d92465a594999c6dd1f7df0385e1ea3dd2e9fc60a3d2bdffccbfa91651d7ee15

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_repair.html
Size 35KB
Sample260930-g5785azzht
SHA256 d92465a594999c6dd1f7df0385e1ea3dd2e9fc60a3d2bdffccbfa91651d7ee15
MD5 6001de2e297aadff525888820f821fb0
SHA1 27206235d18a03e2826f7926417aa89ac7445b0d
SHA512 924713fa4eb6e29cb2fefdec3fdeab1c9d903ec47ee1ccbe29b945d4f4dc87b8bfbbf02ac3f97a45b5e3fba5c2c9aa02be044eac9414d87b4aaedf7c8b9f0a43
SSDEEP 768:M5RHm87xa3zHqrqsRoYKFBbK6KfjhIEY7h6Bx/Y:M5RHm87xKHEo3bjc1Iz6Bx/Y
TLSH
T1F2F2F832FDA5913602678289F7B7A709F2314047CA04CA14F1FC866A6FDAE42CC579ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{71D6EECC-14E0-4F4B-8169-4E1A82010377}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1132	3020	msedge.exe	87
PID 3020 wrote to memory of 4776	3020	msedge.exe	88
PID 3020 wrote to memory of 2052	3020	msedge.exe	89
PID 3020 wrote to memory of 4776	3020	msedge.exe	88
PID 3020 wrote to memory of 4776	3020	msedge.exe	88
PID 3020 wrote to memory of 3256	3020	msedge.exe	90
PID 3020 wrote to memory of 3256	3020	msedge.exe	90
PID 3020 wrote to memory of 736	3020	msedge.exe	91
PID 3020 wrote to memory of 736	3020	msedge.exe	91
PID 3020 wrote to memory of 2368	3020	msedge.exe	92
PID 3020 wrote to memory of 736	3020	msedge.exe	91
PID 3020 wrote to memory of 2368	3020	msedge.exe	92
PID 3020 wrote to memory of 2368	3020	msedge.exe	92
PID 3020 wrote to memory of 4512	3020	msedge.exe	94
PID 3020 wrote to memory of 4040	3020	msedge.exe	95
PID 3020 wrote to memory of 4512	3020	msedge.exe	94
PID 3020 wrote to memory of 4512	3020	msedge.exe	94
PID 3020 wrote to memory of 4040	3020	msedge.exe	95
PID 3020 wrote to memory of 4040	3020	msedge.exe	95
PID 3020 wrote to memory of 3460	3020	msedge.exe	101
PID 3020 wrote to memory of 3460	3020	msedge.exe	101
PID 3020 wrote to memory of 2616	3020	msedge.exe	102
PID 3020 wrote to memory of 2616	3020	msedge.exe	102
PID 3020 wrote to memory of 3424	3020	msedge.exe	104
PID 3020 wrote to memory of 4480	3020	msedge.exe	113
PID 3020 wrote to memory of 1976	3020	msedge.exe	114
PID 3020 wrote to memory of 3044	3020	msedge.exe	115
PID 3020 wrote to memory of 3424	3020	msedge.exe	116
PID 3020 wrote to memory of 3424	3020	msedge.exe	116
PID 3020 wrote to memory of 3424	3020	msedge.exe	116
PID 3020 wrote to memory of 4132	3020	msedge.exe	125
PID 3020 wrote to memory of 4132	3020	msedge.exe	125
PID 3020 wrote to memory of 1216	3020	msedge.exe	128
PID 3020 wrote to memory of 1216	3020	msedge.exe	128
PID 3020 wrote to memory of 624	3020	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_repair.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff928dac188,0x7ff928dac194,0x7ff928dac1a0
