hxxps://atomicmail[.]io/?utm_source=app_mail_signature

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://atomicmail.io/?utm_source=app_mail_signature
Sample260818-gpv9maxxhx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315063827137586"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{8B3B6C56-0EF7-4115-B12B-8F56EF039620}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 8	684	msedge.exe	84
PID 684 wrote to memory of 3364	684	msedge.exe	85
PID 684 wrote to memory of 2760	684	msedge.exe	86
PID 684 wrote to memory of 2760	684	msedge.exe	86
PID 684 wrote to memory of 2760	684	msedge.exe	86
PID 684 wrote to memory of 1736	684	msedge.exe	87
PID 684 wrote to memory of 1736	684	msedge.exe	87
PID 684 wrote to memory of 4044	684	msedge.exe	88
PID 684 wrote to memory of 4044	684	msedge.exe	88
PID 684 wrote to memory of 4044	684	msedge.exe	88
PID 684 wrote to memory of 1380	684	msedge.exe	89
PID 684 wrote to memory of 1380	684	msedge.exe	89
PID 684 wrote to memory of 1380	684	msedge.exe	89
PID 684 wrote to memory of 1468	684	msedge.exe	91
PID 684 wrote to memory of 1468	684	msedge.exe	91
PID 684 wrote to memory of 1468	684	msedge.exe	91
PID 684 wrote to memory of 4528	684	msedge.exe	92
PID 684 wrote to memory of 4528	684	msedge.exe	92
PID 684 wrote to memory of 4528	684	msedge.exe	92
PID 684 wrote to memory of 3412	684	msedge.exe	97
PID 684 wrote to memory of 2968	684	msedge.exe	98
PID 684 wrote to memory of 3412	684	msedge.exe	97
PID 684 wrote to memory of 2968	684	msedge.exe	98
PID 684 wrote to memory of 4832	684	msedge.exe	101
PID 684 wrote to memory of 4832	684	msedge.exe	101
PID 684 wrote to memory of 4832	684	msedge.exe	101
PID 684 wrote to memory of 4100	684	msedge.exe	103
PID 684 wrote to memory of 828	684	msedge.exe	104
PID 684 wrote to memory of 828	684	msedge.exe	104
PID 684 wrote to memory of 828	684	msedge.exe	104
PID 684 wrote to memory of 4680	684	msedge.exe	115
PID 684 wrote to memory of 4692	684	msedge.exe	116
PID 684 wrote to memory of 2828	684	msedge.exe	117
PID 684 wrote to memory of 1924	684	msedge.exe	120
PID 684 wrote to memory of 1924	684	msedge.exe	120
PID 684 wrote to memory of 1964	684	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atomicmail.io/?utm_source=app_mail_signature
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe0325c188,0x7ffe0325c194,0x7ffe0325c1a0
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,12338408777291526333,10709715281616245106,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,18012329534160072244,10969167109313551477,262144 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,2049712827529493327,6036009725763994488,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13892098927096144826,15844368639295600224,2097152 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,18089759832436368235,11331866276412130287,2097152 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,12138892914124264949,5121288889325611877,2097152 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,11034393256796818717,5464040571325613895,2097152 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9321870048534204752,2775134932280841350,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11637709702001777253,6409171558950497659,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5856,i,15781539749711253903,11800496198433309767,2097152 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4707065616717684204,5650103105186140704,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4707065616717684204,5650103105186140704,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6444,i,9608074341982274349,8509407602566052921,2097152 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,2068818627938768222,12687679777161860687,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,16583458416096434150,14765429678483208698,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,5354156511581297265,4411930520266731781,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,6796287724018680249,774879756979924244,524288 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4796,i,5956609114168323654,12039933016496252664,262144 --field-trial-handle=2772,i,3014250152685866883,10453462219390922390,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2a28ad9180ca01317e1ca1c5160e00514ca1486a9cee9ff05014d45e09152fd8
