d86f8863e7160a7eba89fa40aee64bfea06344b5bf63617eac498b83a405c3e5

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-1.html
Size 82KB
Sample260810-rtpyhsbk8y
SHA256 d86f8863e7160a7eba89fa40aee64bfea06344b5bf63617eac498b83a405c3e5
MD5 ac8795b7bb622a583b0fd35accacd253
SHA1 9d4210de7110a1f44983a66e85c7e66877382411
SHA512 5a7f990488e24715ed9f91f1e792154656a963a94b912cde1a085bb1144e83e3577100be1dd727bdb921f8c4b4cfbe11c373eb441e12ffa18505375312e1fb32
SSDEEP 1536:k7OYJg+JcytonNJZNJOiEEum/JcyLljqJ:k7ODVfZfsLEUJ
TLSH
T12F8394B540B88FBE066383FBABB09E16B7766009DEDB210479EF97B407D6C94D56E400
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308495801124604"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E053D391-EC03-4A66-9403-632ACAD4F961}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1220	1404	msedge.exe	85
PID 1404 wrote to memory of 1412	1404	msedge.exe	87
PID 1404 wrote to memory of 4420	1404	msedge.exe	88
PID 1404 wrote to memory of 4420	1404	msedge.exe	88
PID 1404 wrote to memory of 4420	1404	msedge.exe	88
PID 1404 wrote to memory of 2072	1404	msedge.exe	89
PID 1404 wrote to memory of 2072	1404	msedge.exe	89
PID 1404 wrote to memory of 3248	1404	msedge.exe	90
PID 1404 wrote to memory of 3248	1404	msedge.exe	90
PID 1404 wrote to memory of 3248	1404	msedge.exe	90
PID 1404 wrote to memory of 3764	1404	msedge.exe	91
PID 1404 wrote to memory of 3764	1404	msedge.exe	91
PID 1404 wrote to memory of 3764	1404	msedge.exe	91
PID 1404 wrote to memory of 3964	1404	msedge.exe	92
PID 1404 wrote to memory of 2660	1404	msedge.exe	93
PID 1404 wrote to memory of 3964	1404	msedge.exe	92
PID 1404 wrote to memory of 3964	1404	msedge.exe	92
PID 1404 wrote to memory of 2660	1404	msedge.exe	93
PID 1404 wrote to memory of 2660	1404	msedge.exe	93
PID 1404 wrote to memory of 4992	1404	msedge.exe	94
PID 1404 wrote to memory of 4992	1404	msedge.exe	94
PID 1404 wrote to memory of 4992	1404	msedge.exe	94
PID 1404 wrote to memory of 2600	1404	msedge.exe	98
PID 1404 wrote to memory of 3244	1404	msedge.exe	99
PID 1404 wrote to memory of 2600	1404	msedge.exe	98
PID 1404 wrote to memory of 3244	1404	msedge.exe	99
PID 1404 wrote to memory of 652	1404	msedge.exe	101
PID 1404 wrote to memory of 1796	1404	msedge.exe	106
PID 1404 wrote to memory of 3220	1404	msedge.exe	107
PID 1404 wrote to memory of 4796	1404	msedge.exe	108
PID 1404 wrote to memory of 4520	1404	msedge.exe	109
PID 1404 wrote to memory of 4520	1404	msedge.exe	109
PID 1404 wrote to memory of 4320	1404	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffade1fc188,0x7ffade1fc194,0x7ffade1fc1a0
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14729145028519432809,17495578883279281951,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,11800587258438034412,7282317577689462375,262144 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,15592044929445400922,6801666284245861162,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3427861417750154422,3201425865012062797,2097152 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3132342844500007839,3065195512652821290,2097152 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,9276063469401528477,1397742791856819566,2097152 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6146615670318407511,16849531361180456190,2097152 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,10455691992680715331,7212752554096017526,2097152 