6d47baff519b6d709dd5269b3c02cdd9e4691529902e9bb05dc9e1a988fbc3b7

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 13KB
Sample260715-tsrf3aby4x
SHA256 6d47baff519b6d709dd5269b3c02cdd9e4691529902e9bb05dc9e1a988fbc3b7
MD5 5d47916378bee74b4c87f4b7e46d9840
SHA1 d0564561165c81708559a6057bbe13904a88fc94
SHA512 8448a4c8dac04213acb56871c5fd3d38133f67a9bd3e10580b128cbe8ed8b8533e74f013be5f1c44dbba0d91e8ba75f2978e64426c584bb5cb624d23576d9161
SSDEEP 192:w3DkWwP7fzrSabTaHpwGiN0b6uSabwa69a6SabWYaPQmZKJiQTN/1iJ2HPaFC:SweabTaJw/JabwavBabJaiJ1icCU
TLSH
T1B3521C07C3847A1A51338059B212975CFDF243876B50BF91FAEC716667CFCA21A62E89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286059870083512"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{3928297E-1B2A-4305-A9CA-822965BD142D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4340	5016	msedge.exe	85
PID 5016 wrote to memory of 4940	5016	msedge.exe	86
PID 5016 wrote to memory of 2764	5016	msedge.exe	87
PID 5016 wrote to memory of 2764	5016	msedge.exe	87
PID 5016 wrote to memory of 2764	5016	msedge.exe	87
PID 5016 wrote to memory of 4948	5016	msedge.exe	88
PID 5016 wrote to memory of 4948	5016	msedge.exe	88
PID 5016 wrote to memory of 5004	5016	msedge.exe	90
PID 5016 wrote to memory of 1668	5016	msedge.exe	91
PID 5016 wrote to memory of 5004	5016	msedge.exe	90
PID 5016 wrote to memory of 5004	5016	msedge.exe	90
PID 5016 wrote to memory of 1668	5016	msedge.exe	91
PID 5016 wrote to memory of 1668	5016	msedge.exe	91
PID 5016 wrote to memory of 4992	5016	msedge.exe	92
PID 5016 wrote to memory of 2964	5016	msedge.exe	93
PID 5016 wrote to memory of 4992	5016	msedge.exe	92
PID 5016 wrote to memory of 4992	5016	msedge.exe	92
PID 5016 wrote to memory of 2964	5016	msedge.exe	93
PID 5016 wrote to memory of 2964	5016	msedge.exe	93
PID 5016 wrote to memory of 2968	5016	msedge.exe	103
PID 5016 wrote to memory of 2236	5016	msedge.exe	104
PID 5016 wrote to memory of 2968	5016	msedge.exe	103
PID 5016 wrote to memory of 2236	5016	msedge.exe	104
PID 5016 wrote to memory of 5004	5016	msedge.exe	107
PID 5016 wrote to memory of 2736	5016	msedge.exe	116
PID 5016 wrote to memory of 4844	5016	msedge.exe	117
PID 5016 wrote to memory of 3648	5016	msedge.exe	118
PID 5016 wrote to memory of 4248	5016	msedge.exe	122
PID 5016 wrote to memory of 4248	5016	msedge.exe	122
PID 5016 wrote to memory of 2124	5016	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb7b9dc188,0x7ffb7b9dc194,0x7ffb7b9dc1a0
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,12216473396523191889,14610605901315980019,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,17347072660460880035,14742782770714786858,262144 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,12112408334863774828,6304355932369901350,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2800818041093599226,1996184350591928493,2097152 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5082164247960327545,9887325796186901638,2097152 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,10860704219923206932,15254328893941792940,2097152 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2583062160412997625,12093694997443430051,2097152 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,548288002990605541,8219609936757918166,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12649638310505492208,452160465042731829,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11625202610647355599,11595580354715265383,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11625202610647355599,11595580354715265383,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1036,i,1203829828048845785,16669968298854282060,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,15569650023060379115,6678934463992533852,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=768,i,6263644379274772491,16081683567215415698,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,9018859523452286666,7450954532130914375,524288 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,18340171462357182891,8696638278509189830,262144 --field-trial-handle=2364,i,8498704816647185259,8756225024794491199,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 947cc235c9b925c2b2f0555037af0e753755fe2e0413b977cbac67bdfddd4ab2