MD5 254f48076c8c8de5fc551565f82749ca
SHA1 6f9315a178cd5d407e8e6c99bca73dd375ad5161
SHA512 c37675021769ddeabd6819dd0bee80f6dc387978579c46c2806e9471fc32d01b1cae128b0dc5644964f73815c35ff6abbdfb59d98a693007e3fbc791c12ea58c
TLSH
T13A5172B4D0A26523EB621431A1E62F6D3971BFDAFD27CD7340909D32450F7D08B564B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592178.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592178.TMP
Size 2KB
SHA256 128483f884f477d56b8c2a44309c58e4b5ff92f6488a3bd1cede59ccacb6630b
MD5 17c408a12fa1ecce7d85a66fc3f7ce49
SHA1 8fac177321c822d60dcb4e1dada51f618900bb5e
SHA512 6551ae798f9dee15ebf89dbd96a5f3642be1c41ccbe198f6a0859b10a2804307e0287e8d1e72f02d85f5022c947c1cbc3307e15e099fd753fed144c4626ab977
TLSH
T1DE516FB854826523E7251031A1DA2F7E3876BFDAFE5BCE7740908D36450FBE183A9478
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b22ea6b0740afb380918174c282945e52c723b3a7b025dbaed77a257739d15e9
MD5 eaf8fab800cfac7623ebe52f8f5ef3af
SHA1 27cfc20cddd3f875294955b3456e60619b773bbc
SHA512 5da647002f4aadef1e01771d74ca8bd70924f933fef3afe498b20704c2d22898cc39d8c3cebb8b32ba47f391acd1f19f6d0e346e0bcec8f9358dafd34695b2ce
SSDEEP 96:DWOLCL8LSLeLWTLYLYL4z+PLSLdILyfeL+w/L6LdJQuLdbLfLOVL+MLXNGLSL2Lm:D1LCL8LSLeLkLYLYL4yPLSLdILyGLb/P
TLSH
T19AC15AFAC2E89B6DC90257F55725AE1EDE1D061C87683C2AC9D4DF4BD3F2062E10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9835a49d998cdc2a7c0e9f342b43eb15b3891ddd5d61340187f0d19e137da929
MD5 a40a4064c83df32f122453b115a8f3fb
SHA1 d2e1f2094f4ec4129e071f136875acb72b605317
SHA512 cbbbb90c903e6c5eeb229c55cb9c2d9e7fbf62bf4f2a8c84079faa960a343644a756ddf4bb0f02e2b2b844117eb0a4bc8bd7f209c96250a9a0cc5d1fdb7d28e9
SSDEEP 192:sxZUNRI8yM/jK1Ml8Mku/fwshs34IdpJlaHW6+WNwrT/Y9I3lG1IgrJ:sxZUNy8Mu/fwshs5OHbw/09
TLSH
T1F452F8126A34A977CCDBD309BA41BF53E6F5457292940E44AEFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e02e05ccd1ed77cd35c31ed5693334af2bea5b859c6e783daff355a6d918ad14
MD5 aa6e6ab187b161835e6bf57319803bae
SHA1 9f1a254cebf0986c47a922b0cf209a3047ef7758
SHA512 2960ab065dfaef6cf34e083aced1dd601fb8d103adef4c77368329b461028137622dc2315f1ad092b0164cfe7d70bf66f8d47e50f527953d6a9d8a60449f574b
SSDEEP 192:sxZUNRI8yM/jK1Ml8UQwku/fwsCi34IdpblaHW6+WNwj0XY9I/mIX1Ig5uJ:sxZUNy8qDu/fwsCi5MHbNXXnQ
TLSH
T1C452F7126A349977CCDBE309BA41BF53E6F5447292901E44AAFCCA1C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b075fb828788a5325dcdc3cf2beb4f9176e9dc45ebc9fa107c7da05dd492ca49
MD5 15e2381a5ff1b4059b1dc046aa828c1d
SHA1 fa52b8b47b19a94b62c83528567b04baea0225f7
SHA512 5434c1e561d4fa294bf2dabdcb6cc212b0a58ecece17f6961b1a94913f95bee3921c775076549528fdda5edc60280f7dcd3f5313848b7887225542f92f1c972b
SSDEEP 768:yvcv21wWvu+z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNWroGg2u:yvcv21wWvu+z+u1jaeFLeRNtGq
TLSH
T113E2FB2B280CCB7E4F845E9CED2AAF8A6DD801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bc9461bc8e2052e6918599975052984339d1e497\index.txt
Size 135B
SHA256 7a511c597e0b2b8907cc4f6c313956f32ce3f8364d81ed3848f10a9b63f70eb3
MD5 bba78fbe9d61ba03fa7e472350768d96
SHA1 d9c405ac2508d9041b5af970a4ca2a7afade6129
SHA512 2821326f03ccb0aba26d6a81218c69a07ae283d90b0446cba9917c2621d5d71e5264a017bbc48ef597fde92dc6914c25f11e51056b1eb69069a4f79612624caf
TLSH
T153C02BBF2309423ACCFC49A41821D0302107101C9EE9F138C3C582524F4145CA0730E7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590e4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bc9461bc8e2052e6918599975052984339d1e497\index.txt~RFe590e4e.TMP
Size 142B
SHA256 f8005d843b367d7f773a9bf9b0e391c6730c4126ae4aeed5c0220e5f2450429b
MD5 5c68073534cf04076ee5d715b77c8764