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7526219672146883094,28533934320355144,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,1202732294641869635,14849302688413617849,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,16891844491739647445,18179320543954037397,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,16891844491739647445,18179320543954037397,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,9623967622508280987,13295566933245755648,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,18221659000463765115,8725447003587293062,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,10715168012993978466,17264203751733831079,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,7082775678258929174,223208309189860664,524288 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,10988242368177138630,4878590061150995425,262144 --field-trial-handle=2320,i,18169183660032490047,13982969317773485686,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b26ad87277ee247d8766edcb60e57830b9654103a5773618b3f07ce17d00b3c
MD5 810bc6a1e9e51a7c98da303d461036a0
SHA1 ddb165e9167cbb8972e73a98c6092a37b617bb15
SHA512 0a71c7f0655fd1481bc586c705dac434ff77e10172142fb78fecde595fa0b9e629096ad4936bc40b2ecf45854607d90f4618f4f123f86419bbdc99017c1cd2ab
TLSH
T1A361C5710A9312B1EF15C63294DD025D3773C6F7FA1B6E8990809633B61231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587143.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587143.TMP
Size 3KB
SHA256 5646da4cdf94debade1fa60c070109315090324131c911523722b3449be77ddf
MD5 b4c82444101b6a69d5156c21eae0baa5
SHA1 487cf5a64aa236dceafd2f92cf677374e748da36
SHA512 7680bef098d63e9a5226fb68ee5a8031472a50a6f2f91c13d2c3006b4ca13ab1a1538594c62984de5cbd39cdf399c13abad472d558bc7f372d5ec9b9e0d1ceb8
TLSH
T1D661A5750A9312B1EF14C63294DD025D37B7C6F7FA1B6E8A90805A33761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 efc2dca789f599c7e1994d1d21c9deb847b759587ce91f38c0f3e016187c0af8
MD5 6673e1fe0fe92b478641e564c67bb96f
SHA1 30987e80f133c5a463fc9dcbb524c9a09fe07e04
SHA512 7f56201dfbda9e8b9b70c36fb76c814fd35e570a042eaed428346799b417eb9506b7c3684aea6b4afc6482b5aef703c17159d63cb552c805fbfb47aba0bd905e
TLSH
T12D2191B3C3D486BE891156F06E24AE17CE1D065A832C3C26C9E4EF1B93F2475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dc41fc3c0481e81bb2acbebf66683f8e6d9dbbcf79de53dcae2502401b16eb59
MD5 9b101f6746f3d82438a53dec6f3da832
SHA1 4dda79abfab9bebe50c1b35ecf743a69da143d7b
SHA512 e05ce36c62abff1a0a89df1cd7f796b01e6afd127cef07b2fb8d436a7723bfe8f07ad9b287a145f7adfe7bbf13d796812378d8c0dab32d2671537c2155217822
SSDEEP 192:sxZH2R9yM/jK1Ml8MkY/foxsekZ9caVOIdpdwHW6+WNGYvrEjO2IgrJ:sxZH2zMY/foxsekZ9ceKHbG9t9
TLSH
T13642E7116A346977CCDBD209FA45BF53D6F90472A2911E48A9FCDA1C04E6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fa261341c8839ad8f04ad7c64e020bcd397e7de2ac73a9a7bbebd4fa2edff05e
MD5 88035dd0dec1486dcd08656f51f9f84a
SHA1 f32e2830868ced34e2ae6eb91ff37637665f8d4d
SHA512 163b8454a14b5650272c829e4a2be011005cb2a1013d303e2f6d8c05eef0d7a1f5ca594e15275ab02321f44e8193e1e6b59f8200fc597e3df6cd06f2b84bff0e
SSDEEP 192:sxZH2R9yM/jK1Ml8UQrkY/foxsqkZ9HaVOIdpHwHW6+WNGYvJjjO2Ig51J:sxZH2zqAY/foxsqkZ9HeQHbGQtd
TLSH
T1465208126A345977CCDBD20DFA41BF53D6F9147392911E48AAFCDA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 43a60e45278122b0e888b3486f7165ac120b407e3f093a175ba0035a63c6713d
MD5 24c0ca889e6236720d162d001e56ff34
SHA1 bdfaa57b46d566b72c550557fd84dca4940b1746
SHA512 fd9f94837e26a38d1b980a449bd099b214668a1ca0e864bece4880e49f1ce7de6fc68dff5a4566ac456269b789c0b986e4e785cf72ac2d4cfed64db38f54e144
SSDEEP 768:YGseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pprrook:YGseJ3xWvhfynu1jaVcL88pYP
TLSH
