14e23539db10d43af544f9d130d9eef3609ca401a4caa3500851f70f7102d3f4

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 35KB
Sample260730-mth3rawbrf
SHA256 14e23539db10d43af544f9d130d9eef3609ca401a4caa3500851f70f7102d3f4
MD5 84fe33307e111497898933567c85cf13
SHA1 1a39f2b10171798ca63dfaeb5efd29e56bf6334d
SHA512 f5f352f56990182452230f0de8c22cc91541141d7091b73848ad8e3389d7edbd2536658a7461b9cbaa3d5ae7d5b34b5d5b43ae122c32464397c1ae7732062583
SSDEEP 768:0G3m2khJw2IQ/4oQnkRkpT34kGDQScOw4+CbHRxoN2iio0PNHK:0BtIznSE6HF+CrRxoN2ib0pK
TLSH
T139F25521DAD1782F8437C066D062BDEDA145430F9BA31BE4ED165137E91DCB20D3AAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298819323526100"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{EC60B16D-0CCE-4DE2-8573-FED066EF957A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2948	2472	msedge.exe	80
PID 2472 wrote to memory of 3420	2472	msedge.exe	81
PID 2472 wrote to memory of 3440	2472	msedge.exe	82
PID 2472 wrote to memory of 3440	2472	msedge.exe	82
PID 2472 wrote to memory of 3440	2472	msedge.exe	82
PID 2472 wrote to memory of 3232	2472	msedge.exe	83
PID 2472 wrote to memory of 3232	2472	msedge.exe	83
PID 2472 wrote to memory of 5052	2472	msedge.exe	86
PID 2472 wrote to memory of 4896	2472	msedge.exe	85
PID 2472 wrote to memory of 5052	2472	msedge.exe	86
PID 2472 wrote to memory of 5052	2472	msedge.exe	86
PID 2472 wrote to memory of 4896	2472	msedge.exe	85
PID 2472 wrote to memory of 4896	2472	msedge.exe	85
PID 2472 wrote to memory of 4084	2472	msedge.exe	89
PID 2472 wrote to memory of 4408	2472	msedge.exe	87
PID 2472 wrote to memory of 4084	2472	msedge.exe	89
PID 2472 wrote to memory of 4084	2472	msedge.exe	89
PID 2472 wrote to memory of 4408	2472	msedge.exe	87
PID 2472 wrote to memory of 4408	2472	msedge.exe	87
PID 2472 wrote to memory of 1008	2472	msedge.exe	88
PID 2472 wrote to memory of 1008	2472	msedge.exe	88
PID 2472 wrote to memory of 1008	2472	msedge.exe	88
PID 2472 wrote to memory of 5080	2472	msedge.exe	90
PID 2472 wrote to memory of 5080	2472	msedge.exe	90
PID 2472 wrote to memory of 5080	2472	msedge.exe	90
PID 2472 wrote to memory of 4692	2472	msedge.exe	93
PID 2472 wrote to memory of 4692	2472	msedge.exe	93
PID 2472 wrote to memory of 4368	2472	msedge.exe	94
PID 2472 wrote to memory of 4368	2472	msedge.exe	94
PID 2472 wrote to memory of 4724	2472	msedge.exe	96
PID 2472 wrote to memory of 4212	2472	msedge.exe	97
PID 4724 wrote to memory of 2576	4724	msedge.exe	98
PID 2472 wrote to memory of 4868	2472	msedge.exe	99
PID 2472 wrote to memory of 1540	2472	msedge.exe	100
PID 2472 wrote to memory of 4288	2472	msedge.exe	101
PID 2472 wrote to memory of 1680	2472	msedge.exe	102
PID 2472 wrote to memory of 1680	2472	msedge.exe	102
PID 2472 wrote to memory of 2044	2472	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff966adc188,0x7ff966adc194,0x7ff966adc1a0
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,13285261295396248411,2635962722907163845,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,1574707762951600467,9594925808817992596,262144 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,5158355442886281392,5644771571879212656,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,4139380985019674692,1615693437152267481,2097152 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,3078791365991365204,13249931548432898274,2097152 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,6491346665068429863,14816135353836109523,2097152 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,14763739537972963103,11150629832042236697,2097152 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,1545051674308138933,7882906329056333160,2097152 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4256,i,13713047003775334934,11277320147446421736,2097152 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,740144087750941280,4930873087848365907,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,12256758492524878044,8296183698893716796,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12803546930994621446,3595014614070948357,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,9048848414824051384,2391653628110894896,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1104