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,5480420722367307728,14062660204205561919,262144 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1944,i,17136488739310316883,10378332370108841743,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2184,i,2975257907479011142,241601521756707180,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8655350290656728243,14523940423204733458,2097152 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,7934651940374095524,6108828675946413225,2097152 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,3932020539234745250,7196455536650092848,2097152 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,7339274539058109252,10562287868681975410,2097152 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4868,i,1175303684321483326,8354391476896906897,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4864,i,14363585637528266968,9413329184365519587,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5860,i,4142688826216831435,2967762062322230747,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5860,i,4142688826216831435,2967762062322230747,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=560,i,4404424437333685357,16593522579766479694,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4460,i,12438638536597241266,1279900033735931456,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4464,i,14331301053633556787,9948744263707383932,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4472,i,2433250590464752372,17563732256973402981,2097152 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2136,i,4809229476548021005,12274459984746318090,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=780,i,15769017158419171742,14161507596132123185,524288 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,1610572988071507846,13690888819242972776,262144 --field-trial-handle=2684,i,180234302582799396,7392350332867859248,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4a846b3b-30aa-42c4-adf0-9400b8fe6026.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4a846b3b-30aa-42c4-adf0-9400b8fe6026.tmp
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 444da9a166c4e1f0d0571734f34e32365eb455d82e2454b5d3aac522ed25b1f6
MD5 ddb4c020a8b703a83060a1f3499fd8a2
SHA1 acd6340a979f43a519488d0fb8efd07074835f65
SHA512 1787de6b3cfeaf4360018dede7c201bd79fd8dc3e8d4a74ae5375b616ff8dd72a0b4c870c5806062c0c5a07ed60c9c071c5a7fac236a152a2a6f98f3b8d63e84
TLSH
T12B61A3410B134A97FB9835F0DEDD30ABFD70798061739ED19350EF78860AF859D9A290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d6b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d6b4.TMP
Size 3KB
SHA256 36199476c020b091ff1acd470115c558a48d20b4ae711e4fcc9b5cef99277eee
MD5 93669680bf06e4dec0164063cbc65d5f
SHA1 491978fdb2dec43bf7c32cdafd24b0fa1fe3d43f
SHA512 4f5af26aa562c8606b70fff8f6577400d11a24e54429ce64ecc7a206591febbe18d0b0f62e4f5156f2be18e5d3200959fc6d34423110200b369d08ba6ccbc8d7
TLSH
T1F661A3410B134A97FB9835F0DED930ABFD70788061739ED29350EF78860AF855C9A290
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e08ce52a94340c60c9de5d25d79cd8d1930466d5f1e8b1c403fb11823a94c14e
MD5 2830b7f829772470bab9875b6328884c
SHA1 d5ffb28fa62940e575177c49a93a4d05aaf611a9
SHA512 0a568d5ab0e31b07c6b1c3cf83def86b3dcd6894dde5dc966f56e54e619a521d74f3a7be69c1ea6edfb2f87d6827a988344720b6e44234e5f7b3c02ef0d51158
