03d6434d74e5f205bc04af913d19ea4bde8982329b464651e710b41cf04aa25e

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 15KB
Sample260727-rtgl5svcke
SHA256 03d6434d74e5f205bc04af913d19ea4bde8982329b464651e710b41cf04aa25e
MD5 96ec47d94a58dcc4406c94b15b9070dd
SHA1 c7c6b5b8bc00d8279e8eb391a78fa1c2108b881c
SHA512 56c6524bdfcbfac0ba9517cbffe13a3774957afd04e0dfd73cac685c77375fa61d17febc371ec8351635aecfd2f21da8806e6a18d3acd2b454f66737e539fc10
SSDEEP 192:sOhO7nCs4NyKmjLpyzt2iQrSpWZD4gKIJgZI3MhiwnsUwaaWQwqDEXxk:sBeYTT2pGPRJfUbsovUDEBk
TLSH
T16D627273C7917C2AC4328074E122BEE6B150030B5B461A60F55A973BF64AE734E6B6FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3508	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296361539482098"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{F1281665-F897-4569-84DD-98FA2ABCA52A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2380	4628	msedge.exe	88
PID 4628 wrote to memory of 5932	4628	msedge.exe	90
PID 4628 wrote to memory of 3508	4628	msedge.exe	91
PID 4628 wrote to memory of 5932	4628	msedge.exe	90
PID 4628 wrote to memory of 5932	4628	msedge.exe	90
PID 4628 wrote to memory of 3000	4628	msedge.exe	92
PID 4628 wrote to memory of 3000	4628	msedge.exe	92
PID 4628 wrote to memory of 4476	4628	msedge.exe	93
PID 4628 wrote to memory of 4732	4628	msedge.exe	94
PID 4628 wrote to memory of 4476	4628	msedge.exe	93
PID 4628 wrote to memory of 4476	4628	msedge.exe	93
PID 4628 wrote to memory of 4732	4628	msedge.exe	94
PID 4628 wrote to memory of 4732	4628	msedge.exe	94
PID 4628 wrote to memory of 5672	4628	msedge.exe	96
PID 4628 wrote to memory of 5672	4628	msedge.exe	96
PID 4628 wrote to memory of 5672	4628	msedge.exe	96
PID 4628 wrote to memory of 480	4628	msedge.exe	97
PID 4628 wrote to memory of 480	4628	msedge.exe	97
PID 4628 wrote to memory of 480	4628	msedge.exe	97
PID 4628 wrote to memory of 828	4628	msedge.exe	99
PID 4628 wrote to memory of 1076	4628	msedge.exe	100
PID 4628 wrote to memory of 828	4628	msedge.exe	99
PID 4628 wrote to memory of 1076	4628	msedge.exe	100
PID 4628 wrote to memory of 3580	4628	msedge.exe	102
PID 4628 wrote to memory of 2192	4628	msedge.exe	106
PID 4628 wrote to memory of 2112	4628	msedge.exe	107
PID 4628 wrote to memory of 1784	4628	msedge.exe	108
PID 4628 wrote to memory of 5472	4628	msedge.exe	109
PID 4628 wrote to memory of 5472	4628	msedge.exe	109
PID 4628 wrote to memory of 5336	4628	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff80678c188,0x7ff80678c194,0x7ff80678c1a0
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,12375644024322019477,7254448415994874184,262144 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15389632358459487738,9894774793401661385,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,12178608240562579935,14891804569555651002,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,4815252597693666385,6998373204405699769,2097152 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,13885652477398643619,18277171673581812876,2097152 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,17203375310251274310,18122356748918582453,2097152 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,3896920589898411304,13815796133148434549,2097152 