SHA1 e2f836ee1ddbdf3ed799ed1387777f143d3fb39c
SHA512 ee118c9b4f8a962d07d70206b7dfa2c5849e4867abfcd62d7c5d01c35da017f43e05e82f4ebb046f96e6fdc7699964ff59b4259905a04ed217c884257cf484a6
TLSH
T19BC02BBF6319023ECDF844A424B1D05025071C1C9EE9F138C7C6B1624F3145DE2360E7
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a9b44833d459afa8a1057ecb2c1b6b8245c74819003fa7aac2efa7bbb1bb9046
MD5 7075a65a5693dcb7fe804683cfa440d5
SHA1 2a2ec1f4e6c1bfb9d41aa77b3c860ffc512416be
SHA512 651fa4ad75a96dbe1fbd0d470f852b7d4e3817fbc2389b19e1f2ee39e65d1c8eabca64c71dab26fdf2fedfaac6b05a561a2bd0327f767b882bf04572dcdb8a34
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKAIKZSGON2KWwCnr+JFTBBdI9UQqtdKCcn:mT3LVxnr+JFTBBi9UBtXcqzs7z7cQ
TLSH
T114C12702303F0242397D7908B36A8636AE4172673814A8BF7BB910A15F27E221DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599baa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599baa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a9bebe4e74c369cc34b70def1a42fd8272a522fea0255e2f6a01715fc5ea83f8
MD5 60b25c2539450cf34ffa012a9c0adfc6
SHA1 6bdd8336b699837c2394774eb62e789b40005a74
SHA512 26975b181df562f5bb0b83ccd9686eef4bc1b13d1db949a383e07f51be330f709c914edeeb4cf364192d3e2503106892ffd12ecb35b8f33059491df1d3d89aa4
SSDEEP 384:EZcIhsNaiIK4TrziMbhe+CQdi++q1ySllYJTfY81FeDbtBuO:ih/tY4Exq1ZuTHgdBuO
TLSH
T196927B7258345C6BA9FBB658F54B39035EF88067D3CA6AC0D9EC6F1E01DB5A81306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60230c7950775e5f314a619213549c419c74dc55e79fdf285e0a3a70650ceb8b
MD5 4dac29981a26ffb391f3e73b7c4e9419
SHA1 0bbf4f3933fd51a71046c0a761b5c187825d4bda
SHA512 04436d955ee64dbb657344d13b254128163d58e260fdb92650a51ff42a04dd076ea6180923e867b7d4c827a22e2f49915e9b38d29e22920c03c32ebb1fbdaf2c
SSDEEP 384:gyiFiZcI/sNi8TUNTUlIlDIK4TrziMuhe+CQdi++J1ySllYJTfY81FeDbtBuO:g5FQ/zwgW8Y4ExJ1ZuTHgdBuO
TLSH
T1A6D23BF248D7487AD9AEA747A77E2D034EBCC067F6856680B7D85A0DCC960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70807107d301f89575d17086a6a0ea0b93a44e3fb2b1c6b490c75b36affb051e
MD5 eaf5fa1bf74256f70c6b1b0625e7ca09
SHA1 8a76198e26ac6d818b8091a650ce484847f50205
SHA512 5e205b13910afd91b0a4f36d63cd8f7ea8af9c645f1a3907534fa600d0b78d753b2fb7c0945e0780233b6b6eb65976af49534fddb34ef0c4abcfee27d8e3b1c5
SSDEEP 192:JONB6v+YLNQmiUyzeZh+CG6+FdetRLuszLTU6:JONB6vz/TZh+CQdMbU6
TLSH
T13C02FA35A8782C6B9BF6AE45F4873A235FE4103BE9962F80DAD81F1C01D764C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c86d58fc594b4ad85dd4df1593b7aa2f8860efd12007f71b8487b8c157fc9b10
MD5 19f1095b2c1d36c18c5764eff2aa3049
SHA1 fd4f88c57d015e7bd207769c11c87654598957c6
SHA512 8c8f2095519cc4a73f7090f9fbfc8b80ddadc9c6834b38b605211db87773529f974fd5177a5560a97d54a486326d419e2bfdb0278a743a3f49ed29636379ac3e
SSDEEP 192:rONL6v+YLqQmiUySeTh+CG6+FdetRLXx++eCHAqLU6:rONL6vzqoTh+CQdi++f1U6
TLSH
T137120A35A8785C6F9EE2A944F48735136EE45127EBCA3F90E5DC2F1C01EF69C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 80ed0cbc5f6f176235f566c50f307dd875e1b9b1e60f6831d6520addeb768284
MD5 5163627e67a907af6fd9b89342fe5e67
SHA1 1801569918362b90eb795241319e1f8f3794488e
SHA512 00b73b2db28bbbb9f3853b142e24b3d2908d9cf0083015d12bafb54845c209a2d34853e4d50a04c8c2cf50998cefe9e63742b5907d31452f8118892a211f03bd
SSDEEP 384:9ZcIhsNaDIK4TrziMbhe+CQdi++q1ySllYJTfY81FeDbtBuO:lh6tY4Exq1ZuTHgdBuO
TLSH
T1D2927B7258345C6BA9FBB658F54B39035EF88067D3CA6BC0D9EC6F1E01DB5981306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afc69a66-4b7d-4366-aee9-e773e34a6d1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\afc69a66-4b7d-4366-aee9-e773e34a6d1c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e067253c17e80efd7149f769f82216978014e0e7b106da5f942e436b31c0422
MD5 65a4db223fef73c4391c17fb535d1412
SHA1 85a979bac08d5da74c024b5bf2415ad40a44c0ca
SHA512 b4fd9ce0c8ca89a0a2c8381f782336552cf47312de821b544ccd3e9e60d2ae3c27c85ea691c5cfe4ccabcf78999c1c11160f998728e3ac10f9d919b8cf0e427c
TLSH
T1BB41EB58A6F91149B3B76F5A9BF6A8AD487BB8372F06D45E00110E4F0627A41C871737
MD5 SHA1 SHA512 TLSH

Submit Download