c6c5397906da1fb8fd4d7c37a261f88bb3a54b290a296bf93a3c0664e488c533

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_repair.html
Size 35KB
Sample260805-qjs2rayclc
SHA256 c6c5397906da1fb8fd4d7c37a261f88bb3a54b290a296bf93a3c0664e488c533
MD5 bbd83e96cbdf98190b085e90ce610d28
SHA1 6585ff525d3917319fdfe22051208bd6a24c425c
SHA512 343955cc3fc8b62621a16ce9199311b368ed6031fd56bcbadf6fbb7f3aaf56badca5bd56fa1ea45cf2e5fc66b4345457519fa2d5b3950dcb109dabc71222b549
SSDEEP 768:M5RHm8oxagzHqrqsdouKvBbK6KfjhIEY7hHax/Y:M5RHm8oxDHsoHbjc1IzHax/Y
TLSH
T176F2F823FDA5913602678189F7B7A709F2314047CA04CA14F1FC866A6FDAE42CC579EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304094782138611"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{767592DF-A472-4EF9-BFAA-C44FBCB4C5A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2860	2640	msedge.exe	85
PID 2640 wrote to memory of 2492	2640	msedge.exe	86
PID 2640 wrote to memory of 3380	2640	msedge.exe	87
PID 2640 wrote to memory of 3380	2640	msedge.exe	87
PID 2640 wrote to memory of 3380	2640	msedge.exe	87
PID 2640 wrote to memory of 1508	2640	msedge.exe	88
PID 2640 wrote to memory of 1508	2640	msedge.exe	88
PID 2640 wrote to memory of 3148	2640	msedge.exe	89
PID 2640 wrote to memory of 3148	2640	msedge.exe	89
PID 2640 wrote to memory of 3148	2640	msedge.exe	89
PID 2640 wrote to memory of 1512	2640	msedge.exe	90
PID 2640 wrote to memory of 1512	2640	msedge.exe	90
PID 2640 wrote to memory of 1512	2640	msedge.exe	90
PID 2640 wrote to memory of 4564	2640	msedge.exe	92
PID 2640 wrote to memory of 4564	2640	msedge.exe	92
PID 2640 wrote to memory of 4564	2640	msedge.exe	92
PID 2640 wrote to memory of 4580	2640	msedge.exe	93
PID 2640 wrote to memory of 4580	2640	msedge.exe	93
PID 2640 wrote to memory of 4580	2640	msedge.exe	93
PID 2640 wrote to memory of 3140	2640	msedge.exe	97
PID 2640 wrote to memory of 5020	2640	msedge.exe	98
PID 2640 wrote to memory of 3140	2640	msedge.exe	97
PID 2640 wrote to memory of 5020	2640	msedge.exe	98
PID 2640 wrote to memory of 3688	2640	msedge.exe	100
PID 2640 wrote to memory of 3608	2640	msedge.exe	114
PID 2640 wrote to memory of 2900	2640	msedge.exe	115
PID 2640 wrote to memory of 4032	2640	msedge.exe	116
PID 2640 wrote to memory of 2356	2640	msedge.exe	117
PID 2640 wrote to memory of 2356	2640	msedge.exe	117
PID 2640 wrote to memory of 2356	2640	msedge.exe	117
PID 2640 wrote to memory of 3492	2640	msedge.exe	118
PID 2640 wrote to memory of 3492	2640	msedge.exe	118
PID 2640 wrote to memory of 548	2640	msedge.exe	124
PID 2640 wrote to memory of 548	2640	msedge.exe	124
PID 2640 wrote to memory of 2836	2640	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_repair.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a0
