5763cebd15e91762fe3fff6fb6343eecae696b4fe1fb397b08cb2362ce803199

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/09/2026, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 17KB
Sample260923-z3kddsdc59
SHA256 5763cebd15e91762fe3fff6fb6343eecae696b4fe1fb397b08cb2362ce803199
MD5 9cb9038e9452c193fb9ce4ac09c6dc05
SHA1 9bfb41f731e44041291bd91830f6548ea94c780f
SHA512 db2fd6702063d95c9e4b7d19b13f064b0ebef30db2b84cf353623498751f994fbe1a900ad61da9239cf2b262d215d3a31e569536b1cf8828aa3e226c33aa2b0a
SSDEEP 384:DKRRRdrQ9K99VGipYN999/twf7aOwlaP6YKYNYYNy9xWFBXY4YnYVYjYyYAYlYUw:DGzCYKYNYY4+LY4YnYVYjYyYAYlYUmYS
TLSH
T18C82C921E709098391FFB5E5F0765758E442D608933769E1B0246737FCC9AF62A8239F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346716850279579"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{80050EC4-A207-434D-91C5-F87746447ECF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3892	1332	msedge.exe	86
PID 1332 wrote to memory of 4552	1332	msedge.exe	87
PID 1332 wrote to memory of 4312	1332	msedge.exe	88
PID 1332 wrote to memory of 4312	1332	msedge.exe	88
PID 1332 wrote to memory of 4312	1332	msedge.exe	88
PID 1332 wrote to memory of 2568	1332	msedge.exe	89
PID 1332 wrote to memory of 2568	1332	msedge.exe	89
PID 1332 wrote to memory of 2208	1332	msedge.exe	90
PID 1332 wrote to memory of 2208	1332	msedge.exe	90
PID 1332 wrote to memory of 2208	1332	msedge.exe	90
PID 1332 wrote to memory of 3808	1332	msedge.exe	91
PID 1332 wrote to memory of 3808	1332	msedge.exe	91
PID 1332 wrote to memory of 3808	1332	msedge.exe	91
PID 1332 wrote to memory of 4200	1332	msedge.exe	93
PID 1332 wrote to memory of 1176	1332	msedge.exe	94
PID 1332 wrote to memory of 4200	1332	msedge.exe	93
PID 1332 wrote to memory of 4200	1332	msedge.exe	93
PID 1332 wrote to memory of 1176	1332	msedge.exe	94
PID 1332 wrote to memory of 1176	1332	msedge.exe	94
PID 1332 wrote to memory of 716	1332	msedge.exe	100
PID 1332 wrote to memory of 2164	1332	msedge.exe	101
PID 1332 wrote to memory of 716	1332	msedge.exe	100
PID 1332 wrote to memory of 2164	1332	msedge.exe	101
PID 1332 wrote to memory of 3528	1332	msedge.exe	105
PID 1332 wrote to memory of 1392	1332	msedge.exe	115
PID 1332 wrote to memory of 4372	1332	msedge.exe	116
PID 1332 wrote to memory of 1044	1332	msedge.exe	117
PID 1332 wrote to memory of 872	1332	msedge.exe	119
PID 1332 wrote to memory of 872	1332	msedge.exe	119
PID 1332 wrote to memory of 3156	1332	msedge.exe	128
PID 1332 wrote to memory of 3156	1332	msedge.exe	128
PID 1332 wrote to memory of 3064	1332	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff84068c188,0x7ff84068c194,0x7ff84068c1a0
