hxxps://r[.]mail[.]travpholer[.]com/mk/un/v2/sh/7nVTPdbLJ2bPauGpgwtb0wa5bxRuVE1/cbqVAOIxJ6V1

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://r.mail.travpholer.com/mk/un/v2/sh/7nVTPdbLJ2bPauGpgwtb0wa5bxRuVE1/cbqVAOIxJ6V1
Sample260818-rhphlstdme

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2760	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315359228574274"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B2E82DED-F393-4F17-9323-630C9C2B5851}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3408	4884	msedge.exe	87
PID 4884 wrote to memory of 2760	4884	msedge.exe	88
PID 4884 wrote to memory of 3164	4884	msedge.exe	89
PID 4884 wrote to memory of 3164	4884	msedge.exe	89
PID 4884 wrote to memory of 3164	4884	msedge.exe	89
PID 4884 wrote to memory of 864	4884	msedge.exe	90
PID 4884 wrote to memory of 864	4884	msedge.exe	90
PID 4884 wrote to memory of 3628	4884	msedge.exe	92
PID 4884 wrote to memory of 3628	4884	msedge.exe	92
PID 4884 wrote to memory of 3628	4884	msedge.exe	92
PID 4884 wrote to memory of 2884	4884	msedge.exe	93
PID 4884 wrote to memory of 2884	4884	msedge.exe	93
PID 4884 wrote to memory of 2884	4884	msedge.exe	93
PID 4884 wrote to memory of 2156	4884	msedge.exe	94
PID 4884 wrote to memory of 2156	4884	msedge.exe	94
PID 4884 wrote to memory of 2156	4884	msedge.exe	94
PID 4884 wrote to memory of 3196	4884	msedge.exe	95
PID 4884 wrote to memory of 3196	4884	msedge.exe	95
PID 4884 wrote to memory of 3196	4884	msedge.exe	95
PID 4884 wrote to memory of 4164	4884	msedge.exe	99
PID 4884 wrote to memory of 4164	4884	msedge.exe	99
PID 4884 wrote to memory of 4164	4884	msedge.exe	99
PID 4884 wrote to memory of 1284	4884	msedge.exe	100
PID 4884 wrote to memory of 3100	4884	msedge.exe	101
PID 4884 wrote to memory of 1284	4884	msedge.exe	100
PID 4884 wrote to memory of 3100	4884	msedge.exe	101
PID 4884 wrote to memory of 1068	4884	msedge.exe	103
PID 4884 wrote to memory of 1888	4884	msedge.exe	113
PID 4884 wrote to memory of 2856	4884	msedge.exe	114
PID 4884 wrote to memory of 780	4884	msedge.exe	115
PID 4884 wrote to memory of 2372	4884	msedge.exe	117
PID 4884 wrote to memory of 2372	4884	msedge.exe	117
PID 4884 wrote to memory of 1476	4884	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r.mail.travpholer.com/mk/un/v2/sh/7nVTPdbLJ2bPauGpgwtb0wa5bxRuVE1/cbqVAOIxJ6V1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7ffefc57c188,0x7ffefc57c194,0x7ffefc57c1a0
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,3556794096112118111,7185907724705560833,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14127343876517453335,9488457553213748473,262144 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,4240699567668624912,3040108266351065779,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,13492760129189384037,13385406533378324383,2097152 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,14515366720585769485,8451852877317314878,2097152 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11283988984211635230,17273970393203887066,2097152 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,9536418727213759736,5627792526251354818,2097152 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3696,i,4430119977175970664,1055060839143251460,2097152 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,3249701971539835470,15403879076264775721,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,664113470742561455,15067309859740343404,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,11379596720109365703,2635258873397773742,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,11379596720109365703,2635258873397773742,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,8021827936024788143,3771316512043545688,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,15174715468092744403,8430136693804536703,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,2156873592455145650,14930640574399196450,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,7143613698138338891,16559616195679699022,524288 