a6c17317d03b0f959c6114a625be74331dd890f562be0dec91514af4aa98ceff

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_repair.html
Size 35KB
Sample260805-ncsrasem9x
SHA256 a6c17317d03b0f959c6114a625be74331dd890f562be0dec91514af4aa98ceff
MD5 5954c0003104d1783f1732a21c2472ba
SHA1 0c2a525399738562fdb9cad7d4008f08c1e517e2
SHA512 8b13784211b05695c1df6f03928878c640c2585a36f331c4413d87803cb06ac4be5ea8313d492c213987fa14f483826ca57fb2c84356035870bf4c4461e746f1
SSDEEP 768:M5RHm8oxa3zHqrqsfoeK7BbK6KfjhIEY7Bx/Cs:M5RHm8oxKHSoHbjc1Ijx/Cs
TLSH
T185F2F832FDA5913602678189F7B7A709F2314047CA04CA14F5FC866A6FDAE42CC579ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2748	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304021400952069"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{57E08047-987D-4CA7-84E4-DCB4ADC08941}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 6072	2728	msedge.exe	89
PID 2728 wrote to memory of 2748	2728	msedge.exe	90
PID 2728 wrote to memory of 3460	2728	msedge.exe	91
PID 2728 wrote to memory of 3460	2728	msedge.exe	91
PID 2728 wrote to memory of 2516	2728	msedge.exe	92
PID 2728 wrote to memory of 2516	2728	msedge.exe	92
PID 2728 wrote to memory of 2516	2728	msedge.exe	92
PID 2728 wrote to memory of 2996	2728	msedge.exe	94
PID 2728 wrote to memory of 4820	2728	msedge.exe	95
PID 2728 wrote to memory of 2996	2728	msedge.exe	94
PID 2728 wrote to memory of 2996	2728	msedge.exe	94
PID 2728 wrote to memory of 4820	2728	msedge.exe	95
PID 2728 wrote to memory of 4820	2728	msedge.exe	95
PID 2728 wrote to memory of 2752	2728	msedge.exe	96
PID 2728 wrote to memory of 2752	2728	msedge.exe	96
PID 2728 wrote to memory of 2752	2728	msedge.exe	96
PID 2728 wrote to memory of 4452	2728	msedge.exe	97
PID 2728 wrote to memory of 4452	2728	msedge.exe	97
PID 2728 wrote to memory of 4452	2728	msedge.exe	97
PID 2728 wrote to memory of 2564	2728	msedge.exe	99
PID 2728 wrote to memory of 3620	2728	msedge.exe	100
PID 2728 wrote to memory of 2564	2728	msedge.exe	99
PID 2728 wrote to memory of 3620	2728	msedge.exe	100
PID 2728 wrote to memory of 3180	2728	msedge.exe	102
PID 2728 wrote to memory of 2188	2728	msedge.exe	106
PID 2728 wrote to memory of 1448	2728	msedge.exe	107
PID 2728 wrote to memory of 6024	2728	msedge.exe	108
PID 2728 wrote to memory of 2572	2728	msedge.exe	109
PID 2728 wrote to memory of 2572	2728	msedge.exe	109
PID 2728 wrote to memory of 2572	2728	msedge.exe	109
PID 2728 wrote to memory of 3124	2728	msedge.exe	110
PID 2728 wrote to memory of 3124	2728	msedge.exe	110
PID 2728 wrote to memory of 4452	2728	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_repair.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7fffa3eec188,0x7fffa3eec194,0x7fffa3eec1a0
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,12939030682491169546,4278425885080136998,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,15993272133493298568,5129361460361018258,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,7862255149173676575,15314091350359258403,262144 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,6695060484813799646,3720820642820274701,2097152 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,6487874690445068955,6622616264639046473,2097152 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4700674217563888959,8267355428584667974,2097152 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,6542774869615763155,13728241243751116431,2097152 