    3⤵
    PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12803546930994621446,3595014614070948357,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,12040769390637741193,13759746083081652590,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,17466709223272445122,5226946926839428913,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,4090810958127403086,10759915434047941480,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,5926314853091589119,5312061039754143871,524288 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5076,i,14286745357550552198,8726094230693307022,262144 --field-trial-handle=2520,i,11494636554388231074,1944938110458974584,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

513bf0dd-adcc-48ca-9a2e-225987a2ccc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\513bf0dd-adcc-48ca-9a2e-225987a2ccc3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fed940190c6819ef98f7c658195e4586f15c97fae29847e82a01a842c5bd5c15
MD5 e748555fab55e02e55d1229e214aada3
SHA1 f29a76c61f1c7a079b31e0ebcdfadc2c8383a9d7
SHA512 096b4b62167bcee2dffb9f95b6484d009434afbbdb3d6c1a37000d6a62bc56850d605c26feeacad45e1041769e28385acaf1ab50af80021c9fa6549f3d165f26
TLSH
T1A071EA5002410972E3F1F67DE2D1735575B100BDCA6B1E1630229CBE8B2D757BE66138
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a76b45628a5553959c864b630499a5b732fd6b922434c7d149c66a896e72a6f0
MD5 d42bd5769cbb8c99b713d2180852f286
SHA1 125e9e2b81e583b3ed29b85d995ae20308b36e74
SHA512 71e8110ccdc5e8fdd1cbf0e7235e8c42f75ab62a4922056df27995cf051caad2ae7c54e58c77aa5d84778d0b136d7371e5eb9af7009235573f39d6db2c2b5477
TLSH
T1DB71EA5002410972E3F1F57DE2D0735575B100BDCA6B1E1630229CBE8F2E757BE65138
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a91c417698019bd6c18428a1b5b01c939d3830df2b644ee186f23bc3c5309f45
MD5 2904ebfd06a9e5e03715e9fe34315e71
SHA1 d0ae7ec89d9c2834f9e5a9dd4d367d5d50bd8919
SHA512 762c79213d3e59bc0ddb33bb00f10602343e68199fb96b53b4d419004c8840994f9f64a3968f03660f5791b8b98fd56494fe2c25a5eff347c908311509e995ce
TLSH
T1F3417BB7C3D8866E890116F4AB25AE1BCD1D0517832C3D16C9E4EF5BA3F2471E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8e8139342b2c1e07ab34f2acb0f3e166046793a0e14c22354a8062f08c4a13e
MD5 5521d9a99012a5538539e7e1b1b33c7e
SHA1 ad05c19fa2619c4fd6387a98869e7df1f5002b58
SHA512 241d4a50b254a8760da4df95befd21ea0fd1d2deac06afbc281c463bc10c301347d4c6ac286362517f707e109405fdec310817b9e9a50bc7132809e3752c75a3
SSDEEP 192:sxZqRMyM/jK1Ml8MFf/fPs8diIpIdpy4/W6+WNGY0uBHI38CIgrJ:sxZqOdf/fPs8diIi7/bG5uk9
TLSH
T11B42D7166B345977CCDBD209FA45BF53D6F90472D2944E44AAFC8A0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 332452f961eb919eb28095b38cfe6b6c707efafa662fa6f2dde715461ca05ebf
MD5 f41e1e712309883870f0b1d64db11165
SHA1 f4ad2c411fef3d4898aa09a4a76b7fb742ae5f49
SHA512 a9983ec96ef0dca6ebeae62b559363dffcb72996578827e330968861160a88126c9f04661c7924ef962d70007cd2e61b21ae812d0e58f4c95948fe6392adbbd8
SSDEEP 192:sxZqRMyM/jK1Ml8UQSFf/fPsaxiIpIdpE4/W6+WNGY0uBHeMaCIg5aJ:sxZqOqYf/fPsaxiIi5/bG5u3A
TLSH
T1C252C6166A345977CCDBD209FA55BF53D6F90462D2944E44AAFCCA0C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0adf5d7a6077ae81f748a60a7d99767ddab60d4f5050bedf80182b2757db6b81
MD5 c479d7bee257437b0d367672d00af934
SHA1 2a56353f123128140b271ca7669e84cd254384a1
SHA512 d351204241a67dc89bb79c4c696e94af4152521ace076b7f6159a3104bf97986ecbbf266b063479b788b5c59b2deabbfb68f5912ed71e7da2cf8fc30d9a06f8c
SSDEEP 768:by/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lOArozt:by/Lh8dF2/kWRmAcQ3wu1jaKKjLp0DlK
TLSH
T101E22B3B690CCB7E4F840E6DEC266F976ED801CB96688D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 54b600c398cff68619eace88f446c8108c74630df5da506967138f71e19e4190