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6332,i,1461282879785682280,3488287913096978874,262144 --field-trial-handle=2312,i,4185015810950258212,17789928196780581255,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 32bf1b617bd8d18265f0d11cf99eec090aa2694dbb53c3da5caf49d2f1e33cb2
MD5 10e5b35470c7a39fbd7d3b627e249421
SHA1 3059194c0ee599421700132692b90a8fd9219970
SHA512 1ae07043bc2b853568d51be6c373c00a136adf68a7e741bb325b984c6c6075d2f1bbc6a6031e2e16eda1becea6ca3d9a362c33691d4afce8a5cdd67bc1ce70a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T18BB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e38a6e1ed55d659ec76e9b451472f9d20cd451590e3660d9e53c6b8a3e28bfb2
MD5 6df4355b4e1104f85dcacdaa7c7024b9
SHA1 00e5a7ffc1cbf4b9bb4311075ac29a7b5501f845
SHA512 ed3d2c7a4e593f846093d9f5916be03d7f61a456c37a4a779e6657acfd1ea26ba7d50a9d5617a4be56980cc53e927d35d5172ca424cca905a7422e4a03a438a5
TLSH
T1D4711C1841F10F91E3B26FF1CFD216DA3D734D888AA75D3242C49B7E693B72048E5545
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5915c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5915c0.TMP
Size 3KB
SHA256 a3e84fdd25dd356c23f6011c8cb0f6937b295d917aac90a48c7b96ca81ac86d6
MD5 be18aa871a605feccdf45a45c94b4cc1
SHA1 a51f9e9c7c06935ca43e4484a1bb7bb49cbdf7c3
SHA512 09efd79e63ac821bc1a0bc35c580b5ec0e691ba3e612fc7e78263f7954852b7cef954dc4ee1a7f72a7d2f9b37f8cb263edb048964d1a8e9b030ebeb220d155e3
TLSH
T1E6712B1805F10F91E3B66FF2CFE216DA3D734D888AA34D3242C49BBEA93772084E5545
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4c6869d7ae0060cefe55dc4ed33b628f89679c6cab27fdd836cf90ed2ae779fb
MD5 7b10d0ee2fc37f4a7070c056b11c9b6f
SHA1 261c00c8eb9ee6c2eb9fc36984b01bb0d3856f9f
SHA512 09d17ac49034e55b2d63b09debd81b43ecff3ce3a37670295d9384ef2502e173c25881107534ccad022dc10ebfba4336d752a34deaef8c6963771c51bc98f94b
TLSH
T14F317EF387B0867E8A0155F06A14AD1BCE5D0115036C7C668AE4FE1797E35A6E40168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 648ce333ff0ffc901496b920b50a6c6cb50b12d156bcff83d494b75252991e18
MD5 c0a3feb0e79fa81934702ac00e0daa9f
SHA1 048a9009b6fc384016ddba412e61984a21baf92f
SHA512 5e59ce5c267d325b3a1623bd9c3a4c5edc77d8faca99edee71b2ca70e80df01266ea3917ac21cf71b4485ecb84a411e3588f5fe3d06508ea60a87f3c5509a9b3
SSDEEP 192:sxZXRfyM/jK1Ml8MkA/fDsjXmIdpbp2HW6+WNBcwZ/Yw8+C+pIgrJ:sxZXpMA/fDsjXHgHbRZ/AK9
TLSH
T16142D7126B34A977CCDBD308BA45BB53D6F5447292940E84ADFCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a93fe15db02727c82e35c8bd544eda51da7f58cd8f4078874dbfb21b780a7d35
MD5 100ca86f4f648fa68ad5ef09e4b8ab61
SHA1 9c0b24c70eecf69f12466cfed2ad5823b4227cdb
SHA512 18d38dd31310becf71ce5557c4e52ef470e328b5b2bba379052f0784ef08cd8c80ef1852841f981003975dcabb633cadcca7007b4cba6a38ab1d36137f334db4
SSDEEP 192:sxZXRfyM/jK1Ml8UQ2kA/fDs7SmIdpNp2HW6+WNBy4ZYwarC+pIg53J:sxZXpqdA/fDs7SH6Hb3ZtKb
TLSH
T10052E7126A346977CCDBE208BA45BB93D6F5447291A40E84ADFCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ba8ead304a0a97714577e8cf411c79d971ebf8155488ddc3fbc6edabff1d0968
MD5 7ff0962b5cf81e8c78a6dc75866f453b
SHA1 c1980a49c7ff7da9451df9c9b5243cde982d14d1
SHA512 afbaed25fd063c8e39efc6bfe94fa942e51a09b51a328be93a2aea7e4e062afafa57ef0a78855d0a3b2a9a59573f96bff28d43a95cc4a4dc069270011502bc2c
SSDEEP 768:qX4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dFrohPcxaP:qX4jeXmWvmKLEu1jacPLZQd+6i
TLSH
