34cedbf084cd0a463b7ae2e38c6711ffcbcbb6a997e95f019da9e4c4ebe4b8d2

Resubmissions

03/08/2026, 10:18

260803-mcdfyavaqf3

03/08/2026, 09:25

260803-ldsftafp8x3

Analysis

max time kernel
148s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-1.html
Size 142KB
Sample260803-mcdfyavaqf
SHA256 34cedbf084cd0a463b7ae2e38c6711ffcbcbb6a997e95f019da9e4c4ebe4b8d2
MD5 27e14a35a88d2099d24929f6919b03af
SHA1 30fef79e0375ea84ccf97b9572bc9a55c98bac4e
SHA512 19a74eb0db972d46c1999e082c09d6302e482ee88e448162054e4025a032ff7c5523ce9086a39052c54a43819ade2153a8d485098a30ac5c5bb0f371698b56db
SSDEEP 3072:PopHtPSFo2/j0R8wRhwRaS5NtRL++AIBPQQmhYJZzwLkLhJr6MM62OhFhFhFhkTI:gltPDeCybuAPffffKG9OOOO96l4
TLSH
T1A3E30CE0385B125ADFD3E62BB30411017797BAEEC89C12E29B349278C9D4C76CF56D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302259855630516"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{55DC9944-8674-442D-A766-7D452CA7448D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1360	4860	msedge.exe	82
PID 4860 wrote to memory of 5000	4860	msedge.exe	83
PID 4860 wrote to memory of 3484	4860	msedge.exe	84
PID 4860 wrote to memory of 3484	4860	msedge.exe	84
PID 4860 wrote to memory of 3484	4860	msedge.exe	84
PID 4860 wrote to memory of 712	4860	msedge.exe	85
PID 4860 wrote to memory of 712	4860	msedge.exe	85
PID 4860 wrote to memory of 704	4860	msedge.exe	86
PID 4860 wrote to memory of 704	4860	msedge.exe	86
PID 4860 wrote to memory of 704	4860	msedge.exe	86
PID 4860 wrote to memory of 4948	4860	msedge.exe	87
PID 4860 wrote to memory of 4948	4860	msedge.exe	87
PID 4860 wrote to memory of 4948	4860	msedge.exe	87
PID 4860 wrote to memory of 1732	4860	msedge.exe	89
PID 4860 wrote to memory of 360	4860	msedge.exe	90
PID 4860 wrote to memory of 1732	4860	msedge.exe	89
PID 4860 wrote to memory of 1732	4860	msedge.exe	89
PID 4860 wrote to memory of 360	4860	msedge.exe	90
PID 4860 wrote to memory of 360	4860	msedge.exe	90
PID 4860 wrote to memory of 5108	4860	msedge.exe	91
PID 4860 wrote to memory of 3192	4860	msedge.exe	92
PID 4860 wrote to memory of 5108	4860	msedge.exe	91
PID 4860 wrote to memory of 5108	4860	msedge.exe	91
PID 4860 wrote to memory of 3192	4860	msedge.exe	92
PID 4860 wrote to memory of 3192	4860	msedge.exe	92
PID 4860 wrote to memory of 5428	4860	msedge.exe	95
PID 4860 wrote to memory of 5488	4860	msedge.exe	96
PID 4860 wrote to memory of 5428	4860	msedge.exe	95
PID 4860 wrote to memory of 5488	4860	msedge.exe	96
PID 4860 wrote to memory of 2356	4860	msedge.exe	97
PID 4860 wrote to memory of 5880	4860	msedge.exe	99
PID 2356 wrote to memory of 5552	2356	msedge.exe	100
PID 4860 wrote to memory of 5928	4860	msedge.exe	102
PID 4860 wrote to memory of 5940	4860	msedge.exe	103
PID 4860 wrote to memory of 4540	4860	msedge.exe	104
PID 4860 wrote to memory of 3604	4860	msedge.exe	105
PID 4860 wrote to memory of 3604	4860	msedge.exe	105
PID 4860 wrote to memory of 6080	4860	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e0,0x7fff7af7c188,0x7fff7af7c194,0x7fff7af7c1a0
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,813207013162470628,16198745482937210565,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,8427647912302630904,10706429014669057496,262144 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,14524985556931936363,7788890859022507209,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2881677641761832617,13975175621360300474,2097152 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4580371362542389567,6084142624115811211,2097152 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,8784969049617315268,5850460581258480636,2097152 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,2872502239200585229,16995620662070808262,2097152 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,9963708021297784769,6270227225859005683,2097152 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4332,i,3918091751610844872,11668657377445101895,2097152 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,3739106601812264317,11264565250571871490,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,3302967446223415451,17605210587045648845,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7707627037309726068,3330500534446722002,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7056709611163109666,11177894189598426852,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7056709611163109666,11177894189598426852,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,11941576507393206585,11960152283072877896,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,11462415675916938036,10465753834548896596,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,13090780434620395591,1013857196006253526,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,9432193345521572180,1172298630191098513,524288 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,411535947107731939,4543337526736928209,262144 --field-trial-handle=2132,i,9692255261916450991,3034738377301966936,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 81b365ea82409f1ccac31c98ea2ca4cb0be5b910a6b11b18a5c9be98e7453029
MD5 37a277076f38a82edcb5a0af5f60a32c
SHA1 339819b250b6da12057b67147abd36254c573078
SHA512 9e636589953c256d141c7fa0e049bee89baaf40dc67e09598af97004f3b13f57e1f222db27a50ded645e94d608a67a2b2df8f4c430c6547b29ed44a1a383327c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T100B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

