ffa50cabb2543a82aa55206925816b217419f426e0ca0d6d72783d21def0cd5e

Analysis

max time kernel
898s
max time network
795s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 17KB
Sample260821-e1wnessgkd
SHA256 ffa50cabb2543a82aa55206925816b217419f426e0ca0d6d72783d21def0cd5e
MD5 2026139c545ef74469a2d7fe19a2e8aa
SHA1 fc23034496e614afa1f03623f2195f9966deb501
SHA512 09ed71602352dff2c51f593ac10f7a96d85669df8c9dd18f55c2a902c3619c27b59cfd26c527619a79f00aa53b944df1cc90693a42c12164a983db68de2e1cfa
SSDEEP 384:bvIGb9699y9YpzAUUAwuFAYd599999UK9hBABuraaPioT6A8uGw5YpX6EKplF09W:bvKFqaNLz
TLSH
T107821263F9191E0784F642F8E06A3F40D0C5C25ED3163D94A768A9E778CEE692B153CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317599448716988"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{8A8558CD-B2B6-4A08-959E-C30E398372F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5152	msedge.exe
5152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2096	2700	msedge.exe	86
PID 2700 wrote to memory of 2304	2700	msedge.exe	87
PID 2700 wrote to memory of 3864	2700	msedge.exe	88
PID 2700 wrote to memory of 3864	2700	msedge.exe	88
PID 2700 wrote to memory of 3864	2700	msedge.exe	88
PID 2700 wrote to memory of 1768	2700	msedge.exe	89
PID 2700 wrote to memory of 1768	2700	msedge.exe	89
PID 2700 wrote to memory of 2128	2700	msedge.exe	90
PID 2700 wrote to memory of 2128	2700	msedge.exe	90
PID 2700 wrote to memory of 2128	2700	msedge.exe	90
PID 2700 wrote to memory of 5452	2700	msedge.exe	91
PID 2700 wrote to memory of 5452	2700	msedge.exe	91
PID 2700 wrote to memory of 5452	2700	msedge.exe	91
PID 2700 wrote to memory of 5540	2700	msedge.exe	95
PID 2700 wrote to memory of 5540	2700	msedge.exe	95
PID 2700 wrote to memory of 1936	2700	msedge.exe	96
PID 2700 wrote to memory of 1936	2700	msedge.exe	96
PID 2700 wrote to memory of 4688	2700	msedge.exe	98
PID 2700 wrote to memory of 1524	2700	msedge.exe	114
PID 2700 wrote to memory of 5212	2700	msedge.exe	115
PID 2700 wrote to memory of 5728	2700	msedge.exe	116
PID 2700 wrote to memory of 3304	2700	msedge.exe	123
PID 2700 wrote to memory of 3304	2700	msedge.exe	123
PID 2700 wrote to memory of 5152	2700	msedge.exe	127
PID 2700 wrote to memory of 2216	2700	msedge.exe	128
PID 2700 wrote to memory of 2216	2700	msedge.exe	128
PID 2700 wrote to memory of 2380	2700	msedge.exe	129
PID 2700 wrote to memory of 2380	2700	msedge.exe	129
PID 2700 wrote to memory of 3524	2700	msedge.exe	130
PID 2700 wrote to memory of 3524	2700	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcde21c188,0x7ffcde21c194,0x7ffcde21c1a0
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,7734015572953122566,17477154255925408638,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,9784251073677590522,266564861235352780,262144 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,1945603171048816645,2520865651608456351,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12822224348328081036,14715066025478494490,2097152 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11887537916060854596,9633589884521352504,2097152 