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14417783917627792293,18234628404100868404,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,4203729453413537815,9248958144837115229,262144 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,357244219880899008,16599285969192036450,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7505964840610244349,16344738633912182154,2097152 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11690998529127765724,10304666976418957371,2097152 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9580061052015785832,16059008946153604586,2097152 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11908826803280897514,2540378344145704788,2097152 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8805135230027079447,1075370969910715941,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,9332483522523395351,15803448690318754368,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14359636898058255004,15948953145433761392,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14359636898058255004,15948953145433761392,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,7391060404175450372,12560645047973354251,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8102650983233754358,15491857585270490013,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,4712985419544741859,5513252394625466666,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10945690026807678793,13125249247877196402,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13015312133713868988,3218515107885350031,524288 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,15913520296942963614,4154054099640422460,262144 --field-trial-handle=2240,i,13788539416318458024,1989017534929982056,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e0c74d4845fc2034fc1a779edc9a6717f33773b10ff3dceaac0a2d2911ccc8e
MD5 aad0bfcaa100fac65d3e6fc9a491bdd7
SHA1 88d326eed9cb7d86aa9784e1353c1d14e844ec7b
SHA512 eee38d38dc8428e0f6cadb0238952095b433268b8a187c39ebf2060a8d927d5911d20a606df583383714d65ee642fe81d6913bf3fc078098d632ac8eaafbc0db
TLSH
T16861B74DC5944274FF68047381D221E33D35B68A46F7AFE20799FABADB3A364135801C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d08a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d08a.TMP
Size 3KB
SHA256 3d290cd509566614dbb3ea54217a4c7f442bf81d96fdf00563165c3a51b6eb4d
MD5 22d79c0f0758b60314010c091aed6566
SHA1 bf37f29b4f25a7cb96684b77e8dd168e46f6f412
SHA512 4b760108b564a35a4e732f9a528eabe1bf1975cf89081cd80c0b2706d50f6423691b5ccd5039e602b38a005fc1add4e0e565b634cdfcd75c71a5ee5c44c738a9
TLSH
T19561A64DC5944274FF68047391D221E33D35B69A46F7AFE207A9F9BADB3A364139801C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 967c5b6b1903c1dce199bef1cbc289e5dd9d415cc8d41ddeec9e3487008aa193
MD5 24e2b03fb2883748e61a30e729970818
SHA1 ce5dba621378714abae91209594f3a767fcf3d2a
SHA512 72fb2dd629bf982305611f41b6994a277bfe7b73f36ee27c1c238864d46ac0636ac631a6262ec955b3f940e4b80e5c3853fa796e68b2deedb6c1309d71ea0989
TLSH
T105117DF3C3D5856E890516F06A24EE2BCE2D0506421C7C1999D4EF6B93E3475E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 387a2a6b276e2a942cf95c03d4ad07bbfb5cc502865b8b33b5d49bfb89b3952e
MD5 fd1a4506c34ad9d5217ee77961e88f57