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,18080393754984363183,68367884286920324,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,2397025617148369813,8587192475053691433,262144 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,14498977164588389748,14921865925300682747,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,10484947331503235855,9959706847469107242,2097152 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5071439728702513927,14666196364181751321,2097152 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,10167385300638183153,17693413437737847706,2097152 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,8685519438131389265,9949943064865571277,2097152 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,8466674297884372771,16310904614821639506,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,12391134159719052791,3658048768491738928,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1716680824010242967,11862298224446722816,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1716680824010242967,11862298224446722816,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,7982714217557888127,4297064758723087407,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,11895410922654906192,11077027272739051196,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,5288535300782283217,15214050417111730361,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4196,i,11249517972005505509,1783971521540008027,2097152 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,18143487877848321783,5153696046996020499,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8842104162109390203,13035400279395711821,524288 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5936,i,10613855215601494576,8870995270170160142,262144 --field-trial-handle=2360,i,18092784138369110686,145989077717430651,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f1f27d0a6d8a536ddaab15b83cf94952862761ad1e0debd8d4927d0924f8c2fd
MD5 1df927a0cd7a88c1b355aa8576be95e5
SHA1 6c70ef6796956867911622211384e9ac754291c3
SHA512 9d943c591bc3fce9413dc0c6db327a17a44146429cb2da80ef45340f320fe5560f881aa4b0a90765e6bc6f6779b9e29256600be11bae409a5bf79a486e67e7a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T126B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 efdd7340b87fbd8b2f0956a3548a756e2aa7e2476734d5a09811acf13a28501c
MD5 6b0a7ee7e88948bffb08568cac745a43
SHA1 202fcba8e03d23bb4383c41b702fbe5421d5c398
SHA512 03e9e55c43e6399b12c69a2fd5de05d0a488e2c9c80c302762d4c1be27c216ff640bde138fb7d10744eed681141cd8b0496a9a23f972f6b1e97a380bb78d8313
TLSH
T102713C7911D227A6E38A3633E2F2060A30708FA90F137D211174F93DD809B166736DF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d3e5.TMP
Size 3KB
SHA256 dff674688b19986998e20683c3581eafa1496be1fc2bd413eaf3a1862921fbc2
MD5 9a285f48d34dc11317fdb9ab4b8b4078
SHA1 ec19e08979ac8ec12104c3d24a9a5759be1f04fe
SHA512 e3044144c41be363b89d37c45788c702a685159b5cbea74899a52b3964817d2f8e7e193bca8103c8def621224c5121117fb516cc82ff9d4ae397701c274ce08b
TLSH
T12A713C7911D227A6E38A3533E2F2160A30708FA90F137D2110B4F93DD809B166776DF8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 42f5bea8ab007da822070a13b723d602fc3e325bfe2c4f82acbae374a3ffd0ed
MD5 f2602d85a70fd2bdd1eb99168e0a2a65