TLSH
T16B619BF7C3E4876E881296F09B25AE2BCD1D055B822C3C5688F5AF1B63F24B1D10129F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 311c2bc06fb553feda216b23f4c680ba05fdbe0fdde1fd59cef8f8dd5bf14410
MD5 f517797ff00235a59dfaec3775af84e7
SHA1 4b75ea5d5531d2a30132012eb3f6fe848ebfc6c7
SHA512 241b142e7efcbfe40a6718aeda6dbf1ecfa4fe9769653a2f807c2464fea56026d0da668f4dad799c994a89ff24dc8209cf90098d9de1d61eee25c5d61b087025
SSDEEP 192:sxZ6BRrWY//f4Wsg/VAIdpdcHW6+WNGY3RyhIgrJ:sxZ6BkY//f4Wsg/VBOHbGz9
TLSH
T1B512D9166E28B97B8CC7D20DBB25BF53E6F9503251D41E98EAFC861C05E66CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 37da9fa39701596705ac5462f2ff36f6d7ba0479fb52aaf04fad6021bcd79f18
MD5 ebcd25d2cfd74cad4ce671bcc0e3006c
SHA1 4ba34bbc3284d6677fe5a336013c462b8e9e792b
SHA512 4fcee2fb699359f68e3b45256e4554f990f7a803675be44695ef3224be2e625edf824514a59f87162199d1d60433064591f69daa52e45102925127d47097c462
SSDEEP 192:sxZ6BRrWY//f4WsxHAAIdpHpHW6+WNGY3HyhIg56J:sxZ6BkY//f4WsxHABJHbGvM
TLSH
T19322D8166E28A97B8CC7D20DBB15BF53E6F9503251D41E9CAAFC861C05E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4159a5a5f51a2a38c3f71c20b6c8b658fd93dc960c112ca99e7313806e46405c
MD5 7978fef0f0ec309fb4d998cfcb9b6c7e
SHA1 d338085428f4206bad4e189a03f94ea7ec2ead75
SHA512 78337ead605f9604f6a2946f750437049c00e9cecac1d6256a3d16cc402a2209c501122ae1af22d9440144910827d3c65eb015bc8d1b689091612aae11717711
SSDEEP 192:sxZ6BRrWY//f4WsxHAAIdpdpHW6+WNGY3lyhIg56J:sxZ6BkY//f4WsxHABTHbGBM
TLSH
T1BA22D8166E28A97B8CC7E20DBB15BF53E6F9503251D41E9CAAFC861C05E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ba1bf76f2de686a1295dabb250ff86ff60f876d487be31b4f5d535214c48730d
MD5 f4525f1d03d92b87c50bccba244c855e
SHA1 c24df5e1389a9639d144974797cad1b8aad4b97d
SHA512 be8fc07add890880c4a3a694d8bd71a6d663270714e1864d65841c037d1bc5079e6eb6d62c712021b032b0f1e83988bbc2935b1dc76a1b493b9ffe27dcdae898
SSDEEP 192:sxZ6BRrWY//f4Wsx/VAIdpdcHW6+WNGY3RyhIg5YJ:sxZ6BkY//f4Wsx/VBOHbGze
TLSH
T12D22C8166E38797B8CC7D20DBB15BF53E6F9503251D41E98AAFC861C05E66CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9b2d9f1601b509199aea9bb2aa064c95c675ef86e309b286bfbb81a306ca892e
MD5 019f6e08f33051a3964f8960b24d9894
SHA1 20c3b0a2fa5454258691aaeea4706e7bed25ddfe
SHA512 6936ea15890ee2c20a4083535d3cdf90cbd4c761f29e2f76d42148d17176db6d91268e18aa60df2a4319525c35272ae454bde49d80ac51811630d117a784178e
SSDEEP 768:UI30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72rrolZMy:UI30AbSWvS2l9u1jaLmLZ12YJ
TLSH
T16EC2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 af1d421c7fc98ff867467995dfe0ff7c7d3190cfaaadb69774bcbf1ae6a5c88d
MD5 27ff00a364f145315e1e17744c8700d8
SHA1 7b335a2abfc8dd850fadb16fbccc3837f2f2f128
SHA512 e6ebe1ceb9c3634c18cab048acd114f93bd88853c873a6da6b100cfdcb89dc7aa4558029fbdf9931e7bdafa04e41cdb0c3434f2feb94e7742060a6161b2c3077
SSDEEP 96:KVFsXTtDnr0XmaarrKiSahr2FdOPnYfnSx9nBhx0dksaVxKi4aHx2/X8VA+wKnKv:GH72PK
TLSH