641a7aee-6ebf-4546-9c87-ecde5683818b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\641a7aee-6ebf-4546-9c87-ecde5683818b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b33fc3937fc2b4185cc04596c86a15eb57ed6b532b872c191b8e05c9a656cbf
MD5 53250e768d59d233c434d5d2183ca5e4
SHA1 5d05fbc13c6e6838dc45f14cfca98815c2d9c1e7
SHA512 fd9e420167c1d90679b22b94a7944db72452dae7313f8a76a0a7dff28999982911924b24e244dd272d8613cb01e50c7ac07cdb4249666c597b7cb1496ca3ab5d
TLSH
T1A37180C4CE429D93E7A6CC729CF0860570B1B5A50E67DE040594B5F576D5B63F11C437
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a013.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a013.TMP
Size 3KB
SHA256 f38c3db31417b2ae292286c45189224bc4b576dd108d5f91af67ec5281092694
MD5 f706e0d6affdfca1ca9d651973ff8754
SHA1 072ed3c871fe779d063ee3e5d2af723a50cf0145
SHA512 3daa81bcabd7d97ad2c0cc68e5c784bbe56b6227579dd77e8e5f1c10f22dde63f281baef610ae972f76bc6494e6c58a02b83ac2b9f9bcb430ee74a02f63ff258
TLSH
T1B07190C4CE429D83E7A6CC729CF0420570B1B5A90E53DE040450B5F576D6B63F01C43B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ede9a0b8407f7fb42b6d64ea0b5a4a967efeb15dee55fb1909a87fdc46ab7db2
MD5 4e0ba943f411a2d7e695905e3fe898a2
SHA1 0fdea7a69ae3589830f3340c692a692d7506cc91
SHA512 080bdc218e2257c1d0be92e4461ab80537c077c1d09b52f231fb86ab37024d4fc83734ac4422a8efeecd7cee2f2180a29aac56c83cb6b6ada28d863bfdfb71e3
TLSH
T135117AB7C3D595AE890516F05A24AE2BCE2E0606421C7C29C9D4FF6B93E3475E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 75371131a1c118df358a19078aa4517eba17fcac33f23956408d3b3c312cfddb
MD5 b50d18041396e9d1e803900d5b62daab
SHA1 20f7572900a8dffe858335370f240aa28436f247
SHA512 dbd2089b2227ca57bb90ce2976f80de8495dcdd037ffad0c78c3f1ce7b3217ab31022213b41bcd1e30bb67775ca1a863ca9725307e6e3012adca54c71a0de014
SSDEEP 192:sxZrRryM/jK1Ml8MFp/fTsRjDIdpyAl/W6+WNGY0anMvRIgrJ:sxZrxdp/fTsRjcD/bG5J9
TLSH
T1944208016A34697BCCCBD209FA457F53D6F9047392940E54AAFCDA1C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e0d4aeba65af66cdb0d0c5505c33035436d4bc8de47b3c6ed324fad9c36f198
MD5 4b53b22e38ecb112e35bffddb6d4fc25
SHA1 330d75111dc108abc8ef74fa67e45ae58de6ea6e