T1C0D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0102f176ba0fd0d2891e15468f680fe425cf370a0c40b8474f2d62323c0a2ef6
MD5 f1f9d8da1e895f440694059efeddc9a5
SHA1 f91369b2b292ef1f179b4298ecdd8230f00f5823
SHA512 4a856063fe724a50fbcd583a327ce2382d72d5780fca52fa2ef7c97fb19e23a93aafd15bee59ac1f4ac2dd336894f3466df52cbd8ba3c648c2d88c697224021e
SSDEEP 96:KA7aKMMtOpOKCkN+8KzKOvqz+Kckk+K0NlMq+KELMQ+M:0aJFjp9
TLSH
T161B1671279BB13123CBE260891AA9B171A5170FB3018753B3B7D00B29E6BE501DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59adf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59adf9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 28ef94e277067f6dd6dd9c084e3afab34138e54dbafd07fae409883c1cb81230
MD5 3034abf96999ae5d2e9cebb3e0cd7c24
SHA1 7f3a482002d5a7ac81a7444488ec217be9b76bac
SHA512 b37bc9fae3c6a784aee0c1734e363b4b8042e4cbfafb0b4789015a41e86a286a4ef97edec62c052f42459c2f29ca83d5bb9c9676cbb141c123babc004e9f3d50
SSDEEP 384:EiFZ3yFaeO8usN18TUNTUlIlt2YkOy6lf+o8hy9XPRFXr2Yq9m6BMMj5kbOF:fFZ3IzhuIwgw+F3PrXaX9m6yMaC
TLSH
T148C23AF258D7987AE99E5B43A73E3D139EBCC027B4946A50B7D85A1DCC460BFD30A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e07c9ccb2fdb6b3a07609fc5f420460a6180c90f4f0272edf11590c3c9492bcb
MD5 315d4618f3520f2176019648b197aba9
SHA1 41c209f808833acb4e60bdf3108d6d8ec14c4baa
SHA512 7611018dc57892f0e9b5c25872c22fa7b3d96dab416ea12f95ad7ba3b4b61256abdbd447390e8c8ba532907b0a6e2ca1f6859e91e76027771954e67c160a00d9
SSDEEP 192:EONT6hZ0QmiUy6Mpc/+jVSjzorh8F45wOZQjU6:EONT6oqpu+o8hyH2+U6
TLSH
T18C02D83968787C678EE2AE45F48737235FE5112BE9A56F84DAE85F1D00C769C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 74e7714fb6db611122285288a110f09105b28c0a58a3d5d89d266bea37bee2cb
MD5 097d247f06e04dee9c634979cbeb5b69
SHA1 5d8c03c3f94ee05ce0b2161a8e36947494e4f918
SHA512 4164f37b28597f90bfba3b8e7f0a01486ba55a310b7f9c278700bc6d67031df0d16449e4554355bd1f32c53e3083e4b648ec5dfde10d67a055c892fd5868e7f9
SSDEEP 384:d3yFaeO8WsN0U52YkOy+lf+o8hy9XP7FXr2Yq9m6BMMj5kbOF:d3IzhWDiF3PpXaX9m6yMaC
TLSH
T1CF928D3679746CA6AD926641F44B3213AFF4412B99E93F84A9FD6B1E00CF59C130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 98f5cb8c6dc8044fc9440ddc05b5b3c2a3d15e2f6eb55c14d3ff20d42d050266
MD5 09150fd4b2f76511ed9af8aba6a97a49
SHA1 5d32bd3c7e2ce54d403b9ea5f3e8666de8313b54
SHA512 d0032ad5ac4f2857f541f4f757bc623fb8b46f3f71845528aac496c3eac40baa397aeaa5da725875ac1f6813544694388a9a943b684b313840a60e9277adc1ca
SSDEEP 384:33yFaeO8WsN0Ut2YkOy+lf+o8hy9XP7FXr2Yq9m6BMMj5kbOF:33IzhWhiF3PpXaX9m6yMaC
TLSH
T130928D3678747CA7AC92B641F44B3253AFE4412B99E93F84A9FD6B1E00CF59C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 160c597e9d0e59e8c04521c2f11ea1840e5d11fcbb7f2592b6185f35d64f34d8
MD5 708d54da80096ad38f1c312aff5160aa
SHA1 fcae341b10b2f31223d8a37e758c9e63bc39544f
SHA512 4fd0264f2ae44db3787c526c654829b6427d3eaaed771fb8eb34a1946eab447ee77f3f2f214c84f044c6141e10bff559006cc784c5500f5784baf07de3ce2a56
SSDEEP 192:8ONW6hZ6QmiUyzMXc/+jVSjzorh8F9XMEN5cOqEq9U6:8ONW6qVXu+o8hy9XP49XU6
TLSH
T1A712FA366968BC675DD26A45F08732135FE5512BEECA7FC4D6EC2B1C00DF6AC130A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94d53258-5f21-46b8-b16f-3ea56d7e7237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\94d53258-5f21-46b8-b16f-3ea56d7e7237.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e287fbd7cb676f6a1b721f546a3d23962b6585352c4ae4fcfbc39b7dcb78a3b8
MD5 5dbd758c61dc3cf6180e5bf5deae67fb
SHA1 c45a83a457addb458a82b9f19cc2ee2c1a33b7bf
SHA512 0bd90efd0c335130e5fa8f2f51273b43a6e05748881760433fc290aecb1863522fb0fb756225d135f1851809a5c63106d1831f12cf2b84656b25132f61ad867d
TLSH
T137410948B6FA1148B3B3BE56ABF6686E483B7C772E06D55D10110E8E4A67F408C61737
MD5 SHA1 SHA512 TLSH

Submit Download