T197911001327B53403DBD664D81B5866F464131677014FA2BBFBE15668A6BE488CFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fc33596-4a86-4f3d-90fc-ed1e10e469d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1fc33596-4a86-4f3d-90fc-ed1e10e469d9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3887a28ea5432bab00f82acd69e7f65bb5bc78cd671fceebd6685ba8c1d8dfd
MD5 0218a07164372237f0284079870f8ed3
SHA1 d92f155793d414a0e4718f8813f2652e3598ea66
SHA512 fcb559f1abe866c312a421bffaf47880f21a637a469a063af52af0850bf83de69fd28998276543e7942a5491b254b2d5401fae74343c41ca0ef943d73f5945f3
SSDEEP 384:bZcIhsNt52Ufppunev+9iX5F1V3wJtgOIwZOyookoF:DhPUfpu8qa7wJXs8k+
TLSH
T126827D729878ACBF5DE2E154F14737035FB88167A784AF94D9ED672C06DA698030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5b00fddb0c86ff15b21d2af22f8d39969f9e90a0ee2728b099a7593a2a1946b2
MD5 b451881e1e057ba669d78c999b84aef3
SHA1 9d820dfb6dee7a524ec85db672dcca094092c1e0
SHA512 228afe500435602770755833280a5519034b9ded0797a04eac0d285334c199f86f7ccbf5d5db5dda7e9cd447f68bd49d7894ae3efc6c7b595ac2575404a729ea
SSDEEP 384:IiFiZcIYzsN38TUNTUlIl+2Ufppunev+9iX5F1VmwJtgOIwZOyookoF:TFQkKwg9Ufpu8qaywJXs8k+
TLSH
T10FA27D3388A8DDBF9DE6DA44F54A36038FB84177DA85EE94E6DD572C01DA1D8030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46209d367dbf442b3829a114e00371d4d834b0c63b2546fb29ac30dcb42b2788
MD5 215875ccfa95d64b89900d09dd8713cc
SHA1 8e98aa98400db05f01cd71d0357b430d0b479ba8
SHA512 e249a3fd8c486f33b83e443c10aed276ec828251d040521cae925a0cdcd3de5b614e570a7315ad3adbff486d110ac78be40c403baa2408bfb7f590c1aee45c46
SSDEEP 192:LONS6AmwprQmiUyxb6siX5FNHkJiwJYU6:LONS6ipde6siX5F1BwuU6
TLSH
T19902EA35BD686CBB8DE3AE54F44B77235FA5116BEA942F84CAE81B2C01D765C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4f32a3746d3aaa8e57436114099e3c3f7e22b322f66666eca8d9c1558f4d42b
MD5 aaf50c44b9760bb4ba183678e2148ef3
SHA1 1ce242e9dc717428cd1776961575b624c89b0b44
SHA512 5f924e208a86ae5e8361cb133c7b7947866c5ad78e6b6dc04cb2c37e14c0c75079bd0c1a7152589dc6b4a80ac99ee8dbb0fde271ba29503034b8776ad83243b8
SSDEEP 192:LONI6AmwpJQmiUy/b6siX5FNH7Jd60lRwuqNU6:LONI6ipni6siX5F1V7wJU6
TLSH
T116122A36A878AC7F4DD2E550F04736135EA45267EB486F84C9EC272C06DF69C530B832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bd75593912580688fe4d7040c87cde8418638da593e1a3b49eef04f13c9563b9
MD5 7c259fdfa982b8e6482166504de04432
SHA1 88731eed2d08c3419d8f90cef3e878baaf7ee2d4
SHA512 7527b4cd14a64d05397b8a4711631cfc0149b78bc833965c618461150ee5432f11f772b8cc813f1295620cceff519f68deb0a355e247039bc055162edfcfa40a
SSDEEP 384:SZcIhsNt+2Ufppunev+9iX5F1V3wJtgOIwZOyookoF:ghmUfpu8qa7wJXs8k+
TLSH
T171828D7298789CBF5DE3E144F14737035FB88167A784AF94D9ED672C06DA698030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bf6d1f79f5beaee5e7dbe12e4f4f6b1c839e2c23805bc475b5060bad9e1a6574
MD5 4771aeeaaa0b92402487b7e86f5e796b
SHA1 54f42086731247eb070687d53623d838a1012afe
SHA512 1e5f3371fa36dc97534eef4b8f36a5d247aeb9350e9f08e400ca897b6cc08cb28d84652f2fcb7e9b7b21b333e62f6abd366fad4dae54aeb2cb33c4fff0408950
TLSH
T1D0410499B7E91148F3B76F9A9BFAA86E443AF9372E07945D00150E4F0A63B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download