2b53825a73afb
SHA1 eac7e6ac97b8f2af624d5e6c7a0ff4c13ff6ae03
SHA512 312f54b5cbf8f49374265ee428ddd37f5ab01dfbba758d8c289aa2c5f8a2c74c9ea5371a2d45d2d490d9589c96db8204f8ef381d28f8e385aacb24ad422131a6
SSDEEP 192:MONG64BAQmiUyh14W5GBPKm2+FdGr55aDtZU6:MONG6eAS2WidMcLU6
TLSH
T1EE02F9396C796C7B9EB2AE45F48737175FE8113BE6951B44EAE85B0C00D728C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c82927ef64dcab9166c6cb833605dc3671da0c5d0dc0b657b726e840e0b195f
MD5 02da69b0d1c13c38d65937aba1c24a7e
SHA1 ff909bf2ffbb3ff488533566b40dea2f0cac0078
SHA512 2d6eb8b933b3385aba5c52ff00975e8f8fc7f2ebbd58344e9db1a41a8155dcc685f4486b99d4f031a8af5bd701930f4ca756c675d5f06b86b8c07cfea1e3d1d7
TLSH
T10E41E75CBAED1149B3B77F1AABF6A86D487BB9772F06D45E00110D4E0562E40C871B3B
MD5 SHA1 SHA512 TLSH

Submit Download