T125D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA980C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f579ac07a8a9c591c6d0473ea95df54d70e511f3ffa03cd1e4a6ff5784f40cd6
MD5 32edb738e43e6023b0ceefa7dec6e5c5
SHA1 ba5d7c1fb2ffd0a88183e87797a9c9f6feb40abb
SHA512 eafa97eb24006588e93077135389d535e094e172e3b987f2069348524914e801f7733a1ad88ca5bf660edb8b37da2d0e73aa52c11047897503a4970d6f42a80a
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EA:KYHIhKggkXySdIxK+cMjy9dIJKmkMryi
TLSH
T1D3913E12347A12463CBE284CA296D6374E4231A3B559E4BF7FB900A15EA7F114EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590c2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590c2b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7f60c2fd69818af934f89bb801f7b796b27d46feb8dd4c4b21a8a2c69be2a3c1
MD5 f4497720c9b8f6f79c60138e5bf45e5f
SHA1 944fda6d5efaf2a97e1b174695ea941497e4c1d3
SHA512 085ebfd522aa307539edcb20b257d938759dd1295bcc2a0d6247aa09e9e6991771fe0d7be8b118a47c7830b74905a82aeb91d6c6e196d1f1355b5f9003ef7a60
SSDEEP 192:uem+xasuheOwQxMGsNaYQC8YHM7XS7QmiU1iAQ4MTobWCIK++Wyio8z1JqW0skYy:cZcIhsNaYiX7itlfzFIKPlAn0su
TLSH
T11A626CB26CB89C7B99BBF145F48932034FB88137A2C45B50E5ED7F1D00DA5AC131B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5f1cc39f5285ed68513b746465db14599fd4e6fb388a15341b39dfc6e0ad5fd8
MD5 9afb9f0cbd5e1171e566efe94b423ef6
SHA1 4a57ab42aedad8f7c659a3d6d061c4655548d7b3
SHA512 6cd20cced5403e30eceb49b003199893bb9f984e0b1f6206ddf787732564a2cc1090758102c0a6658cfe9a78b91e904dce952a9115ee3ae820d280e54d68122b
SSDEEP 192:uOm+xasuheOwQxMGsNaJQC8YHM7XS7QmiU1iAQ4MTobWCIK++Wyio8z1JqW0skYy:oZcIhsNaJiX7itlfzFIKPlAn0su
TLSH
T148626CB26CA89C7B99BBF145F48932134FB88137A2C45B50E5ED7F1D00DA56C131B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d4a6759c65d147ffb6b3e2ae1546f65edebb090179b3f2dddb808a0eb91bf9b
MD5 888e563c12a8500cf249498a08c52974
SHA1 bb5c58d1d08eab1d58f3ba58698c99af55fe5642
SHA512 86ea96916c2f7a36f63df40712d42cfd61c7d14898a5ee4a5c29596cff2da7bf156b9cb32350fbde43eee84011ebab33d47ce0f2c1511166f82f3d060376292d
SSDEEP 192:lONG6vMtPQmiUycYThTobWCIKp847ELU/u:lONG6UtRkTiFIKRqU/u
TLSH
T1CF020876BC786C7BAAA7BE45F48E23171FE4116FA5905B50EAE82F1C00D765C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4994d9e0ca560d827866528ccd3e8859ac510c66c0e4f7e669e0efe24c436967
MD5 2ec09a0e39cf3a276440987299a61873
SHA1 d50079b4431faba1cfec03558b8b30faa3be3fd0
SHA512 9f790cd9a1278871673c725e29288908117d69013a3220327ef37b0d4bf9eba052d8bc229e0582ea55123d2d0f9dab18aa90d0f342255a96bad6d4ecad655cdb
SSDEEP 192:hONb6vMcPQmiUyLY9hTobWCIK++Wyi380IJqWU/u:hONb6UcR99iFIKPlhnU/u
TLSH
T12D121972ACA49C6B9DA7B555F48E32131EB4826BE6C4AB50EADC3F2C00DB56C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1f98ad1a32071ca1f85e6dcc9c7f72a650d9523eca543fef085e6d8d2d3dd75d
MD5 d66febd57f79d17f817ae8346f855111
SHA1 7460650d8bc5c52eaacc98b82fd5a0ef1b178182
SHA512 05fab73d39153d68a02aaf0c903dbf58008d9473732167945dea551148298aa83d0450c774ddf049d5daffabe272c680906b05b40a537d31600d74dbdc7060b7
SSDEEP 384:aiFiZcIKzsNi8TUNTUlIlJiX7itlfzFIKPlin0su:RFQCrwgmXO7FxlinNu
TLSH
T157824BB35C94897FADBBB645F98D32038EB44177D6C4AA50F6DD6E1C009B1AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ce25fe2c729310386a623c2932bc608e1eb0ccbe60d130c58ac18910ea693721
MD5 510950f13286e0d3c611bd77b9643c53
SHA1 44be3bf0f3801f04536d84f2dcbe1d84617a3bd0
SHA512 8099cf04c53c03c64658ebc38076f9d27e47eb3b6066bf7e6c9e7289a1afa84156aae39efdeb172dabd9a90837c804dd671071e9d42d2a547ad9f5214fc500ef
TLSH
T1C8412758B6ED1148B3B7BF1B9BF7A46D447AB8772F46C49E10110E8E0A63A01C962737
MD5 SHA1 SHA512 TLSH

Submit Download