9170ae367eb8401e200d38fab2c7412ee8a4e1cfcbe41af9925eaaf089ee16df

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_repair.html
Size 35KB
Sample260809-j2ll3abr2t
SHA256 9170ae367eb8401e200d38fab2c7412ee8a4e1cfcbe41af9925eaaf089ee16df
MD5 b1cd43cd829b63a8b21c14d9eda48820
SHA1 23ec9e1bb9c44d4e0f0d0ae6e61e6d5257408930
SHA512 5d3d6e045f15f7565546f32a9b37450236e1b8451830f4a058b9720dbb1bc2be39fa14d83a97bd3b23cf8523fdd159eae1e0e2b6239f67b55d64e212731dbc7a
SSDEEP 768:M5RHm8MxazzHqrqsco9K8BbK6KfjhIEY7Dx/Cs:M5RHm8MxiHVoVbjc1Ilx/Cs
TLSH
T19FF2F823FDA5913602678189F7BBA709F2314047CA04CA10F5FC826A6FDAE42CC579ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307366026056188"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{96408C8E-0B5D-4D42-906E-D8AB1D6D72AE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5956	3452	msedge.exe	87
PID 3452 wrote to memory of 4304	3452	msedge.exe	89
PID 3452 wrote to memory of 3432	3452	msedge.exe	91
PID 3452 wrote to memory of 4304	3452	msedge.exe	89
PID 3452 wrote to memory of 4304	3452	msedge.exe	89
PID 3452 wrote to memory of 2616	3452	msedge.exe	92
PID 3452 wrote to memory of 2616	3452	msedge.exe	92
PID 3452 wrote to memory of 928	3452	msedge.exe	93
PID 3452 wrote to memory of 928	3452	msedge.exe	93
PID 3452 wrote to memory of 2836	3452	msedge.exe	94
PID 3452 wrote to memory of 928	3452	msedge.exe	93
PID 3452 wrote to memory of 2836	3452	msedge.exe	94
PID 3452 wrote to memory of 2836	3452	msedge.exe	94
PID 3452 wrote to memory of 2728	3452	msedge.exe	95
PID 3452 wrote to memory of 2728	3452	msedge.exe	95
PID 3452 wrote to memory of 2728	3452	msedge.exe	95
PID 3452 wrote to memory of 4908	3452	msedge.exe	96
PID 3452 wrote to memory of 4908	3452	msedge.exe	96
PID 3452 wrote to memory of 4908	3452	msedge.exe	96
PID 3452 wrote to memory of 4504	3452	msedge.exe	99
PID 3452 wrote to memory of 3852	3452	msedge.exe	100
PID 3452 wrote to memory of 4504	3452	msedge.exe	99
PID 3452 wrote to memory of 3852	3452	msedge.exe	100
PID 3452 wrote to memory of 1396	3452	msedge.exe	102
PID 3452 wrote to memory of 3580	3452	msedge.exe	106
PID 3452 wrote to memory of 5480	3452	msedge.exe	107
PID 3452 wrote to memory of 3196	3452	msedge.exe	108
PID 3452 wrote to memory of 3620	3452	msedge.exe	109
PID 3452 wrote to memory of 3620	3452	msedge.exe	109
PID 3452 wrote to memory of 3620	3452	msedge.exe	109
PID 3452 wrote to memory of 2536	3452	msedge.exe	110
PID 3452 wrote to memory of 2536	3452	msedge.exe	110
PID 3452 wrote to memory of 6124	3452	msedge.exe	112
PID 3452 wrote to memory of 6124	3452	msedge.exe	112
PID 3452 wrote to memory of 4884	3452	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_repair.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc76f1c188,0x7ffc76f1c194,0x7ffc76f1c1a0