SHA1 ae3fbb522cedc93b6624251daaf95f8f4a12294e
SHA512 5a46288cecebdd63798d51ed5ef1e7cec96328966926d972d6a16349d289285eea3bd4214633fe1d121457b3c26f280b989a0855899e7ace2d8ca429bfa1e104
TLSH
T1826188BBC3D4876E891156F09B25AE2ACE2D055A423C3C968CF4EF1F63E24B1D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fe5d673e-931c-4fce-8d2f-82a38988979c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe5d673e-931c-4fce-8d2f-82a38988979c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f0562d50196a17d38bca9691d03edddb08d3dfe0ec9e0803f122610858c3161f
MD5 c4e269f8c9d874c5d982c1755213c1ad
SHA1 8f5fae44015cc402c9af6c1896ca6ff75ea8d34f
SHA512 3ced05d20aaed224c9968fc41fbc973a7c1902ecb822572a447d0f7ca4a452215b830b1a194c27032b1b8dc54437f54d0250319c058dbff7e46db6aedec8fb7b
SSDEEP 192:sxZMR2yM/jK1Ml8MkW/fBsaD2IdpdYHW6+WNGY4wJ+NIgrJ:sxZMQMW/fBsaD3mHbGL9
TLSH
T11A420911AA346977CCDBD209FA55BF43D6F80572A2900E54A9FCDA1C05E6AEC321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 118e8d06cb2e14c84783b158eaec2fc70d9d125678369ea7851373e12a87ee60
MD5 6433581efabbecaeda7147ae17c87428
SHA1 fa06c354f414f4719724d151b58afa4152c3869e
SHA512 51831dd000e680f134fe322860cd15d2f10509883afbda6c9628634bb1e07ccdcf587f739b99d6481b0e9837d9e1e690b5a8011c7bb88be26462a38b70c6209a
SSDEEP 192:sxZMR2yM/jK1Ml8UQIkW/fBsIb3IdpHtHW6+WNGY4AGaNIg59J:sxZMgqrW/fBsIbYNHbGqZ
TLSH
T1C452F712AA346977CCDBD20DBA41BF53D6F9057292900E44AAFCDA1C01E6BED721381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 947c9decd3c4ffbbc540e7feaccbd0ba11cabf283bf1a3c0d6f38de1db398b82
MD5 7657af4a62feffeb34b4798fad504f4c
SHA1 00bef8e2412825df82f0f352b67987b3963c0995
SHA512 4af9d0632d81e5bafa107333ccf54fd05897c61744b1bb20db23a1008eeae0e7c13354ec0ff97508effd789615de16ec078f717f4aee38885d7bfd8acc711b91
SSDEEP 192:sxZMR2yM/jK1Ml8MkW/fBsIb3IdpdtHW6+WNGY4zh+NIg59J:sxZMgMW/fBsIbYXHbGuZ
TLSH
T102520811AA346977CCDBD209FA45BF43D6F9057292900E44AAFCDA1C01E6BED721381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a7ce67b0d5afab7631267959808afd86a7628d1f5eea8e722a278c91dca459e7
MD5 ffe8bacdb084ce0d2308fff420393ccb
SHA1 ff691eaee4942c17bf8fa1410916643537535bed
SHA512 217c67e72e5625c96b2030631528d5065dd6c68991d85d7800014a4f57201465ffc6e9161a76303715b0dda43d4d10b3ea7168273b6c66503f70ab20f13161e0
SSDEEP 768:gy8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdfro8klUn7:gy8iJPNWvx76ru1jahALocdMNU7
TLSH
T1C8D2FA3B680CCB7E4F844E9CEC266F966DD801CB5A988D5447FA884C03C76EE51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d885ccfdb33ba6cf94b9ed4550f2e29706fb38625da6de856e6d6866923f3795
MD5 e3ffb354ee5c5b15595ab757b0ab3f62
SHA1 40504b68fb9d5ad4959fd15a23375fafad893ad4
SHA512 dcd26de973a14fdb67af3d7415cce5851e5a6eec06fc57f14d2981b0e23e9253fc7d7af4cb716dc23f62a0fbdddf6163293e422336b531859adb54228a6db178
SSDEEP 24:KdiflELfEyEREIaENdEBEhEx4ElEB+EsIjEdExKiEOhaEzEx1EELEhSmETMEW8Ex:KV9IhKe0sbyV1INKGQAuFI1K+wQXyg
TLSH