SHA1 628bd0b724035f22a37b83ba353d5f118024e127
SHA512 f1e90ddc33f8b599690739c21be7b0134b24a84c937d52b37ce90e8ede2f3e7660caa01d454e61055bfbaa7d42637b4e5064898d27c5b39bfb9e0be4a3c14ff1
SSDEEP 192:sxZ4RcvWz/fAssYlKIdpdPHW6+WNGYRPRXJIgrJ:sxZ4S+z/fAs7DNHbGmf9
TLSH
T1C712B7566E38A87B8CC7E60DBA657F53D6F9503251941E48FAFC861C04E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e727754bc3b8892236b78c8e1e3445640beaddc45ce6a76ac9dd0a0a258228b
MD5 3111368d701b4458af0b051efa42f4f1
SHA1 76c4e5a68a0531274613c221a8d5545b7feb6b8a
SHA512 c611694aa9bb181f43ffdde51ae1c5fdb95dc594186cd95fe53df9d015dbe50b78c7b217e6f09feaf294e871f7629f87d2c349b791724ac6d7962f766bb4c15b
SSDEEP 192:sxZ4RcvWz/fAs/2lKIdpHPHW6+WNGYRP/XJIg5PJ:sxZ4S+z/fAs2DvHbGm1f
TLSH
T1A522C6567E28A87B8CC7E60DBA65BF53D6F9503251901E48BAFC861C05E7ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 446e587ab06950c80043faa45755785dd6aece0d33784c607ac6d48efada4b1b
MD5 3ed21ed0bf7ee27e225a059dae8fd8ca
SHA1 79ed8960b8f09e06f74371c0a87efa256232c5e5
SHA512 d6be0dc6992659516500eeb7aad4739fdbd94c4e6fed9bcad49fe0f5f3484ea2173ad23f87352940446c21761e9651208be807483b722341aa263b9efe940160
SSDEEP 192:sxZ4RcvWz/fAs/2lKIdpdPHW6+WNGYRPhXJIg5PJ:sxZ4S+z/fAs2DNHbGmff
TLSH
T1A022B6567E28A87B8CCBE60DBA657F53D6F9503251941E48BAFC861C05E7ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3866233ba110fbe6214baec48efaad476aa943384c9bd07022d05307c31053d1
MD5 1ef93b1b265c6a3b29a2b441abc00b64
SHA1 38f9421946a78f42d5a8e81c138aa7b4eba7554b
SHA512 61f3ae4692f4ea6728cbefd1eca62933e8612b5554126a562e5301a3bf6e524cdda009829aba034c4c3b43817f12a0ece9375043edfb6652be4eb7e8261e57f0
SSDEEP 192:sxZ4RcvWz/fAs/YlKIdpdPHW6+WNGYRPRXJIg5lJ:sxZ4S+z/fAs0DNHbGmfJ
TLSH
T14022B6567E38A97B8CCBE60DBA65BF53D6F9503251941E48FAFC861C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 66a6df4d2ef231c08e77d236f194447351ae8b7958eea7bfbd7aa3e100b09aa1
MD5 e946d2985c1f96e9db38810be69e4b4c
SHA1 05f5b8cc8aaa734e5ab28dba8b38f0a708bd84d9
SHA512 83c1c555d5fa3b06613c624e2aacd1b651f3054abf5f81e639149287992fec9724727fefdc920c84ed32e99d4784dd8a6dfad84ac003d001b02438c5470205a5
SSDEEP 768:gKK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Hrox+K+:gKK9uzYWvcQWsu1ja0HL7Q3Ux+K+
TLSH
T137C2093F640CCB7E5FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 35f763c6d70dc8b9b91009cb77b8e47599e35a2b99cbbdcfa843d6d41f38b053
MD5 35d3a4f4236ae81f204693f3ca7fdc3d
SHA1 25518725817d06212e3755a4e5f54b64038d0252
SHA512 ff771b0ec62b4e8cca608f9824c6895ff9bc4efd3e411658e515785e6a4a2286f78f0cadc9552a51ce926d316414ea2cdf19c11064989f9b70e6a28804e7c595
TLSH
T123113380F2F680456E49A991E11F7003D4A27F59120DD931732D44F00F85C2A0BBEBB4
MD5 SHA1 SHA512 TLSH

Submit Download

421023cc-032e-418d-ac6d-aef34d594102.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\421023cc-032e-418d-ac6d-aef34d594102.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 0214f556afca82d93cc1ad13d542cd3dbb70fb60b13f662f3103d1e7b2cfd00d