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,3165715337614479312,4118178040622810103,262144 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2221315800841660564,12605459032027335069,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,254533517956812873,6585818559961242786,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,10263693891007425815,10375441152266568353,2097152 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,13043274303399032327,6399981035271395445,2097152 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,10928603199531465915,12908919576068249026,2097152 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,13665019856885458730,15992621410712393153,2097152 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,6629428409221672525,8660912646570414647,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,15634242778183656439,6380236082821225657,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,15344182269133152865,9707296261929960617,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,15344182269133152865,9707296261929960617,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,7805572030944933450,15918711655404565940,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,9116790355114908463,11080669214689219001,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14810818358882853951,13725710781304233335,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2192,i,10931535290128661100,14564456667845715774,2097152 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,15479415190563351358,6695512004838381787,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,16021388197005014358,4243758117794911451,524288 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5432,i,3487875771742053256,822929115533736606,262144 --field-trial-handle=2824,i,930853875288949283,17099818004322920071,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d8d8bc232ddbd44a2a4479e91627d2a2ecdbb5d0c750c08a4c1f2e7b3af32e12
MD5 d970c9220d3563ca7e10907d7f9b0169
SHA1 f001264dfc33d676072e2a245fc25e75ff6b7445
SHA512 0d4203aa59fbd8f7c727428c7c0c0b3d2397350e511fac72fd6ab4708fdc8cf8a4f35854e83407c428c8fe58a63d48b708a2b6428a72c0a219434530e60510de
TLSH
T1176191A12B6559F0EB6445BA96E09889BAF0C1E50F0BFE117406AC30C93AF243FD3123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f870.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f870.TMP
Size 3KB
SHA256 a3bba1a8320859c030d2a20aac0374d8ee4cb4b37f0c9ba9f6a46329e0733d13
MD5 f72f9e0b546d2a5f8d99611a98296d0e
SHA1 6048cb5b546ba04adcef8b7dcad2930a4f87e77b
SHA512 a8f1a5650b822e17d7b0ca7973df4b1e0a15316093fe8ce8f98fd35275ee59843d03476e29ab7126c5e58235fe784d87c26a2552efc2c58f05cdd136955e8b90
TLSH
T1CD61A2A12B6558F0EB6444BA96E09889BAF0C1E40F0BFE1174066C30C93AF243FD3123
MD5 SHA1 SHA512 TLSH

Submit Download

e3f2349e-7ec9-4026-8283-83c316aa6d55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e3f2349e-7ec9-4026-8283-83c316aa6d55.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b0a4ae8d-db67-483c-b9c7-cc4d40429d43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0a4ae8d-db67-483c-b9c7-cc4d40429d43.tmp
Size 3KB
SHA256 a557cc0cc4306d08754e54fd873a3a4d61bfdfaf45320f5415b1ffb9199e59dd
MD5 8a3c2503e8e8a3cc6bec3782c25afdf5
