99a6c45fd27ece1503286dc2c8e5f62b261522c274be3b0253ffa5d41a5e784a

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_repair.html
Size 35KB
Sample260804-h473eahr9s
SHA256 99a6c45fd27ece1503286dc2c8e5f62b261522c274be3b0253ffa5d41a5e784a
MD5 d6ed938ef3a0e92cd72aa18fc37dac73
SHA1 ad8d80ce73a36cf0632f74c6ad61e2d9cbe0998b
SHA512 869331ebe20ff3822b6fba201bddaa0fb9f4c83d944acd0920b993236974453bc4ed07c05a16135cf5cfbb8cb3770f9c0637da1ebdb706439db7d03544aa105f
SSDEEP 768:M5RHm8JxazzHqrqsPoHKOBbK6KfjhIEY7hHMx/Y:M5RHm8JxiHSoDbjc1IzHMx/Y
TLSH
T1A6F2F823FDA5913602678189F7B7A709F2315047CA04CA14F5FC82AA6FDAE42CC579ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3200	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303015223681708"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{6510A8BF-4C92-4A8E-B93D-AD01A2734657}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2400	3124	msedge.exe	88
PID 3124 wrote to memory of 4912	3124	msedge.exe	90
PID 3124 wrote to memory of 3200	3124	msedge.exe	91
PID 3124 wrote to memory of 4912	3124	msedge.exe	90
PID 3124 wrote to memory of 4912	3124	msedge.exe	90
PID 3124 wrote to memory of 2736	3124	msedge.exe	92
PID 3124 wrote to memory of 2736	3124	msedge.exe	92
PID 3124 wrote to memory of 3476	3124	msedge.exe	93
PID 3124 wrote to memory of 1988	3124	msedge.exe	94
PID 3124 wrote to memory of 1988	3124	msedge.exe	94
PID 3124 wrote to memory of 1988	3124	msedge.exe	94
PID 3124 wrote to memory of 3476	3124	msedge.exe	93
PID 3124 wrote to memory of 3476	3124	msedge.exe	93
PID 3124 wrote to memory of 124	3124	msedge.exe	95
PID 3124 wrote to memory of 124	3124	msedge.exe	95
PID 3124 wrote to memory of 124	3124	msedge.exe	95
PID 3124 wrote to memory of 240	3124	msedge.exe	96
PID 3124 wrote to memory of 240	3124	msedge.exe	96
PID 3124 wrote to memory of 240	3124	msedge.exe	96
PID 3124 wrote to memory of 764	3124	msedge.exe	99
PID 3124 wrote to memory of 764	3124	msedge.exe	99
PID 3124 wrote to memory of 1840	3124	msedge.exe	100
PID 3124 wrote to memory of 1840	3124	msedge.exe	100
PID 3124 wrote to memory of 4756	3124	msedge.exe	102
PID 3124 wrote to memory of 3920	3124	msedge.exe	106
PID 3124 wrote to memory of 5348	3124	msedge.exe	107
PID 3124 wrote to memory of 3296	3124	msedge.exe	108
PID 3124 wrote to memory of 3644	3124	msedge.exe	109
PID 3124 wrote to memory of 3644	3124	msedge.exe	109
PID 3124 wrote to memory of 3644	3124	msedge.exe	109
PID 3124 wrote to memory of 1868	3124	msedge.exe	110
PID 3124 wrote to memory of 1868	3124	msedge.exe	110
PID 3124 wrote to memory of 4432	3124	msedge.exe	112
PID 3124 wrote to memory of 4432	3124	msedge.exe	112
PID 3124 wrote to memory of 5552	3124	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_repair.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ff96523c188,0x7ff96523c194,0x7ff96523c1a0
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,18044138703247280962,6195767579489600766,262144 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12151822890873225624,13957535194269172936,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13461056291571621260,16495465007587798794,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,10688391700999085046,5540060145592691148,2097152 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,10627159220149542821,16508867636945703658,2097152 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,15333864817517611439,8796234832220766935,2097152 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,5293285853020477007,14102070122927904890,2097152 