MD5 49d7910cbf1ef63d9b72a6abdd1eee8c
SHA1 9f9bb5ae967917467f9337e66a46edccbe6b4333
SHA512 07d91aa8053bc13b0082a102fb0ceff52e402dbfbe227c8e0163a50c184a7d1332ff360bb521b56dab4e62008c306e42bdd3b6c352c1c2dfab87a753832d9505
SSDEEP 48:K08I/KFGs3uI/Kv60ryI+vKO0YEg4gtzIBWgKO1Wsg6mwTdMety1rIZK4Ic7:K08gKFGquoKv6quh2KSUCerqK4IY
TLSH
T108B1415375BB02023C7E2958969187660B427667312CA53F7BF804B74E66E360DFC8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594193.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594193.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a6ed638b0eb5d05683d75332436db1100364b8dc2f5e7ae2bf0bea54cdb488f2
MD5 b2c881e0e49113de2b774b8ee127db47
SHA1 6d6531b7ee1b791658b86e2f2044f820a4169069
SHA512 6c0932b263bcf05e3edc77eedbd866300d80dc0dd63a7e029a10aa2e98dc3299d5aab0ee62e7dd4f2bed8b977a5eaeb75b6f6bfaec2efb068b72dfdf5d70e2dd
SSDEEP 384:PZcIm8Nl7x/3O40H2Eu0Fptx58Kvf0X3UUOObjI9G6w7Bm:HmQ1YBdbnJfcEU29MBm
TLSH
T1A0929E365C345C375AF3A551F48636239EF9902BE7C86B84A5FCE70C019F69C0306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 945882bb5a07a3ed717bc98f1f0dfb4861d22ac111a0887a3d4b7b4d47b2f41e
MD5 73b57c9cb4e9f3a97b6f498c7a6e7afd
SHA1 d42063bc40e7f2564213432932dae17bc6f1e996
SHA512 88b007303a8752790a27fc8cade8c3a859f2f9ae162fe4d275995901ec29b988f8bafbb011779fd0d9084ef55b95c0ca6b59c3bfeb7f1b84fc1d77e1834c074a
SSDEEP 384:ZiFzZcIaL8N/8TUNTUlIlwx/3O40H2Eu0Fptx58Kvf0X3RUOObjI9G6w7Bm:wFrYiwgG1YBdbnJfcBU29MBm
TLSH
T10BB27D375C248D7BAEF79E55F98A36139EF54167D6D8AB80E2EC9B0C019B2DC0306C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 db80d44b6b56143fc47b830559554a8dc8bca7f5b1dc84e00ae03c232ecd0e01
MD5 4334a29d1b1cd531de0c81059cbfad8e
SHA1 1425ca9f9f062957a0f32222e85a8509ece3c4b7
SHA512 26db14beccdc3fff55adfee1d91f9f8f98fdb1bbf0ae7cf827055f80565102cf76fd0ca3030bb426a4b2f14242913855cee069622d10449f9547d6e28c0b9741
SSDEEP 192:qGN46d9402QmiUyCvBTBF2oP1xljzorKkorGw9vUvpU6:qGN46740S9JTBFptx58Kv5IU6
TLSH
T17F02E9366C386CBB9FF36E49B54737136EE5116BEA942B44DAF81B1C00DB38C1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 afdf5b281c92933315f28ff16640c9d9363a9ec35ad1ddbd86a513d4dcb824c9
MD5 bd037cac16e08a0cf624a7265d64f066
SHA1 6b466c808dd6df736e1b30ffe5616c7c57c931b0
SHA512 fd0bab1b04263a23530aad55d02eb8c6695067aeee2b430d543472487951ab0705a7c7644b707a1612ba150a9f91c6857b240d7d067cc749899de3af44a22718
SSDEEP 192:AJGNo6d940hQmiUyFBKBF2oP1xljzorKkof0Xo+RiD1qxU6:GGNo6740/mKBFptx58Kvf0X3AUU6
TLSH
T10612F93768386C7B5EE37995B5873613AEE5411BEA887B40D9FC1B1C01EF29C134AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bb76a0cf3dc9f810a5fbe3e471b161f8a93d5214e853062af4e064c41dee6e49
MD5 c2cccc6296a52733a1c7e7316878f2d0
SHA1 b7e57c5ffe8bdfe375ce713c17ee390a8443347b
SHA512 01a0a2fcd7695f3677d7ef153433e618e7aa5f56d3aab0115664fc674053a090dd7744dca4503e493ec08cb4c04253427a0ad5033cf2fa66349c7861b0498908
SSDEEP 384:QZcIm8Nl3x/3O40H2Eu0Fptx58Kvf0X3UUOObjI9G6w7Bm:umA1YBdbnJfcEU29MBm
TLSH
T121929D366C345D775AF3A555F48636239EF9902BE7C86B84A5FCEB0C019B69C0306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d956bc85-8d36-41d3-b03d-3603f5c9fab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d956bc85-8d36-41d3-b03d-3603f5c9fab5.tmp
Size 20KB
SHA256 878747b79657b702f42fd90001febd59a8ddfdf8f06f9f88dc328bbdc6669a90
MD5 e3cdf00914a307ac0d2b1da88c57afc4
SHA1 cde1750123181337a888968469f4df147cadb9b7
SHA512 43c81f9076ca9069ed9abe65a317eeb110da3c67316aa10cae66bce5fdcfb739187310eb504f30571f525ce507e8460ce2030d0d7ab870f9b3c2ccc6306363e5
SSDEEP 384:CZcIm8Nlwx/3O40H2Eu0Fptx58Kvf0X3UUOObjI9G6w7Bm:wm11YBdbnJfcEU29MBm
TLSH
T1D5929D366C345D775AF3A555F48636239EF9902BE7CC6B84A5FCEB0C019B69C030682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c619cb3b-edcb-4d71-9738-dcf038a9116a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c619cb3b-edcb-4d71-9738-dcf038a9116a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download