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15551176375598080125,15287942057996500312,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,10478373230349847015,17964056375410927467,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,16280812360063040051,8302115573733127199,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,16280812360063040051,8302115573733127199,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,6004933748672728117,741810373689228750,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,3153233204500412768,16968456321257525154,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,402714730720713928,5393885249163857190,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,3867339008174067681,8256051085346265517,524288 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,7668008036771938190,14937415634572446303,262144 --field-trial-handle=2324,i,6536936344290716073,13785534261992214622,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 dd6ac90862ae0f9d1f274a51e7d0d22d8857a86f8730f19e316ae86e249554a9
MD5 cb3ac262c44416318e84e33fe780f4a2
SHA1 f7d92bdab1a54c5a6fbf62c98e70d84ce8e496c5
SHA512 761bd951a51d6d0501aca41eab41ff07b8d31829c7c56f9bd7bfae7bd46b2e0571be9ac713fc7a7bb26aa20544a70185aa5695525d7bd8989bd89253152d5856
TLSH
T19851F75463E718F1E72D917250F0559832F4867A8E07BB81D05FAF3CCAA2F7491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b433.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b433.TMP
Size 2KB
SHA256 bbc394d3cc70269ac71fbd059d2cba14134f75ee3844ee9983560dbf66de65b9
MD5 cbb9e649a2a978f5f41b6bb3fa6727bb
SHA1 2211cccb3e7b21c3714dd633c9d3e5a4b26cc6a8
SHA512 80e42b71553554bad37c38bac6ff9ebf9daaca39760c4a07dc34f393b5b7f38d445c47a7f657afde1052d287eaa518b9e5f9c9b646da4cdb0ab6047d73f3b85c
TLSH
T1D651F81463E718F1E72DA17254F0559832F486798D07BB81D05F6F3CCAA2F3491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 857e2d96f53204fe929bc677dce8e20248a47ed282c1b0035af38aba7d6ce96f
MD5 a11fa70a4bce4c4af328932c2d1c2355
SHA1 76e0746e6e50e033f54c6557c5c258e077a3f6a3
SHA512 ec84177113939fb8b573d7acb139dae471772fca9db0d4a4fbcbb7e2fff5ce25557526b39b0bbf47940023c0c3cc33d939b1bf77e460e27ad7a7a53d20030159
TLSH
T18151ADF7C3E8967E890141F0AB186E1BCD1D0916432C3C66C9F4AE1BA3F24B1D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 938f6ea833ab87453dfb9deb3d069361ac85c1dd10cad8ffb3218c812553ab31
MD5 1482dc368d90dc6d9c57f3dd37796429
SHA1 ff289fc4b5a97847abe8ef5f3e1da1c5ff8c6770
SHA512 392fdc0ed8398161f49ff7c2f6af6de6c6697554cd0abcafb6f55f1ade14c10f8f7cddd2b1a9eb355b1a315b1157c1cdfc5070c35bc93ecfd265cef8f7176a12
SSDEEP 192:sxRarbN/fJsIsKCA94/uzoA8p4Y/g6+WNIYD9c6SMGYzIgD1J:sxRaPN/fJsIsZ88N/5IASA7
TLSH
T16B32B7165928A93B9CCBE21DBB567F53E6F95032A1D01E48A7FC9B0C04E66DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9b5d1fbd669cb1aa5db8bac40a57d60b84d93d77461d73d42f65925454c34f7d
MD5 914986d927309d9e96a0d04aa0d0d3f5
SHA1 2c22f7c2b954231d0e37e30ce0a176982cc68e9b
SHA512 55e826feb774c042c1693fde2a1532fd6658f4f96eae336922b449f04a59cd369b652916b4821d030f46477e106ac89bfba9762e45db4eeb432c7912b42779be
SSDEEP 192:sxRRrbN/fJsELKCA94/uzoA8p4Y/g6+WNIYD986SMGYzIgIJ:sxRRPN/fJsELZ88N/5ISSAs
TLSH
T1FF32B8165928A93B8CCBE21DBB667F53E6F95033A1D01E58A7FC971C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3484b0a91484816308ae894c40421ad203007efd5f54df8ae60a6093ba62e874
MD5 36cc79053a2428394545ea75589adf61
SHA1 cb827ea75013081b585d534841979d2b5511057b
SHA512 fadf6369c305b30bd637264f8fe0c2c659aee67cc427054b4f2aa49ef096658486647a6d8380551b324bc731839e32650687308ae68e54a78dec2ec4aff10fab
SSDEEP 192:sxRarbN/fJsILKCA94/uzoA8p4Y/g6+WNIYD986SMGYzIgDzJ:sxRaPN/fJsILZ88N/5ISSAR
TLSH