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11363933483191473216,10073300183271145214,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7595596806527047699,16220907344995357445,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7984132697435401105,3977098695422486486,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7984132697435401105,3977098695422486486,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,4792879967770351322,14291165211459215075,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,7864183787979696207,16307487505579831153,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10105414845728710174,315309707017427196,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2460,i,5203965055590616624,17337696355566848450,2097152 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,801622776403560359,7814335859990964028,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,15621089936532864872,12708216270363248850,524288 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6480,i,16799482155192410684,9276210436593550091,262144 --field-trial-handle=2364,i,14781024063539407684,684182894822112786,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7eaa15da-7cf4-466d-8b4f-557c12075422.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7eaa15da-7cf4-466d-8b4f-557c12075422.tmp
Size 35KB
SHA256 a025a43d8506eecef13555e7954570f22108f1c9f076d3e4d394d52c754356bc
MD5 48438c2f22b87bb102ff081df857e1f1
SHA1 501515b9190632c1f49f699cd828cf3031918911
SHA512 6e6c88a41d9d87bcd21b0bf57c2c06a570925269af59af9809e1f3e7714285940b21364ebd49777f34bbd4a3ad2c050d5ae40a3a5a2c0e06b82a3a936c6b0279
SSDEEP 768:v832/iSZOb+DIVCp8+p3bd66j+4BRv86aLIWTQojKgqmUbz:v832aS8c2c8+p3Z6n4y9QfgRU3
TLSH
T11BF2AE31E8A9DA779CF6D688B28637436FF45063A6C05ED4E4DC7B0E00561AD630B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 098ca82272e60187a6e0b5377a4c82e8f891910479f1e68b249e3ba77689b665
MD5 dcf6030ead03ca768d894bbde4c5e3d9
SHA1 812dc34f339cdccdf32ccc9a1835e26aac5bdaad
SHA512 28b5d1875854a9692fad99a21354e433aaa862fcadba8ba6b2f4afd0a8364a39a8f4192ba52f1970771dbe83cdf12744900a16c98102c1c24e7d3f961e8334ba
TLSH
T10E41B81CA36A06E2D7F585B72AE1925433F1D83D810BAF6110409DFC8AE6F4820F693B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d1fff5f43307e45764f494f72b6910c8c3402a55b022fd2de43e1a841c88840c
MD5 a2bfd430099bec985fd5d22afd6c0ab7
SHA1 89bb7443a6a477977e105607b40e317fe4eee9da
SHA512 ae717952ea4de30f142a361c0beb29e2139061ef40b1d53680a189cf5f5b2f01ab703af6254987f071046465b707c8758e5a88a4f21b3db7d8f9ddcfe64a8a49
SSDEEP 48:YALlNgOgpgqgbsJzaAsJ31foKsJrfgmgCZsJ3fjhhnONzsdO9zsdOdzsds8ZxJzF:DyOYZha91WiNjh27R8Zdz1LZk4xxwUx
TLSH
T16291DFF7C7E8867E890156F0AB257E2BCD1D095A432C3C5688E4AF1F63E24B1D24169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b27a6e284f0ccc887dea6de6b0744015e0cc836596b21d6a45657abc08fa2bda
MD5 88a5c0a8434c984bb6360e5b198ddfce
SHA1 6cd2f04a704500f727d88e943258c533b74bcad8
SHA512 cf1a15f6b5f372dd20f4367f937c8bf1755a33bdb032872d62084c66027185d4be6f1989a780bb2c51f148fc878ad9bc37a4b8579a4d5bccd25dbb19d30a8f14
SSDEEP 192:sxRHR/yM/jK1Ml8wbl/fbsNiDde5lSszoD8p4//g6+WNIYCy+OjGhIgD/J:sxRHLll/fbsNic5ld2/5ImQF
TLSH
T11D62D805AA345D7B8CDBD20DFA517F53D6F91573A2901E44AAFC9A1C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 85f8fda713239af95779730966f6043d9ed84e3785b9039df63fb09e90c8c5ed
MD5 f0b875cc76185ba28e886b801b33f4b3
SHA1 320d01976459de929a1e4ad81def27ddcd4800b4
SHA512 c20b99c11001bf8c595ca67f54b850312f2227fb63ea45852bf4afcbbc908faa77d97754398daae8a8025b5555360d1dad30a713f3dd7c705c32dcc0f97f39f1
SSDEEP 192:sxRHR/yM/jK1Ml8UQBbl/fbsNIDde5lSkzoD8pex/g6+WNIYCp+OjGhIgDhJ:sxRHFqpl/fbsNIc5l/+/5I5Q/
TLSH
T16262D8159A349D7B8CDBD20DBA917F53D2F55573A2901E04AAFCDA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 76e3e7be75cbded61f68848718b2bc764a3dc20fd86a3b3e1fa5bb471467076f
MD5 39c5c4778368592a70fa6bdc3afccd85
SHA1 27351076e686494db179f2370209b64c1771843f
SHA512 fdc782103a18b6e9e024261e9406e5786b047b062b8d30cc5b0ea6e37080eac437307b4f42e517eed0b58c9f88ca3505a2ed3aa052c54c324f5ff6372549a3b5
SSDEEP 192:sxRER/yM/jK1Ml8wbl/fbs4iDde5lSszoD8p4//g6+WNIYCy+OjGhIgIJ:sxRELll/fbs4ic5ld2/5ImQs
TLSH