MD5 5c6683a12053783afb22d55bbb27db29
SHA1 ffae10c7e70a13862fe6a1bd1a775f839594ac57
SHA512 4aa98b478b81e2c49f631c8ed093e6ebb28e5f07675963926fee918b23a17194095ba5f1e3dd9d865c31211214e188a79a7732492d2146f54ee2e3a8b0719835
TLSH
T19571187E024253D1E765217BFDD906053A7D8BE909024EAD11A0983FA90EBF5BD3740B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e6c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e6c1.TMP
Size 3KB
SHA256 b7e62a76e0960fff4acb2ac03b07783298d18a42e09373d2d8e816f31afa816e
MD5 f98c86c7a05c674dc27759c0390f3240
SHA1 2ad89452943b1c5c4fb3bd54c56577b82f21be23
SHA512 8b3cb075c87f27c103952665f43e526e804f507dc2d14fc2ad13345cd7f5b46510d95802909b94464f0fe2ec3a1ad6bf55b7b3013913a2bc1588630b32c7ca62
TLSH
T17871187E024257D1E7652177FDD80A053A698BE809024EAE11A0983FA90EBF5BD3740B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 45a18bad0a0218b1799607a8a45c371139e850fc0cd1087c56ede035a8859218
MD5 3e8a0f6f427b5df21b702b8429d25367
SHA1 b45f676ea854a9b36cc5846bb2ef5e3ed552cd4f
SHA512 d058be157991fa6e6a41ba2770ec13a63c12d7ceadbdc5188ea8b4ec72286f986acea053d9128072d4aa4a8885ea708e8dfc04e1711329b3221444811ed1de9e
TLSH
T16B21E1F3C3E5866E9A0116F05A24AE2BCE1D0106432C7C668AE4FF1793F34B1E00169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 85a9209f7b987df8cb360e017da8b3a0e2405e65affdf95dcf796131b528bf11
MD5 1f03c230fd267e6984babef5a39c40a6
SHA1 19e4bae890b542d07f2a2f0364fda63674cf3b9f
SHA512 08276f09c66e0d03c45506ddc7ba7b03e23dfcdc1b7678d2d7a26d13fd49a677d63a8aa0d6a27c4f28954afa550b6f742d0d367d3e9b6b778d2992c30cb4d667
SSDEEP 192:sxZ2R5yM/jK1Ml8MWa/fDsZPWIdpdmHW6+WNGY4wITuIgrJ:sxZ2bua/fDsVXQHbGq9
TLSH
T19B42E912AA349977CCDBD20DFA55BF93D5F9047392940D44AAFCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b64ad276e550e849bd8633001f6b6c5cf54733ff2d81ade276af62b7717ea7f4
MD5 7625c58aec024524f0c1b81fb31be20e
SHA1 c04e6e18f6d71e83a11abb2eb259966fd8b8eb6a
SHA512 d8d55d003cc7de770450d3813c5185a5120388f98208636406e91d90168cc733bc04363188af31c6cd558da60591b2d5771bff2522397b3d4d796fdf4cb9975a
SSDEEP 192:sxZ2R5yM/jK1Ml8UQMWa/fDskPWIdpHmHW6+WNGY4uNTuIg5bJ:sxZ2bq3a/fDs4XGHbGx3
TLSH
T15D52C712AA349977CCDBD20DFA55BF93D5F5147392940D44AAFCCA0C05E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9c07021f8b442216779f206f692fa68db48d45e942aab41f11218c3a393c7c6a
MD5 7ff38151c250d64a0d6e69c532ef7a94
SHA1 4485326395fc92d3d8a58e5667e3daad4be62897
SHA512 613a04006e0b3501611b459fd5bc4ec39a83e3fae1255263e76f062615337ac5dd98ec552ccacddf3cf4916ee7ad72481ebbd98cbcc453fe0e5b8688c18dbc4f
SSDEEP 768:PP8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdkro1kYUnc:PP8iJPNWvx76ru1jahALocdv9Uc
TLSH
T1C0D20B3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ee27efa900c5461f4e804f946e3acd6a7ccd444f2d76fa5b7521a39a084bb9ef
MD5 816fdefe5ce70a223837450a1684ca78
SHA1 224d4c3a959f3f5c72649186ebd29d98657f9cce
SHA512 4f17f5cc56ecbcc40b93846f3228b36beaf81d933363d41777caca33d8b8c9a494d7e358696cb9e9848d3beca8f63206d4d078c0ec6324537b62c3c1c9be46be
SSDEEP 48:KKII7KhKEXyHDIfDRxhC3ZmxIAzCK1ntlCpTSy+tRHIlK48Arym:KKIAKhKWSwAKdGSH6K48Wl
TLSH
T124912112307B12413C7E648C96A686164791B5A33029B96F3BE940B50F2BF350FFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 70b75a73602157fae3af771fd13d14b66283adb3a6a18d646f1f0628b7737834