MD5 8a26e23ea138a86d76ec9b9ce5a29778
SHA1 277db121f70ef8716271fd3c49ca00c03d32ea40
SHA512 c52e6de0e29973caa58a66409915efd04a7a10a21438bc21adca6d83a8bd3e9953b056295dcc68c010fddcaab60e7a6115e5547474368e28349592dc9a77af5f
SSDEEP 384:iiFiZcInzsN18TUNTUlIltwHL3f8O/OjTVKjGYm3kuwTeUC65lol:pFQz4wgG3lGnJ37wewq
TLSH
T1B1A27E735CA89C7FADF6AB45F84A3213CFF480A3C585AA90E6DC5B0D009B1D8130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d0062a0199e5364f84afae30c9fc0bb277caa4a81c4d71698c610d7cfc35e077
MD5 8b911665a74bbe7cdf5342c46fcf79e6
SHA1 2e5a9bec2e3e45681cd43135f240065faa5267e3
SHA512 697243dade233965ecf9fc285fb0695f6fd534132a27cba765ce8b1d208e787b7f4c06d086648fe950a85ce3d2fe44c2a5a5db7c9eecfa392f81179f757ed777
SSDEEP 384:cZcIhsNrtwHL3f8O/OjTVKjGYmtkuwTeUC65lol:Khl3lGnJt7wewq
TLSH
T10C828D765C782C7A59F6E545F88636139FF8D063D6886F80E4EC5B0D00DA6E4230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e97d5ad50e852e5064c3bae109589bf96b460006a31cb03cef9e84ad59be82b0
MD5 f6e0ffe936fc02cd1546b562785c6a7b
SHA1 c4cb6af944af47492314ce028698638f6b192543
SHA512 1da586e0dd7f0d1b4d08a3bed116ee00daf9c08f22a47f7092caae1c4755f3828dd2ab41dd2633e62f4529d6d5979cf71eee8dcb541713fa14c2159fcf509452
SSDEEP 384:LZcIhsNrwwHL3f8O/OjTVKjGYmtkuwTeUC65lol:Th+3lGnJt7wewq
TLSH
T104828D765C782C7A69F6E545F88636139FF89063D6886F80E4ED2B1D00DA6E4230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d11cd3cb80cdc9ff4ebc476f9a6ad7241d385e5b3c7499a4a163e8cf4f111f25
MD5 be91a2b4a400eaf8e69d1e7c900145ca
SHA1 87129c4b713ace8153f21edad4f90b641b1bbca6
SHA512 6c6af46a055aa2ea93886d73d2f9454fccc6c7eed329f9baef3d66c2ac9ce253f3f6c08f30ec1a02852a2a77b7dd000fb881c7b93778bd096d4d7a51ec577a3c
SSDEEP 192:SONF6ygpQmiUyh+tOCTVgVHDR0pqzPeAU6:SONF6lHFtOCTVKjGW7U6
TLSH
T1EA02C739AC686CBB8EF3AE06F48A36135FE4117BD9552B84DAE81A1D00D765C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6616aaf3a9e4b669eae885793817b5c78911551412836aeca6d04929d6dbd51a
MD5 5bc654bdb8844560459fbfe9b777c8e9
SHA1 8b4bd96f78b7659d70ff423b8d7f9fb496bb32f3
SHA512 cfb8050205cffe4ab4d7380b726eefb1096af83e77cb848cb7994ad279263d831f1bc8554199702c3bbbbd129b08a663fee3b1e22eab45a6b7b8c7d11d87e79f
SSDEEP 192:SONW6yIQmiUyx+dOCTVgVHDR0p+L9ERQ3Uki/NU6:SONW6zLdOCTVKjGYmvkuU6
TLSH
T144120A36BC686C7B5EE3A901F48732139FA48167DA456F80E5DC1F1C01EF6AC630A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fa6c5bb-66b2-4586-b833-9279b17af379.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0fa6c5bb-66b2-4586-b833-9279b17af379.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 765ef657674b433be911a55c9230d6ac4f8db34b0aa3d7f56a3e3dece917e7c4
MD5 fd9a1e00fc4715948efc0c5a3d044f30
SHA1 65f49c50b3dee28d2da3c19ac22ab4916a6bee1f
SHA512 45694f57afcad127e03ea8a3095ed7e509018bde5a9efbb3f6627270d8962cf221c4f08dffc6838cbef7c291c766b05c60b260ff3a10a1cf78264c94a22e7687
TLSH
T104411858B6FA1148B3B36E5AABF768AD487BB9372E06D45D00110D4F0563F01C8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download