T18C912E27F0BB53413C3E29199951862607817DA33418A46F7BA941B18F6BE291FFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596fa8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596fa8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2aca717da1de6014559c86b1450775f1915b636324956fc9c3843893c7d5109e
MD5 639d3a23a9fceba99fc22993cd31ec14
SHA1 2e4abf2988cbe22862f6c7d7af20dd9797f95b15
SHA512 d6feb131c041a396324e81b8ebd5b56ddd66ed6fa96f4049921ebc46c320055fa103f7a10b26a8536be13a2ae88546414d54af3e214260f32b04a3a9598ead70
SSDEEP 384:eZcIhsNZ/t2Tskg8kyv7XLojMBeRs9JKgqijUvhOGv:ch1VbsjMTjKgqmUvhOGv
TLSH
T13392AE7154786D3B99E3E981F48A3A1B5FF48423E7C43FE4E6EC6B0C018A19C131E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a16758ce304f1fe3480dc77638602291831257afe400e8aad5df326d87fc9fbf
MD5 ec81a8c282dab2c2efc9b941d7bb2109
SHA1 72af8ec665cf2b551e80a65c393e7877d47aea53
SHA512 8a5d74a010bb5deb754cea7d417736737765d5ccd316916d4eed0761f97c6803d9acf30dec1626559ddfccef99e88e8f5c33b7b9e4be15f129593670acb73c09
SSDEEP 384:viFiZcIQzsN78TUNTUlIlOt2Tskg8kyv7XLoOMBeRs9JKgqijUvhOGv:6FQM6wgLVbsOMTjKgqmUvhOGv
TLSH
T1C6A27C724868997FEEF3AE85F44A36179EF04067D6C4AFA0E7EC5B1C01961DC130AD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 beb088c7c0b9d0b1bb81fc5c52a13d203adec20a2d25e5bec573f6aec8f55941
MD5 40cb5a916c5758d0e22f01e0d15a9c5d
SHA1 cf5d166833d20391798070bd3121384862264761
SHA512 aa696f7baf4437aa515b9304d60548ef5ddec03e9cd0eeef4d05ee6a970e4b69e1c80607703d6003e62209fa8b6a1e303e00eef925254ed933b86ed4f6f7d616
SSDEEP 384:FZcIhsNZOt2Tskg8kyv7XLojMBeRs9JKgqijUvhOGv:9hSVbsjMTjKgqmUvhOGv
TLSH
T1D592AE7154786D3B99E3E941F4863A1B5FF08423E7C43FD4E6FC6B0C018A59C131A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85fb773ccb9d7b5ad68d58532f5312412916e8a0292470bc14016770b1de2112
MD5 03e93351c3318a5285b14fbbaa14ed74
SHA1 fa55b9e023864bd7c193e30594f5d7ea97ecd59b
SHA512 907074a4b1100abd6426cf3139698090eebf5bdbc58fffc19736093accbffc57b07f8e3893425236cea5a0becfadf48b4800c3e8567b880c8375bcb4ba7a188b
SSDEEP 192:gONv6kDfQmiUyHXZ9035jzorkbravWQisaU6:gONv6ghSZ9g8kyv0fU6
TLSH
T1D802D93568786C7B8EF3AE49B44B37275FE5112BEA952F84DAE81B1C40C725C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d6b8338641e15da122c1f04c134a5bd70a7e79979e4c6c8024c20d91ed60f0db
MD5 6fa518009acdbcbb75b00cc245946e3b
SHA1 66e6201fc4bd3c2d9c67ad08d69abd567ac32aad
SHA512 485292560c09dfe3f3090b76624669a571cb8268c98b08867f673c67d50035cab832c761b5a182ac9e63ce96dbaaec97774a678757a3aa7cc0c8fbd410430a7b
SSDEEP 192:EON06k4QmiUySX89035jzorkbrav7XHNNo1cRLqjU6:EON06Nd89g8kyv7XLoKMU6
TLSH
T12A123C3264786C7B5DE3A945B44B36279EE54127EBC87F94E9EC171C01DF29C530A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9f9d9f4e24ea3ac716997cecc3570b83015d31807942209b4dbda404899ff8a2
MD5 656bd71a661488f48964c12e1741679a
SHA1 7ef86f7f7e21c1a5b83d9fa001dfe9b43f8d6df3
SHA512 ffc6e26a22288d7faddd6b01e4e0c836e8823d33170f5e26694fe78ada0beab95b73000471326fe4b83bb31da6247d094d3e8cf98d4b14708c2a679d7cdff1f6
TLSH
T1EC413B5CAAFA1148B3B77E169BF6A46D487AB8722F0BD49D10110D4E4662B40C862B77
MD5 SHA1 SHA512 TLSH

Submit Download