MD5 244edbe34f7af49e5a7423de0e31db99
SHA1 fd30106f81334553cccd434f7d3953ffc8a5e25d
SHA512 34efbe0e7729c4be99afa21db7da718da6ba9f6b2fd4cf0f9aa16128af093fb13938afa3cb12ca4e78118f882538de547e314964455434032d7acb27506bb3f0
SSDEEP 192:uBTSNWMsnMcPPQLz3XX9VoAXzsNTmQmEdPaWmRHQmiU16gF4k03etLE2HIkEq+SK:mtNn/s3n9SkzsNTmh3pakREntScjmwhB
TLSH
T12F928E36AC68AC6A5EE35585F54737178FA4416787C82F80D9EC6F0C40CA6AC0317A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fdc0bb95674b171cd07a4c83b1fed91245055e1d28b493b59240071a773fa8b4
MD5 c9aa76f9cd04201b4820a5b8fb865d77
SHA1 489ebe18456e8c58e2bfe440fd59c2cd8898a331
SHA512 451f9ebb91d3a2419645816e773218a4e88a4be542c748f152da74ca20bcada36dd882b9cb8f708a03a91d830241146405fc4ca42a1ae214a283a850b768e230
SSDEEP 96:ZqONkdQsjpfmUTmDK5ih/cIPURHl8h4otop5C5D4BhPwivh50xy0SFYK+AxrgCMk:gONx6kDfQmiUycMZ903etnQik8pU6
TLSH
T17E02D73968782CAB9EF3AE45B48B37275FA5112BEA952F80D9E81B1C40C764C1303937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 82e1fe73c800945302bcbf5828ea6ecbad519ebc7e3dd8e15b1a2a5469c6c19b
MD5 6f0e15d48d254c05fe5bf55cead2cc11
SHA1 563e2658d4a981549a9044923e1654457de0a1e1
SHA512 d362163cfe3f30ac49ae2baa6db707c20f42a6b979e87d229c4e0036694383deb02d56772b75b7f4481cc07ee60dde57182df19eb86079750531f433d1d217ed
SSDEEP 192:upLsNTgUQmEdPaWmRHQmiU16gF4k03etLEdLIkEq+ScjmqYoJXmgXuv:ksNTNh3pakREqtScjmwhs
TLSH
T1F3725C36A878AC7A6EB39545F44736139FA44163CBC82F80DAED5B0C45CA5EC131792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38e97022cfb20d1b02b413e9b7ab8acae6ced88036622dbc1f1c72c4453b3fcf
MD5 ca9bac00c88f573bf243f08048230b38
SHA1 061f3dd731199eeac5103e058838ed74efff72e9
SHA512 8e7ed6e2e9753fe3fcbbffac5db335865d946b7153becd09798cb424da6e4fd075b47b1bf135238ed6ddfae97f2ed020a1022fcc387d0b00e063f998e325cea2
SSDEEP 96:iqONkOQsjpfmUT/K5ih/cIPURHl8h4otop5CeD4B8Pwivh50xy0SFYK+AxrgCMy4:ZONu6kSQmiUyPMG903etLEacRkEq+U6
TLSH
T1E2120936A8B86C6B5EE36941F48737175EA58227EBC93F81D5EC1B1C00DF69C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9fe186be4089559aef13edc7223889d93e053b68e53ed0293d956ffa328d6b18
MD5 3001222d5fe722ed98b7c73fbb99da19
SHA1 0f6bda70f030bf6c49e96097bc7a128a4a2e5769
SHA512 a650ffbddbae319786222e7a6a1cc2d5fffda55a4636acc47dc9ad9270cb8bcc268deb17f789fdf6df05ebfb7d9063f721892793be5c25d4c4891a12c10679dc
SSDEEP 192:upTSNWMsnMcPPQLz3XX9VofsNTrQmEdPaWmRHQmiU16gF4k03etLEdLIkEq+ScjD:8tNn/s3n9SfsNTrh3pakREqtScjmwhB
TLSH
T139928D36AC68AC6A5EE35585F54B37178FB4416397C52F80D9ECAF0D40CA6EC0317A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1738a3658a14362a97188d412526202aa2b1f4ca44612b6658eed13ed82b30b9
MD5 55bac324b6d19bf65e90b7feaa342471
SHA1 7d8ed2c336ad9f4e798bf89582ed5a463ee9c860
SHA512 fe403cc18ccc60e4a163c25cd5889c094b0cae4bcc1fb9029879827c11b31bd09a81f8655d91e36de63b1e20d184d58cb145e3c0f8afc2ff44bebbdebf071287
SSDEEP 192:uvTSNWMsnMcPPQLz3XX9VofsNTmQmEdPaWmRHQmiU16gF4k03etLEdLIkEq+ScjD:CtNn/s3n9SfsNTmh3pakREqtScjmwhB
TLSH
T171928E36AC68AC6A5EE35585F54737178FB4416397C82F80D9ECAF0D00CA6EC0317A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dead9244-ae6a-495e-ae2f-5dabb4c4e87f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dead9244-ae6a-495e-ae2f-5dabb4c4e87f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9746117272ffbf7885967ec621ecfa120013bcade96024f360ff77dc0b82d917
MD5 be2e4c41110dda77fedb3eeeb008b94a
SHA1 3057a9dc3425eaad6973303dc2bf6973117b2a1a
SHA512 a9ace1a17907c71afcd8997500f4f6be1897e3b8c8de415ec85bb6a02f8db44218022b95c67b1936af4a69fc9027a4154d04a9a42d1942075a38a876b4bd34d0
TLSH
T13F410998B6EA1148B3B76F5A9BF6A86D487AB9372F07D45D10010E4F0663B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download