SHA1 b3e6fa841c6e67b48992218795fc3dbe678b29eb
SHA512 4d4c04e911a72beef47b6d6acb6177c8b7f734cd9f23ecf4037f30f2f73a26c528cf88aad5f905269d1978a4333755e04ad4cda360b9b79e4970db50fa300e3d
TLSH
T17A81BDFBC3E4877E891196F0AB256E1BCE1D051A432C7C6689F4AE1B63F24B1D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b81ecd44d796e2d7370cc4287e8235a0ebb97155ee161842e038c7a4a4601854
MD5 73ad78c2d112c24865c1a4e089ffea84
SHA1 f854795bde27b3250d2b35cf41432faba0dbdd05
SHA512 8809dc5227dc3df28c6edff0ad47d4e9cdcb3fc3bb60546abc2294bfcee21e3356ba1625e68a7f7b47922ee4a85cdc5fcabdd7b27195ec23f9720cd34fc736be
SSDEEP 192:sxRoR3bt/fZsTYBmKCA94/QzoA8p4m/g6+WNIYD9juL6SCGSnIgDsJ:sxRoRt/fZscBmZ8OD/5IWS8k
TLSH
T19742E7166928AD3B9CCBE20DBB55BF83D6F9503361D02E18A7FC960C04E76DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c944f22dcd7150727341c51e031da060980b3827f16d15cd9b57b7322f21a65
MD5 6dc649144ebe1e6203fbebcecdeca83a
SHA1 0d826735f394548c4a84548b439539514875de75
SHA512 e756af4e45a43932767b0cfacc98a590f74117b22171a50a6e471f24d1ccd92020f369c7675c32075448892d193fe11a86c76f635f862033cf40699be90e1363
SSDEEP 192:sxRoR3bt/fZsTYAmKCA94/RzoA8p4d/g6+WNIYD9m36SCGSnIgDWJ:sxRoRt/fZscAmZ81U/5ICS8W
TLSH
T10C32D7166A28AD3B9CCBE21DBB15BF83D6F9503261D01E58A6FC961C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c5a69dfd0d5cd0cb8590e9c3a502de18f09c92890ef72ff10fbe9537e2c61654
MD5 b9b77e4f7d0eea0dc0ad4a98172fbe54
SHA1 9d7f4a0e388ef8cb266de60ed79f549eaa68e956
SHA512 40a0271f48ae371bc27b3e050ea3fc87fce148f3dbc061937ce3aae549f82e3d47a6a34ab9c6455f833bd17dccaa5544acaa1ef34daee713a4aefc652f9c865d
SSDEEP 192:sxRjR3bt/fZsvYAmKCA94/RzoA8p4d/g6+WNIYD9m36SCGSnIgIJ:sxRjRt/fZswAmZ81U/5ICS8s
TLSH
T1D132C7166A28AD3B9CCBE21DBB15BF93D6F9503361D01E58A6FC961C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 55dbf4d966fb4bf91bada982a8213eec7ac0c8af3810fd9e779901cfa849dc8c
MD5 fb4f5254a355cbd1d705fcbe1c24e071
SHA1 5228d14772fc24e9c357050ba0272257ae14d63b
SHA512 414855ff319d0680b54d564d43ce655178a0bf5b1f913dfe55bce64848fd5921d39d47a879d3cebe479b30b356934b2e68b5aab005906b27a93421573ac86b2b
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcmropDK:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0V6
TLSH
T123B2EA2F200DCB7E9F800A9DAD196FD77D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 e90f8aae10968814f59718ef46fda9512e15e4ebc38e6a04fc5b421c8702a285
MD5 178a7c286d13fbf5266cb215127ba09d
SHA1 8c078ee159a7299c81defd4e85be10f83f3854b2
SHA512 1462da3b3d62b75843a866e392ffbf2ff1c59e20f1ce24b34cfd9142bedfde6acd881a8c0d0c3db6c5a4bd9a12978194eb8e537febc00759ff07652af4fd779a
TLSH
T104812245317E4340787EA60D80BACD1FC28278727619A66B7FE901634F66E628DFDCC9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6a2c8daae2ad9b1dd1283a81a12338f8b714a508453b58eda79dcb8670d41acd
MD5 5f7b7ac1c322f41e7100e90cb13629ca
SHA1 d8c73d9f8073ae9d4fd1fdf19185379a8cbaaa9e
SHA512 ad2883ae87539ba2c8d2155f5179bc95fd8eddfee1698bc0023fb735bd5537efd3a43f9d6fb8ea16cbdf53fec5f9f432ed97d1eb0c7c8d1f1c4136518c53b89c