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,15527407879973080210,4151931818561065648,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8604236264266352320,17420053534713321168,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,15011568832994318285,4674901084716706455,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,15011568832994318285,4674901084716706455,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,16916069790770832537,4461149811233924123,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,9056942534071429988,14868869863370680688,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6488782639167614129,10330085575421509518,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3804,i,6102591412260285195,16477627801397302675,2097152 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,6459017390410187485,632355577897580039,524288 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3584,i,11401794603420416703,368298487462505584,262144 --field-trial-handle=1944,i,5771524327397837327,9830240564159744419,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9a9d77d58ed3b6f55be9e23ea6c230e176d768b32511fbcef0733ebfbdca4718
MD5 d383ec3476d49c964615cf1f45c70911
SHA1 fb31d81a33db2d6695f6453771de8ccb46a626ca
SHA512 a9e14bf2d3ff98dd73c931d4fe852d7367cd024105aec0492231b9d241b7ebcff2b776d89ac7b4dc610fdb3174e5cf6d7ab07e7d38f0b60852fa67a67a2df3ef
TLSH
T1FD411E5303E73AD2E7A1AAB113EC465C33F0C079291B9F21C36B1D74AA12FA850D14D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59618f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59618f.TMP
Size 2KB
SHA256 162f9a2f4efa1b829ae289475f2d69b5b21b1c48fd9c9664a30c5cfe3a9b6128
MD5 ab03d3a03d38067aad5979ea9a7d7244
SHA1 a2700fe8f2cd690523923db506754e9a8735b8ff
SHA512 c84e409555bd37881c6cd0fe94694e93e12ae85f03bcee36d4e7362af44187a719ad5b1b4f26513a81bc045cab768c792179082258d24a341f38274f07388b9c
TLSH
T1E841FE5303E73AD2E7A1AAB113EC465D33F0D0B9291B9F21C36B1D75AA16FA850D14D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 aeebbb994dd4f3957dacc71d662185490b59f981fe026ffe74f0c4cf10dabd3d
MD5 77e2e48adf8dcd7bbee873b871d7f5dc
SHA1 a964d30ff1b747191288054ffefad8379f21ea25
SHA512 2554a03a3a3ca176b8f2540c36842503b3ccf36fd4e46ad90980167607c73cb391b39a33b469435e2cc4d622bf166d01e842e62a16653749261bf3edbd7ac1e8
SSDEEP 48:YALlgANVOg6vg8sJ1GaAsJEfoKsJBgmgCCZxJzsf9zsrzEsTdzsF6sN3s/TC7ZFl:DJbO17aKIiZZ2kz/GfuGZG6RxxKOwQ
TLSH
T116919BF7C3E8877E881256F0AB256E1ACD1D095A422C3C5688E5AF1F63F24B1E14169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 102ba80b66b044ea57d7e59b0d42174be590137243e6e147607de2afa032c9c5
MD5 9016672cbdec6b4f11167409aa8e2e56
SHA1 719e4976167062adf24bfa88e2a7181ca839e7da
SHA512 d55b4f35837524b1629b7efbae2e2789125b75cd6bc3f0ce2d4baba09e160f25713f415d90f4c051932b7a12886d4c94a87add400147cd689e95236d3e271ff8
SSDEEP 192:sxRPRPbK/fks1Jpq1z+PFzoD8p47/g6+WNIYGpkqG2IgD3J:sxRPxK/fks1J4iPx2/5IgwN
TLSH
T10342D7166928A93B9CCBE20DFB55BF53E2F9503361952E18A7FC970C05E76DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e7ac67073a0ca347905aeb8115fc68b3afce7f0e0f537a12b8be8fb5a848ac6e
MD5 a9be0ae43ab0eec0861b1d0321b3b2fd
SHA1 d5b59ba35275f24d788743403fd2c399e4eaded3
SHA512 5d1ad8c2251b98fe8155e8931217210d21292a6eb73e896439133dc0073cc7bb7fb6037855540af052ac81d9abc7ab6d0b67e1ee7a0e9f440f60f32bdf99ff40
SSDEEP 192:sxRoRPbK/fkszwpq1z+OFzoD8p4g/g6+WNIYGlkkqG2IgIJ:sxRoxK/fkszw4iOxp/5Itws
TLSH
T10C32B7166A28A93B9CCBE20DFB557F53D2FD503261D42E18A7FC970C04EA6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f0fc727a992a38a306134cbfcbc3041dbed04014c66f498040b7eb6b93d92e87
MD5 f2392959c6c2bfaa7b4e3a807aa52f59
SHA1 12af789e6ccff5f4e2c7a72483e977d78b861c7a
SHA512 adef5cc5a15582ea404158bb39ec549a877f7c1da495a7bb13ebe1d84111f0f014f2083e7ee5e51c672a3a9b9f0d256ab111808fcf8135cd5e746945548e4383
SSDEEP 192:sxRPRPbK/fks1wpq1z+OFzoD8p4g/g6+WNIYGlkkqG2IgDhJ:sxRPxK/fks1w4iOxp/5Itwf
TLSH
T1BD32C7166A28A93B9CCBD20DFB557F53D2FD503260D42E18A7FC970C04EA6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b2568cfd79bf73ad07c49afe4ddf35a8682e11eada18c536cd8c7d11c2bc5f6b
MD5 8c4e16db20a744d8e6064fc41d003961
SHA1 e69f446b74a9563c1d882105d41380a0a12e7990