SHA512 c9f598eaa9cd7215a770c43817dc6166b72fc0dce69e4245dbf48e137babb528bcba1997f41ec02c9750623e2421f4eb28178d2cba8937af2a58617e9bc14bff
SSDEEP 192:sxZrRryM/jK1Ml8UQgFp/fTsi5DIdpEAl/W6+WNGY0a4nURIg5+J:sxZrxqWp/fTsi5cp/bG5uQ
TLSH
T134520915AA34697BCCDBD209FA557F53D6F9147392900E84AAFCDA1C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 3af90c25b4a81a5c9fefc33e7ce2280542c0a96c5f1258a277e42e254ef727f1
MD5 a593641a2e6b813301c2ac35c1357a8b
SHA1 a6b59a32fe334fbe845c679dc474be827880da3d
SHA512 cb6f2caa867c79bcf86dfd006fba6883beaaedc867ad90af44abfd1dc6dbbfb19c4c918a31ed3ad46b748c25cfbe10435af0864d16db94562cf050fcc627d3da
SSDEEP 768:ED/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VXvro65:ED/zh8dF2PkWRmEcQXwu1jaKWjLp2tVD
TLSH
T1FBE21A2F280CC7BE4F844E9CEC2A6F976ED801CB66684D5447FA894C03C77DB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c8a5fcfc9266f06fbf54570f97591bff0aac8d8956cbfdeccae8dfcb39eab844
MD5 6ba6e704541d15c69f75c35264f45ee4
SHA1 f48c01eb672738bc0cdae07f9328c2b4a877d26d
SHA512 5aa81bbf1ad731b6a493a63ee8e3eb31ecd6e2dee901894b7c48f60eef8a81d3349b8b4d36316dc8932721fc57b2b8da6b022b1c5b1580ac84aeae402ebaf663
SSDEEP 48:KEWIHKvf5IpK6k0TyhwILKda8jypWIHK3KEi:KEWgKvf5GK6kySwgKdayKW4K3Kh
TLSH
T167B1978671BB42123C3D3918A291871B5A427B67305DF96FBBAC50B10E67E146DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9dbdbf2320745d107ede3e7f34f9fabae7ac7d0d9f814222f09fef3b5f3bee14
MD5 fa7724748ff51dcd15bf65e134285375
SHA1 647db929e926b1e9e17e58deb659df8192a77475
SHA512 b3d995996cf32eb69d4a42d282b1da08555725c987e5741a571cbc7bcc3ca55d7aa3a7ca7e540f00fd8e0a41a2f66f883c3924ef0e1f4f05a635ce38f075472b
SSDEEP 384:vZcIn8NPhmqfZuuI1qnsPOWESLIO6HlytEDq1pUw:nn6ZMesPONSLIOoy6DqnUw
TLSH
T1B4929E3159742D775EE7E145F48A36038EF85063EAD92FD490EDAF1D00DEAE8230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f83803149290eedaae76e45e628cf97607b713657135dfb56499e018601a49ad
MD5 6ae1379456d22c7c9390ae6347f8f968
SHA1 4cb38801d1154f5fae21580d76d2e705f00399bb
SHA512 338069d952f1f7147ac33f6f4039843cd0f6d8c20c2902b15c652c176206225898080b418a4a1d65ff10b18bd3eb361017c9efe16072e86a57ff8d3d003af61a
SSDEEP 384:tFBZcIt8Nx8TUNTUlIl4mqfZuuI1qnsPOWESLDO6HlytEDq1pUw:tFJtUwgeZMesPONSLDOoy6DqnUw
TLSH