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHS3eyEkUyW8pBgiyK43gYyciKxQZZuK6op:C2r6WwYYZo9m22Lgkte2VUGfHS3eyEkH
TLSH
T1AB911145317E43407C7EAB0D80BACD1FC28278627619A56B7BE901A34F66E624DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a9368.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9368.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 99f0c14d53e667ad19ed7256470d1055389e19f4a9d603ebef11737d57d1dea5
MD5 77cd192a55de77baef69f64b4ec1723e
SHA1 c42c82f2a1d0e6ddeaf8e20c7dffd53345754dc0
SHA512 5908e79fb37a412cc84f512c88853cf7081a46c1fc5985b0f784360a292e0f060739547157d7f7362d1542fb69ec298eb422e926a3f580fb6123439b2375318d
SSDEEP 384:bQZcI/R38NOgeW4lEJqWZlf8hyEGXX77eI6Fry2rEoajo4cdR8eHhVODjYPNDUMs:buZ31Gji03PsrEnjN3Gac1FD2ewBKZOV
TLSH
T13EF2BE746C789DB38CEAE381B5477743AEF05663D4D40FA896DEBA0C12975A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a47cea53bbab9ad6103fdb1cd4a14f7200815421eee9f4c15011eba381133c80
MD5 ec2e46d05b2c793eff4c5d9e159b7a7b
SHA1 e166f418507d7c2287ef3a3009eff5608d78fc26
SHA512 a8cf10d5d88c87ed0479c59aabef790442bd5f83e4b5a7ac4f03f4c87e4f47100eb65688fee54824fea3c93c737846131f7283ffcc3e54e284d53f34a97b8300
SSDEEP 384:iQZcI/R38NONeW4q7qWZlf8hyEGXX77eI6FWy2rEoajo4cdR8eHhVODjYPNDUMDY:iuZ3Yuji03PxrEnjN3Gac1FD2ewBKZOV
TLSH
T1E6F2BE746C749DB38CEAE381B5477743AEF05663D4D80EA896DEBA0C11D75A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9b578106e76f8c49a564e968e5cb7468d99af24dc08ca8d156140046ed1ad1d9
MD5 7044997d37eaaf8b2036e7c296510550
SHA1 620483298fba11734cb43958c18f65e624cfc023
SHA512 fb784653e1b4104362393c8942d42907370cf306135a9e12f3350011b9a029a9b738de198d3b81e66956394e2f809fb5aeb700b9188d7a6aec9e77914759cd05
SSDEEP 768:aBFQf3Zwgquji03PorEnjN3Gac1FD2ewBKZOV:aQf3ZfoQnjMaU2evZG
TLSH
T1DE03AE716CA48DB79DEAEB81B64772439EF042A3C4D44AA8D7CDBA0C11975EC130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5b7dbd11684ab460ceb5cf0212f8e015eeca6e3878f15c69d1fe4a7d2a2538a0
MD5 f24cef873897e4ff0971a74118de23fa
SHA1 d8cf62df1c0c20fa3926420724945516d6633b24
SHA512 e7ad14988c32805d62a54324c9956c7f81d7682c06f723d2f8d1651ca350786970c56cca7e7bc9f92bd0f6e0120e9042ad24720674f032070c85a18d30faa7ce
SSDEEP 768:rrv+4UNbdS3Lmi03FrEnjN3Gac1ZeeVH1SCz:rbsbg3Q1QnjMa5EH1V
TLSH
T18103CF3169A89EB39CEBE385B1877A037EB4125385940BE4C6DD6B0D029B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a8a9901d374776a8210af91463d54884fd7f12c336543f7e518d1c4c1018ca7e
MD5 374cabd45650bde6d1f9e4d8c3e17ad1
SHA1 f2a5d5406fafe9b2ec4afe0327cfb8fecdb53fee
SHA512 1031c5e07a6c411590ff49e629a41d49e3ed84f87bbdded3eb04573a35a2eb1e7650bb3f8a376a312e607fbc7e6f0ef51ca465eded5b06ffce0127eb27dc8f9f
SSDEEP 768:WYrv+4UNbdS351i03PNrEnjN3Gac1oDeVH1SCz:WYbsbg31fNQnjMaDEH1V
TLSH
T1CF03BE3169B89AB39CE7A385B087B6037FB4565385840BA4C9C96B0D069B4EC130F967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8722757-3667-477e-be07-edd838c0b56e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e8722757-3667-477e-be07-edd838c0b56e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download