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,10554655573101326186,9166047736393208926,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,10093778045933671376,15892529223233151017,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,18077286601469948912,13169009974568487904,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,18077286601469948912,13169009974568487904,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10943426208710153467,9593447359788288896,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,11229803829230833901,16551614216348681267,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11207795972942460812,10060320697688555632,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4381667462200002905,2291553285669118935,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5648,i,16516727974854238667,9085024633836194435,262144 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,15048654055009949377,17302233319131139469,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,12665984737191596243,12304617868247151655,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,10253177466490054861,6971583498379801161,524288 --field-trial-handle=2324,i,5103900203843106474,8635016213652342869,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 92de6906acdd0fd7a0539d9b183ab61977d9ee3d032e0a10a9f245db0def9004
MD5 5d3a13e4d2ee5dac160b874e2056da00
SHA1 e8e87ff5a69f5b11f78081ad3aa1a270b2c2c82f
SHA512 5a99a9a99dea4ef3e4d388b09ff268ef6e5426aad629416f66cde922ec95ba755352d00857bfb51185e68a3bcdc4420429ef1f67f7a2b54c4bb6bbbb519f0a56
SSDEEP 192:Jj0/qNNNNNNNNNNNfffffffffffffffffffffAHh:Jj0/qNNNNNNNNNNNfffffffffffffffi
TLSH
T112F1FD2286D5C7AB8F0520EB8DA0526D0074370FEBDCD58C239DDACD354E5BBA5EB690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6751a4294771d13fcb32543f6c0f994258e9d21d0cb48adf1ec3ce45253f8830
MD5 ce302e1f105df9f209e108096f0150f2
SHA1 5c112e4ed783998af20b2efeb99e71487a0f290d
SHA512 7b37e2a5eb1f95cb207c97a388e08f7ce0fa987cf29cce7693f27f834cce7446e10665f1117400e7b79977d2794e48a10c21adabe1b206d8a7f169bc30886b42
TLSH
T1A7E026A409CBC2AF9640B98BD67C934C92A1360E92C8B9CE5714C4C8B081064A3D7694
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9a83d0ee8bb337f70b43163a47f2c05ad1532b35e71f6627323e6c5060beccdb
MD5 7cea53516bef79ef0efce0f8c0fed724
SHA1 5e0d25c738562ccad3d2c2aa3bcb4633c7e44bb4
SHA512 3f17ce0d89949bae26420a8fef0946f3b18fe6d9a57ba753167de344244ecabfd9ab59ba617d450bc19f6311c7fa83ac8055f6ed8ef01e89513c65bca2972ef6
TLSH
T138E022A6C822FC3708FE4B28A0498746FB4523172A40894F3B3D81088FF473B55CAC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bdc11fdc3103a925c35a1c93864bdfb2654c135d3093cee9e4fb2d889a7f4616
MD5 88b1fb19b35635df4664faca26d50dce
SHA1 2b05c993ff69a565ef356aaf742e87d83333ae6c
SHA512 95a83e59ff876820aa5e9b1133ed79d2851a3cb061add8639217eea4759cf4a64d9a5f4d975f0f7e632e6c3df7942b0510959564ac0d637ec45e5401f8a125e7
TLSH
T11E31BEF783F4856ECA1196F0AA18BE2FCF2D0511432C3D9A85E4AE5B93E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2f8c0f63cf791a440e436bf8011ee96f42344ee0ad626aa9cf94e6a5d33762d1