T1DA52D8055A385D7BCCDBD20DFA517F53D6F91573A2901E44AAFC9A0C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7ea16c01376b3c1ae78b3ac6276c752b4293d63fe2a0d9f5001a80eaedb585bd
MD5 99edba8fd6b52d6fd1cb48fcc67a024f
SHA1 b95e961275c694782ef9fce1e33f06d06be1c2d0
SHA512 26aacb926d064f65b244ab78ba49c01fc6b8e03502b451b7bdf9241e538b5cdfc7ffe29ef159649e89576f2e778911ee8c6f028194f7671fb652380dbae71a9f
SSDEEP 192:sxRHR/yM/jK1Ml8wbl/fbsNIDde5lSkzoD8p4x/g6+WNIYCp+OjGhIgDhJ:sxRHFll/fbsNIc5l/A/5I5Q/
TLSH
T12762D8056A349D7B8CDBD20DBA417F53D6F95573A2901E04AAFCDA0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 845ec6cd1c4bc80d21efe499bc7efeb64c86e32ce173e6e04c1a22e12bbc0ddb
MD5 72d4b38bed937581fd7156a0fb1fa436
SHA1 7914a8947bdf6ecd97934699a5933dc3b5f2ac55
SHA512 3f1b2fbeb38cd33399ffd18ba1c0bb9e6880e0901edf62e1d5ff3d405c63f3ae232607fdca4861b33603ef7915b4404dd8779b034292d64d2942707d31df4850
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqtrovy:j/8vrQWgQ+fB+u1ja3VqGK
TLSH
T1D5C2EC2B640CCB7E4F844EADEC29BED66DD801CF57588D5447EA890C03CA7EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6f9283703e5c1fdc3e58b458c1e7f743de815248f0faae43c076249988394363
MD5 ef49ef3d664db1b80fe71ad6d7629ce6
SHA1 6389d3c963982abf44efeb460f44175c0865a11c
SHA512 a2509d6084ef00103be60fea1e567fe5b1cc6b7d0fde997dd4741017551ae37dadbed84b23a9342949bbf3426a519d9c67d56f398c7000aecf90f8eb43c22ca2
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHQCQHQuQCQ0QUQEQCWQMQZQxgQyQCK4Qn7:CbEBVj5JAdSp9/EgTK7j6dJOHQCQHQuc
TLSH
T165914845307A0250387E6A0D84798C2E96C274733715F92B7BE846571F6BE43ADFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a06f6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a06f6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2fd8fe6d8da9b065a23365bc2a3bec69a357ab85288db4e2c19ed26c0a89201c
MD5 97ed81c50bf69114ca85d0d72a64e89b
SHA1 2fd97d16bdecf6243436a0146287447a46006d99
SHA512 ac4250bbb08e808f85c1f4ff853efb5886f5f614009424d989e55008864801480790ac49d9665d881da7fd0b0fafb385ad9e3a3b77b4b9886e7da0faabaa7a22
SSDEEP 768:Grv+4UNbdb3H/iSGOb+DIVCp8+p3bd66j+4BRv86aLIWTQM:GbsbN3HaSPc2c8+p3Z6n4y9QM
TLSH
T16403BF32F8A9DD739CF6C644B1463A437FB8516396C11EE4E4DD7B4E019A1AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5f578cd56394916b32b5faab5ad3978ac0808559c770958f0adf34650724cc91
MD5 f9a5ebfa7e2703ff10feefe722a389e7
SHA1 1f2adeffb9c327ea7ccfec178a96cbe2d0d9c7b9
SHA512 de49e996b215a832da9430d647ce9fdbf129d524e25bce3873111c06c9ad54e9fa0d854dcdc9d8d5a13121ed22cc3e19a6e0c41a3a806c91293f8a0e5904d084
SSDEEP 768:a83D/iSZOb+DIVCp8+p3bd66j+4BRv86aLIWTQojKgqmUbz:a83DaS8c2c8+p3Z6n4y9QfgRU3
TLSH
T10FF2AE31E8A9DA779CF6D688B28637436FF45463A6C05ED4E4DC7B0E00561AD630B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6c25207c617c4e98787b77e24fc9f486da5d9914d25cf17ab2e41bdf7c8fe86a
MD5 5095549dfa825874791b56955eb4196a
SHA1 c60dacd7969f8977fc8600a40b495a74f62a1582
SHA512 b007e3d2f0202ac3ad23a45b6ec54d562abeaab51714e341bedaf54fcd42a7a60f246908e718119c9d370bd8e96c4f1034c177b9954b7bbbb3ef0a9067878592
SSDEEP 768:rFQG3vwgG/iSZOb+DIxp8+p3bd66j+4BRv86aLIWTQojKgqmUbz:+G3EaS8cc8+p3Z6n4y9QfgRU3
TLSH
T12C039E72D894DA7B9CFADB88B6863743AEF54063D5D0AEE4E5DC7E0D005709D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 81f2110ba6045d5580ce35f9b73488fcfc495787c6d189fda40f429bced4c526
MD5 6aeac0a6c8b8c51de04e331b4dc30876
SHA1 fa8be716ddd51ed8573c6a00abd1e8821afcae44
SHA512 9bbdeeed0cd87172a8eca4038989fc84fa7c500377daa163e3ca36623e9bc34b86bd3f9f892555e218c4f735346ee47e5cffc3289ace102673a9d03b72c8de43
SSDEEP 768:Irv+4UNbdD3Dcb+NNp8+p3bd66j+4BRv86aLIiG2bwCl1:Ibsbp3EML8+p3Z6n4yQ0ww
TLSH
T14703CF33E9A899739CF6C648B2467B437FF851A396C10EC0E4DD2B4E415A19E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d731c22-4196-407f-a724-c7e102fdd83a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d731c22-4196-407f-a724-c7e102fdd83a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download