T16332B8165928A93B8CCBE21DBB56BF53E6F95033A1D01E58A7FC970C04E66DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e1ec0a7927aee56380b71523d91c4ec3c24473e8e93d0ba08bca0d063e49ce26
MD5 d036742f3ca6cacc9b99e580541ebbef
SHA1 f143c27bce1711ed9d68bc6da88e161f12123bf0
SHA512 e3939fbef08002c28a3b22904b5888d00f3875008c0c6d0a782edf3d4f12517bd93cd3ea56f51b887a0c1e9dc7168eba4d2fcc518a3ade4cfdfb5785acc4108e
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcYropDc:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vi
TLSH
T1E8B2EA2F600CCB7E5F800AADAD196FD77D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

079f9a4c-52b0-4e2c-b702-ea20eac91ce8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\079f9a4c-52b0-4e2c-b702-ea20eac91ce8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9960c697f9ee978d0f60a22fb67ffd9b5fe3a40d206abeb29d934d736f0c03c6
MD5 798f3fa2e722668b6a459874c4e5330f
SHA1 5f48062efb821a312ed1abe75bc9b126ae5a8d54
SHA512 64c31373fb63f897b2d6f16ab38d7ed8abd8f45a300801f6ee5a2308159effa7386159babdb3e09b473391e9265d80e1eae0ea2780b90cc4d4868f4f04e7e5c4
SSDEEP 768:2rv+4UNbdq3bmi0KkrEnjN3Gac1FyXb9MG:2bsbU34FQnjMa1Xb+G
TLSH
T10D13CF3179688EB38DF7D285B0473A437FF0165786D80AA4DAD97B0D169B4EC530B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1377d3ee2ace8f9976de0f6d5fea18fe5778aa30818c733cb569e7285e7e4475
MD5 a7f7b06bfcd066f719358cd95b7c012a
SHA1 30b23356446b04641d9c3af61a901516ce36dc4c
SHA512 29e6aa6c05d7d9199f86cd3790d7d1c700b6f2e1d0ad1b807cccc30eb680bac64116b515f651e6daec5277dd29fc361fd0e9149dcbb56bda180f154920db6fb4
SSDEEP 384:AiFiZcIM38No8TUNTUlIli16L/xWZlf8hyEGoH77jaFJy2rEoajo4cdR8eHhVODl:bFQM3fwgXmi0KMrEnjN3Gac1FyXb9Mw
TLSH
T12203BF726CA4CAB7CDFBDB85F5473602AEF042A7C5D44A94A7CDAA0D11974EC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3546b0db08d5804a17172ec259c1193ed09e84aee04fc929c2cafb0bec07a517
MD5 4b5984b1c9f53f18b75436cff45f977f
SHA1 0f93b4962fa0b8955fd03b35b163f5eb68312cbf
SHA512 1bab91c55af60cc63efd6d73abae192e40dd7f9466eefac68e3f73cc1bcaaa030b7a6edaad20931da5c593968de4db33bf2e743daf578abdfba5c6aa0108ff7d
SSDEEP 384:cZcIB38N4i16L/xWZlf8hyEGoH77jaFzy2rEoajo4cdR8eHhVODjYPNDUMyXhObc:KB3Xmi0KkrEnjN3Gac1FyXb9Mw
TLSH
T15BF2BF716C758EB38CEBD385B1873A027EF04763C6D80A9496DDBB0D16979EC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1bd89c44f84849066adc61c716c22417d8922f4605bb13f91f7cb385084a85ad
MD5 c4272acd948ad06d9d22aa37b1bcd347
SHA1 c98256c8c65665c90b801735920dcb1fd6c53cbf
SHA512 28a3788fa4c3f0aaf7e026369c12e99436aec650c36a4c44126e79d2328a60345df8b2d5d3a2b574ed3c28245b22efe0e78fa2a89ad745bb9d4fa273cc78762f
SSDEEP 768:Drv+4UNbdq3Zmi0KkrEnjN3Gac1FyXeVH1SCx:DbsbU3aFQnjMa1XEH1X
TLSH
T17213BE3269B89EB38CE7D385B1477A037FB4465386940BA0C9DA6B0D169B5EC130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1d92af03a9e8db6de5963a1e5ae29b950e7091c6be31bb9340880a69af49c3b1
MD5 c85a80398d6cda189acbe7977496dc6e
SHA1 d98ad72fe8c0f8250c03a39c4547e0c809ece718
SHA512 a676ddfbf658f07cb522655e3087ae713ac74ac540cd910d532b0b525809feb0c596cd449ecde3608e5f56eeaa0c6d744bfc53b0f0b6e6736f9c8f9451981cf3
SSDEEP 768:rrv+4UNbdS3Omi0KUrEnjN3Gac1ZyReVH1SCz:rbsbg3t/QnjMaJREH1V
TLSH
T1B803CF3669A88EB38CE7E385714776037FB4125385940BE0C6DD7B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52a6207b-e447-4bc2-8fb8-a31a25414b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\52a6207b-e447-4bc2-8fb8-a31a25414b00.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download