T133A28D3248B4897BAEFBAA44F44A36038EF84063D9D96ED4E1DD9E1D00DB6DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 798547f701501f9fdbf34eba0ea904c7be36c3240c6d9585a11be66876dadae6
MD5 41e9d50d913d1ce007c989435ad2d389
SHA1 2a893cf9231e290a26e02728f5d8d3f6f34e4526
SHA512 8758b827eaef88571ef6331194c57b742e542d70814247593869037cd892542128541b66851ac50e2290ae28d0646ed15ef18d305e80b69ee62f090210c72dfc
SSDEEP 384:uZcIn8NP9mqfZuuI1qnsPOWESLIO6HlytEDq1pUw:Mn2ZMesPONSLIOoy6DqnUw
TLSH
T1C3928E3159742D775EE7E045F48A36038EF85063EAD92FD490EDAF1D01DEAE8230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 37b2924517b9f9ac394bb051cabb9991127508ef78c7b70b183cb931dcffe08b
MD5 c06e68fd114ff6a6b581c93cbdaa4e2f
SHA1 bfbdb69482f25286745f0ed9dc92d273eeb674dc
SHA512 39c6a665411c3a98c47e5fa04076e8a9a3f9f0b8f69329c9bf2147fe0962fb9bfa2118fa11d8f557693da0529d96f86f51511063202f69d54a48961efcd3b966
SSDEEP 384:yZcIn8NP4mqfZuuI1qnsPOWESLIO6HlytEDq1pUw:AntZMesPONSLIOoy6DqnUw
TLSH
T197929E3159741D775EE7E045F48A36038EF85063EAD92FD490EDAF1D00DEAD82307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b9fa2987961ad5011dd54d7cf39390e24855ed59695652bda818d14af2de1b6
MD5 beef08518d29ef0412d6d7161c4419ff
SHA1 7bd2bc71b96d5781e443c054bc3c663dedf93be5
SHA512 ab84602cb627e5d343391804015a05ba2e36f821836addb9c068291c7c6d31a2c1f12c09c01b3c05b7cade982c2aa5002b65ccdef27f6db329a9c389213b2170
SSDEEP 192:6GN66P2UmQmiUyhEH2Gv0POWESL00BaEqjU6:6GN66eJwo2GsPOWESL1OU6
TLSH
T16F120B7A6D746C7B0EE2A481F48736138EE85167EA4A3F80D0DC2E0C01DFA9C6347967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63b661ec5bb926125f4c944566b6cdd7af8d15e2df153c51cb94fe920abbba28
MD5 fd8bc3bdaae3930d4efbcdfab9f84ee6
SHA1 f8fc828941c21246927502e84c6254b932ef78a8
SHA512 1e157ac0a55451aa6c2c030400fdcf644422bbcf5cd5b89ac9b7e548be155c0ca8176b2b79654d8fc527d35fa8b30301281b270d60ab7703172e16d7000e1279
SSDEEP 192:BGN+6P2UOcQmiUyRIUHqGv0POWZwSaEaU6:BGN+6eXs2I4qGsPOWxgU6
TLSH
T19302E879AD682CBB8EA2AD45F88777139FE8107BEA962F84D5D41E0C00C765C2347937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4253c8d2-b73f-4f8e-8916-6eb0477c1a1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4253c8d2-b73f-4f8e-8916-6eb0477c1a1e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download