SHA512 7e32271a3870b47162358ec1f12563690db79caa36d1c12b87e7b68aa70e30caf135d869da914f8a73834d1de7e3d6917efc0d017c40524c7658d8ecc54eceab
SSDEEP 384:US5Yi0hfCtgvZFfxJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDT9NHRIsrowJ2:UQYi0NWgv7fxJ8F1+UoAYDCx9Tuqh0Vr
TLSH
T1F7B2EB3B600CCB7E9F800AAD9C197FDB7D9802C796589D4047FE994C02C77FA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9334ecc4cfdce4fed2f21e7402648750b8c98bcef9b6f94ce354108407d402c2
MD5 c84ad82fdc203c6e6dbe3eb5e8404508
SHA1 9b310edd31bbbd89031d8c661f66727d1fc4a90c
SHA512 b174a42199b93c5a36400a910eb305f68ac0d9c9cde361c6d11cb02c9835a891b8a18f3d95ffd53eb50fa9ce2861eb802d4a886a5336a07d1e843efeab29c2bb
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkfItpfd9xWJmsgRxK44g/DcJh8fnAHcoBw1xv:Cm7KmgIIJ4tWGm7g09OGlkfItpfd9cJu
TLSH
T1BF91F316327E02503CBE791C94B5881B53C274A37218E47BBBB812A64F67E126DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3fe98683-6f6a-467e-9ead-f07b5a8765f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3fe98683-6f6a-467e-9ead-f07b5a8765f2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7d5ead14223dbb7a8f20328b2aaa87e6e0f47543ced8fa4ac78f9a20f30e3eaa
MD5 0e9a44cd04c095e7e457372fa8b6601b
SHA1 60bed49a3ecbbe992b9264a6d33ec7646711e547
SHA512 06f4d4305300d2f9ff84b371c55f21bca6493832962b254cf8d648cbf96a16587f71456e6c63d633ff30d78339a0d63173759282236606abdd2a685c47d4e552
SSDEEP 768:wkrv+4UNbdY3j+m8lYyHw7Hucys6BRvi82oP4/z6himo6KR3FS:wkbsbm3K5l3imOz6Imo9nS
TLSH
T1C903AF31E8189E72DCF78289B14A7A537FF45223458C2A94DADE6F4D42CB59E131B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e0294ce6c9599efc547e71ac3e5c494a6527ae961b8603db728ec71df30fcb12
MD5 794fdd211b3fd47507da77b47abf23b6
SHA1 77986ad9191ecb1ab8d64bd52e61cdb353da4168
SHA512 711ce7e06ab83e8b09a67baebbd732f5915216015da08746909a18504427c2667a17819a2150e1bff60a2050ef7971dbb56f9e5011e51caa712b7f26cb990acf
SSDEEP 768:UAT3AV8lYyHv7Hucys6BRvi82oP4/z6himo6KojKgqmU6hOGI:UAT3/e3imOz6Imo9fgRU68GI
TLSH
T145F2B030D8559E72ECE7D2C5B24A3B536EF1522395CC2ED4D6EE6F0D0287A9D131B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d8dfbd1c0fd0cb17f98580f3f50365b0dcfb13bee3e0430ab61e0fdc218023c8
MD5 24b54e21c496bd5025af98a8732f3708
SHA1 2b3f463a5cdcbd75ff4b442b1691c19d54a00bea
SHA512 f48cf8b27ba28f7d2d81bda0f63306970a5f75a2e1074309b658ab7e38f1c57a27a1761ba2f8fd6ac0c63a3dcf5231be17c01879b5e7ae0e61c052d0865cabc4
SSDEEP 768:cAT31V8lYyHv7Hucys6BRvi82oP4/z6himo6KojKgqmU6hOGI:cAT3ge3imOz6Imo9fgRU68GI
TLSH
T1BBF2B030D8559E72ECE7D2C5B14A3B536EF1522395CC2ED4D6EE6F0D0287A9D131B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fa626716663b7a7a3068dff161851161b7b26c5a5d6595985f71974781874d85
MD5 d26d93b6c40515b7ae76aed94718e2ca
SHA1 0d4af44d8ecd91315ff22d7ae4712bce0ab38939
SHA512 37bb0512fac1fb5545c9862032d7934c60eee56b6732a307b6e56dd5f57edd1a944675e7fe4b46467be9722171b450c366551ff93d86d1bfac00b4504370e775
SSDEEP 768:8CFQD38wg3V8lYyHB7Hucys6BRvi82oP4/z6himo6KojKgqmU6hOGI:8ZD3tg3imOz6Imo9fgRU68GI
TLSH
T17303AF319854CA76ECFB97C5F64A37125EF15233C588AEE0E6EEAF0D128759D130B821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 928a9f824b980171b1b3abadbed2cb48cc8f848f1b374e7d798fa2ae393fff7f
MD5 28d4aa6862ba6ec43ae2689f2988f4e2
SHA1 8d035f86a1e6cbc20144cf61ff1ddec9c19e745c
SHA512 50cce49b3cd7bd5860b29a590b5c31ae047d31f649e29def1b4b172984c75068a9bb02282381c7113f00263e6d3b628002c09bb05794a8b8426f7d3da708841f
SSDEEP 768:xGrv+4UNbdS3T62lYyg7Hucys6BRvi82oP4/z6himo+U2bwn+h:xGbsbw3T13imOz6ImoL0w+
TLSH
T15603BF35E4189973DCF78288B14ABA533FF4522345C91A80E6DE5B0D128BA5E230B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c5a7b9e-e663-4ead-8e5e-ff67ada756f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9c5a7b9e-e663-4ead-8e5e-ff67ada756f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download