hxxps://email[.]pei[.]group/trk?t=1&mid=NjIwLVRHWi0zNTcAAAGi-9MrvDq5U8B_-Ifknequ1bqzAuJ003rbyOf2jbF1dE4MSzKdLjIDcSQHZRBpS1x4i3OlybqqlMcdM-HFZ7tMIpIImfN_UzAdxyyfACjpMZxH4nknZbeTGtznPLZ9WUmUe_8czB0MRAoN1LjTfhJ56B7n

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://email.pei.group/trk?t=1&mid=NjIwLVRHWi0zNTcAAAGi-9MrvDq5U8B_-Ifknequ1bqzAuJ003rbyOf2jbF1dE4MSzKdLjIDcSQHZRBpS1x4i3OlybqqlMcdM-HFZ7tMIpIImfN_UzAdxyyfACjpMZxH4nknZbeTGtznPLZ9WUmUe_8czB0MRAoN1LjTfhJ56B7n
Sample260714-ake9aaa13k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284617755382132"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{D2FC2592-EA0B-4779-B6B7-336BABD26673}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4892	700	msedge.exe	83
PID 700 wrote to memory of 3296	700	msedge.exe	84
PID 700 wrote to memory of 2320	700	msedge.exe	85
PID 700 wrote to memory of 2320	700	msedge.exe	85
PID 700 wrote to memory of 2320	700	msedge.exe	85
PID 700 wrote to memory of 5024	700	msedge.exe	86
PID 700 wrote to memory of 5024	700	msedge.exe	86
PID 700 wrote to memory of 2940	700	msedge.exe	88
PID 700 wrote to memory of 2940	700	msedge.exe	88
PID 700 wrote to memory of 2132	700	msedge.exe	89
PID 700 wrote to memory of 2940	700	msedge.exe	88
PID 700 wrote to memory of 2132	700	msedge.exe	89
PID 700 wrote to memory of 2132	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	90
PID 700 wrote to memory of 2196	700	msedge.exe	91
PID 700 wrote to memory of 3836	700	msedge.exe	90
PID 700 wrote to memory of 3836	700	msedge.exe	90
PID 700 wrote to memory of 2196	700	msedge.exe	91
PID 700 wrote to memory of 2196	700	msedge.exe	91
PID 700 wrote to memory of 2272	700	msedge.exe	95
PID 700 wrote to memory of 4668	700	msedge.exe	96
PID 700 wrote to memory of 2272	700	msedge.exe	95
PID 700 wrote to memory of 4668	700	msedge.exe	96
PID 700 wrote to memory of 4440	700	msedge.exe	99
PID 700 wrote to memory of 3772	700	msedge.exe	115
PID 700 wrote to memory of 3228	700	msedge.exe	116
PID 700 wrote to memory of 1564	700	msedge.exe	117
PID 700 wrote to memory of 4808	700	msedge.exe	120
PID 700 wrote to memory of 4808	700	msedge.exe	120
PID 700 wrote to memory of 3620	700	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://email.pei.group/trk?t=1&mid=NjIwLVRHWi0zNTcAAAGi-9MrvDq5U8B_-Ifknequ1bqzAuJ003rbyOf2jbF1dE4MSzKdLjIDcSQHZRBpS1x4i3OlybqqlMcdM-HFZ7tMIpIImfN_UzAdxyyfACjpMZxH4nknZbeTGtznPLZ9WUmUe_8czB0MRAoN1LjTfhJ56B7n
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10717683918144903498,13086003865594522429,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,13853240814407415267,15715092163482334745,262144 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,853405307055955544,8066571537984134929,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4550107589174529697,13444691045042189113,2097152 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4755221575675771200,2286574541198056700,2097152 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,15776132288852633256,5160660153920989155,2097152 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,15730964893571045153,12290286765313605668,2097152 