MD5 d9e10abd7ecdd8a0e0ab00531f60017b
SHA1 26b66b6712fa06337bdafb4bc007e7de3a2b1020
SHA512 41927fe191422bf355d9b8612c342b2fb504a9748d39f58a6cef21aaee87364cfa3f8e85621a0430735a9e5690f4aac6725c1b498c0850b6d67e38526139bed9
TLSH
T1BB31B0F783F4856ECA0196F0AA18BE2FCF2D0511432C7D9A85E4AE2793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1a825fc19875249faa0d756f77f16549334a1f173e33a3336e2974637c65e0fe
MD5 71a6326790c45982e8bbf47bbf2b25b3
SHA1 bf5751be7638d973f57484c87fcccce6c1c89db4
SHA512 479461f0a8f678f639fa7d3d133a4478e69e6c589bb7f62051f9d5ec101191e9280eb21b79d93451dae27c3e5e5e2e2c58a04f733550d9b5b6e61a9c07ad1209
SSDEEP 192:sxZ5RKyMqZjK1Ml8UQZkA/f7s2hi7Zd2zodpHoHW6+WNGYvxSOhtKIg5deJ:sxZ5XqaA/f7s/7zNIHbGChA3q
TLSH
T11D62E705AA349A778CDBD219F645BB53D7F91573A2904E44A9FCDA1C00E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6afd9e7a5c5faba4072e4dbfd09fb9c16feb00dc72a7753f72a77109d6c01ebf
MD5 34929d846314be2f9c7d30ee644ba93b
SHA1 2053799711c5c86a1220b757dd08b8b2168e9682
SHA512 4b70f635a7bef10d83b5f4b41c7ced371751fb718d2a5e0a5296c90f2c0105450ac90ff40a073c4b25340a67114082f7e3e144433b841531166c37a4ee22b61c
SSDEEP 192:sxZ5RKyMqZjK1Ml8MkA/f7ss8hipaZd2zodpHoHW6+WNGYvIuSO1tKIgjeJ:sxZ5XMA/f7ss5pazNIHbGa1Ajq
TLSH
T18562E806AA34997B8DDBD219F6457F53D7F91523A2905E44A9FCCA0C04E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index
Size 72B
SHA256 b2f5bd186a1f3af47b79c19f1dfc6e93f67659ec47ec95233dff8972d3f9632a
MD5 507ad276d966a466319db294a25a6926
SHA1 59e91d86307655462a67d48a99a6ab61141a2b47
SHA512 02f7ef7b68332b2eec58f23d79ef1519669b4d488cb1dd6a618896a63247a0b386ed86f51c2b1173ac5276a7596b8301de54074a7187197ebc505cc793e5e3af
TLSH
T181A0026201410008CA8402F470C122601E149EF0919167525CFDB0C8A9544C09B4D084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ccef0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index~RFe5ccef0.TMP
Size 72B
SHA256 4f14fe1fe7c3816bd6f4081f9313e24ea60a120c24e5197c033dadd5e888b373
MD5 a156dbb2ad634b06ce48ae94010103fd
SHA1 fdab10519ab33788c291f113ed1fc244204d9ce6
SHA512 a90f843fbcca3ccd2fde846e1c18b2267407526808d3bb774cbbc2cfa13b68b3755c126a9d08425e47222c41dc98b846f5a6a717955d3880a42af233ba0f1177
TLSH
T1CFA002100240C1C8DB455172304512721610BCE051900FA34AE920989CE50C0B715544
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 52506b5663730d8c2af138268759f737871db974e9ca600958d1ec5e7ea5aa88
MD5 525b98f20d87fac3113f3fd2608d6dea
SHA1 cf5249b0a7e715007752dba1a7f4aefdf0ffe256
SHA512 c13c966087a66e896930e41d9286e8955947ca262b655cf0edb6070526ce3039f85cf82e8e0e17a988e8b42eb85fd5573347fd93da297e03a4f0b36f31767098
TLSH
T1F7F055BB7FFB1850FCABD3DA20316DA0020AB9508894DC1F7427B28755B231D205ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 526e0b8c81ca4db859a519c1b56bf3c225baee43c3830eaa6bb699dd56bf780b
MD5 aaa39c853e22c443bc5086bbbc89d6d2
SHA1 b1fc89075fd3bc29a46050ca901a75942e497292
SHA512 8d44a61e8ca0aff18a3e664b6385378c49750af99555d1f4df3fca4729430c5b1c851ab95bf32b8e3a176a29e199ffe0a710d908c5712629183c8f1b1334edd9
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG7:05ppxnY753RNBvRJJdt7p5J99lH/
TLSH
T184B27A5A703A0211397E3988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf2dc7c66fb7be831665480d8029393b63dbf903aa04cf19e2f931f0202a4054
MD5 dbfc6d6f0be41d2120366366c4ec0a6e
SHA1 3c8eaf0dc24753990bd33b3ce604f446a52c2d24
SHA512 fc27950c86c72c0e5be5e51eae2885027bb55dc9334d36e7294646d0a274a4bb0049dc5febcdee2c58c18b9423678fc470a154e4602515882939a47405b3b898
SSDEEP 768:p1FQl3Awg6kdS8oGGr7cjGfkSGrsiUufK:Ol3B2sMa9iUmK
TLSH
T1B0C24B32D894DAB7BDE78B85A74A7607DFF4412389CC99D4D9D85E5C00DB1AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5c6f0d6c9f0070d346f47a84c935250a72a2e6da4600eae33655573788590884
MD5 84488808fa372875cd72abfcf16b8ddb
SHA1 4fb24bac58ddaf974c8d24c4d639ae8a91488965
SHA512 767b4016b86f3c7160e7499424bbcba37c6883ccc489ecd0d278a9cb192ba64623ae0f88a380b9640fa36f5961237e50f572ddf44e609ca986b0fdfb21f7f006
SSDEEP 384:nPiFiZcIl3sNp8TUNTUlI4dQckCrruSyphiftGGr7DOYibj/+WAkMrGrsivcuVtu:aFQl3Awg0kXS8oGGr7cjGfkSGrsiUufK
TLSH
T1EAC24A32DC94DAB7ADE78B85A74A7603DFF4412389CC9AD4D9D85E5C00DB2AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e4929ce4a86cdd87276aed9c15cbf38f8c05101c5cc640ef252df8894cd85ee2
MD5 015fb5424841c9c6cd4650f098caf8de
SHA1 b8ebf7ee56ba0866db2b868b349744cf3f99611c
SHA512 22e57d56ec51d755c2bcc5f06c322f8bb71b9553cd57d9d2fac526610dba3af1590380ce532b5db0009393678f13d2c981abb61e4409e6e5b5b88d670e88eaab
SSDEEP 768:p2Fccps3QwgbkUBSNoGGr7cjGfkSFrsI8p0IL9:gs3iCsMa+I8p0IL9
TLSH
T11CC25B32E858CAB7FDD74F99A75E3543DEE452278A8C99E4DACC1D4C00DB1AD430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6844e22aa2975893ec5adfe6f8b20e6ff7e37d2923ad309ae498791987f2e7c0
MD5 e745eacbb652922fae4dcae6b32efbde
SHA1 504e83fcf6691fa771bf51aa959f7c62cb9d5a7c
SHA512 10148d638083b75358cc8a73b392e581507e431647b520f86262ba4bf6a9afcd9df45617c2ebe18472b9b1e17b3e70fd1048cb217d04bfea0bdab9608446d768
SSDEEP 768:p5Fccps36wgbkUakoGGr7cjGffVI8p0IL9:Ls3s3sMa1I8p0IL9
TLSH
T16CB25C36EC58CAB7EDE74F99A75E7603DEE4122785DC99E8DAD81E0C008719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2abcc93f787ade6cac25ae382c0a18a5286b860becc0871d5bd50f8348f3c6e4
MD5 391082ca96abf0a2199954ae7103d2e9
SHA1 ad97446de3dc28cd277c79c0773cfc5d90999898
SHA512 e2bffdfee771e28e769b80a6388b35ceb602dffe225f1291d0303cb6e0fc13150df6f39a1898844018fd32ccb2ac0d4a92ee9d3943b7ffa1020f17b6ce0b0990
SSDEEP 384:nciFiZcI53sNp8TUNTUlI4dQckCrruSyphiftGGr7DOYibj/+WAkMrmrsivcuVtu:HFQ53Awg0kXS8oGGr7cjGfkSmrsiUufK
TLSH
T16BC24A32ECA4DAB7ADE78B85A74A3507DFF4512389CC99D4D9D85E5C00DB2AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 173e16c33b3cac79366f4e63e350c0f7c56ff18d50f0cfd91e3101f32551cb94
MD5 4a1fe1cb3286bb6ddf8cb9be67b93c86
SHA1 b940ae9a59f7311cab1a31b48553e4016dd53733
SHA512 8028acef1bcc152684d16083a2f613d360dabf965355bfd8d505b1da1ee9b6c9da8ed85ccb6aabd322fe81f04bc2acba378612434bc5fcc29dc9fea352f591dd
TLSH
T170416E5CB6F91158F3B76F56ABF6A8AD487BB9772F06D09E10110F4E0622A04C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4688-200-0x0000021D2C0E0000-0x0000021D2D0E0000-memory.dmp

Download