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,2634310075726372867,11407648810010422885,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13355121743518931935,4065923471659094761,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10482846729954545788,631157640139791309,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10482846729954545788,631157640139791309,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,16327581110874415847,10507313489652802650,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,14315845596169850763,13914415787283708410,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,6063665940756522933,6832015341917475235,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,9432098081764964730,1329643027607509327,524288 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,3131513930752796121,8169162903000397451,262144 --field-trial-handle=2304,i,16606824866689585698,18441483602143123374,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ab47a4c6f090c9d2c742316a385824424cdc1d2697d4ada14d0d5d492d6c73b5
MD5 f853ac1643dd9e8f5fe843b1bfd3f425
SHA1 928ddf7102ae629e32083202a31b884e7f8b2343
SHA512 891489bc7e684b6ea236cda4d160d791062c3e903b12f527183cf8603c538779e5b1011f9fc6b72308b8fb2716148c008e1b77ab6f57b8613ac83b57b0019854
TLSH
T130715EFE18E30FA5EB21F2705AC10242B13085EBF613ED674E80D7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586627.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586627.TMP
Size 3KB
SHA256 caf6d9965a99e62f682e7b3903625357524a2c54ece6a4901e6119fd112097b6
MD5 5b826cd296041ac64f06ff30f3efaeb8
SHA1 3d5a9916d3c37f21de88d528e9a70a9bdd2aa2c4
SHA512 91acbc6bfb205f21553595a0f82d77e74990a6d73bc6c52add6862237bd7869fbeaef87b71d046c803b526a1457bb6b4f22e7923a6d8708335bc3c2465f11b2c
TLSH
T191716EFE18E30FA5EB21F2705AC10246B13081EBF513ED238D80C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dacaf30c241218bb3b2c1d6d9ac769bba333d1ed8f372333dd306383a6af740c
MD5 97d2136f737201e6b0708f9229e9b700
SHA1 3fb398cbefea6208085e65d8428155588e5e231d
SHA512 5341de6f1bc049e79e193d5d0830a734fe938e3bfda9f698ae3f25b086dd1cf0567f54ecfef335b4a3c28f7489d9048c5b219d75efe6182644cd6068dd41e26d
TLSH
T11C21AFF783E585AEDE1156F0AA24AE2BCE1C0505832C3C65CAE4FF1B93E3475E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 25b3de537f5157cf056f6343a9f80afbbd572a5fd01665627647bc6a29f461ec
MD5 58e25fa5f48c9f6f3adabd93fb9595bf
SHA1 6380dca08ceed6ace8fffbbb86b4a04386469fbb
SHA512 4746982a87acda6071d32622f0f1690fa67c52f8b1c42841157afa9a77454ee078b1a2e4a389e8adecd5f908173d484f94e83a81ee49f370bffff7e8535ce542
SSDEEP 192:sxZmRJyM/jK1Ml8MkM/f2sIIOIdpowYHW6+WNBsL/YIQBU6zIgrJ:sxZmXMM/f2sIIfSHb6/o9
TLSH
T1D242D812AB34597BCCDBD209FA55BF93D6F50472A2901E44AAFCDA0C04E6ADC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cc3c3dfeace4251b5e1afc9a01978ef328aeb97a3829bdb3b4d31ae0a9facaa5
MD5 5f99b1297c3e51cb257830f26f318578
SHA1 391879fe7bef200224ee191587f8cacd264d18bc
SHA512 a6ec0fd776631f4d054ee03b6ef35f22aa3a966dacb5f950b797af8f9827200996ec13e5619931d85faf452c76b3668c1f3c23cdc69c6d2bd4164bf68019dced
SSDEEP 192:sxZmRJyM/jK1Ml8UQlkM/f2s6MOIdp2wYHW6+WNBsL/YIvYU6zIg5TJ:sxZmXquM/f2s6Mf8Hb6/0X
TLSH
T1C952E812AA345977CCDBD209FA55BF93D6F50472A2901E44AAFCDA0C04F6ADC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1023b620b5c4dc8e35a643599d12033e84edf7a2638396b9fac126ec9a739eb7
MD5 41dc9abf0bbc95b268280f891e1c11f2
SHA1 86bb211afd5f99987eba1f6b1823bd4b21dd977c
SHA512 36eb46d7f4a2ca59ea31250faed5a8034708b285b2a5462853d8a7ed68ac95408fbc5c7a3b976688abe885b59d9823a513b11e8a4a5acd45ebc7159b4321bd7d
SSDEEP 768:r/sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR90roBgz:r/sqxXlWvJD6Tu1ja54LAs9fBW
TLSH
T171D21B3B694CCB7E4F840E5CEC266FD76ED801CBA7988D5447FA880C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5901bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5901bb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1e930411d6c519d7f518f1644124132b08b3387601a3dd181ea59526e317a14c
MD5 0d9b8f1f27be0493dbe803c71be1be80
SHA1 b6f74c46a3545cb30c7e60827cc0228cfcb33f68
SHA512 695d404acd7c863331af3ae4e00c5bc299bf8a314bf5aa4b5af734fd801bbe4a3195273031990c9c5e317a293038c1eb7a1496b0230661fb9cf47e7510351a50
SSDEEP 384:LtNn/s3n9SfsNI5exxGbezCVRN3OKZ9QdNOObjI9G6w7Yw:Lj+9UuQH3Om9uN29Mz
TLSH
T154928D32AC281C734DE39555F54B362B8FF8917BA7CA2E84C5DC6F0D02DB6AC5306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a4e90b25690c387ce820926a097828e83a52d0f731f338a1fdf8f7505074c05e
MD5 05e76e06a79e7505753d95cf95afcb67
SHA1 6b6a5123eea625f991d096cba9ab800fc81ac75b
SHA512 cd48c8955111358bbc2366a1821e0855b6c42cbf8eedafabca66c8cdeaefa590d76aa41a4f12885fcccc3e6e0700256754471a71817ad5582850db00fe386e76
SSDEEP 384:qiF1tNn/s3n9SIzsN48TUNTUlIlIexxGbegCVRN3OKZ9QuNOObjI9G6w7Yw:hF1j+9fBwgQQH3Om9DN29Mz
TLSH
T127C238F258D74C36D9AE4B47B77E2D178EBCC067B6856944B3885A0CCD9A1BFC306910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ee36da4fda81e359433457fae7d6bd3343c4910d1673ceaf46ea0ec717ea8828
MD5 6d928659170725362c4497c2928fadab
SHA1 a071c1bec66fb85c1a6d5dbfaf53100ab2681d5c
SHA512 cf5e69839147c369e96d37b310099c83977bddb5470df6b4403d31e854b4db841cb110b4c3d759dba4b0704bad175f3b51323d3f04a3917c7a1d13b241717a10
SSDEEP 384:RtNn/s3n9SfsNIIexxGbezCVRN3OKZ9QdNOObjI9G6w7Yw:Rj+9U5QH3Om9uN29Mz
TLSH
T1C6929E32AC281C734DE39595F54B362B8FF8907B97CA2E84C6DC6F0D01DB6AC5306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eefb1d475df8565308879f99a7b51fde2baad36e3ec586002946330d508058f1
MD5 1f29b44b03e76272439ab14d067ca80d
SHA1 8411037b59926c3a6d61562dda23e1ad509e3582
SHA512 0202ca08ea2eb34e111e9584bf1cea53555200f525c6bb5a38e1f76b8ea71bbcdaed7b6abe22dd1e37ae79dcc7e45e07d5356de8d37bca998475c31e36181e7a
SSDEEP 192:tONK6JkRtQmiUy6mW+RN3OmNOmFHh30ROFU6:tONK6UrUW+RN3OKBpBU6
TLSH
T12F02E935BD382C778EF2AE09B98B27135FA4206BE9952F84DAD81B1C01D765C2347936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2d3971275a0bafb725d3cda38734a98543da7619a600d58980d515d4178960c
MD5 47d7918338677d98cbb214a6980e2d29
SHA1 c24fb3c2c1fc97fd0a9caa4eaa748caa60d9c3e3
SHA512 4abc70d3d8b8484eebaa1973dc0a270accc5c3026974ffd9c2b896307ceba9070c6aa3de7d85a0d0179c02ecf60421f64e5917447c6a4e42441df20601f17aef
SSDEEP 192:lONB6JkRLQmiUyEme+RN3OmNOmSC9QjM5VcDqpIU6:lONB6U90e+RN3OKZ9Q7NU6
TLSH
T1CE121936B8385C675EE2A945F58732174FA85127EB896F80D5DC2F1C01EFA9C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c67f91d6-db43-4076-b327-4fb0f1650f9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c67f91d6-db43-4076-b327-4fb0f1650f9d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e27cf8aaec59cb4a3c815f7850d57584ef91b88fc98923e285cdc1415d9a9547
MD5 694d2aee92c97f356048587f3ac5ddf5
SHA1 7d910ecc5cf6a3b23899465bd8454c37e9f7d76b
SHA512 e81e8944b2ae88794995c21821a8ff91c8d3503aa195beb12e561d7d36e7649f765da70e9076588ed9eea05fb181ba7b26a36ac22fe307841997f35110aab5ce
TLSH
T1F4410D59B6FA1148F3B76F5A9BF6A86D447EBC772F46945D10010D4F0A22B40C872733
MD5 SHA1 SHA512 TLSH

Submit Download