d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample260727-pmvjbaba34
SHA256 d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c
MD5 161dba8de49f41eee63421cce887ca0e
SHA1 b1fa0fbc7ac9176f2af1d8e1eade2215e0589884
SHA512 2de5c438949e6b349d0450ccf95a904521482593b776b3b7a39478a04500f8c752103a75db353d884723d6556b639858c5482047f81e4bd57c277ae3e3ad76d3
SSDEEP 96:CQUK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:n8/SVPmuB3C/Da7d0JuCidI
TLSH
T157E1A56BB540537A135143B1600621BA733300BEB79D464654DBE62EBBA23B4AF7F0DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296294256823456"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{722FC16F-4E76-4E2B-8015-E1A30931876C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1348	4164	msedge.exe	89
PID 4164 wrote to memory of 2536	4164	msedge.exe	90
PID 4164 wrote to memory of 1260	4164	msedge.exe	91
PID 4164 wrote to memory of 1260	4164	msedge.exe	91
PID 4164 wrote to memory of 2972	4164	msedge.exe	92
PID 4164 wrote to memory of 1260	4164	msedge.exe	91
PID 4164 wrote to memory of 2972	4164	msedge.exe	92
PID 4164 wrote to memory of 1292	4164	msedge.exe	94
PID 4164 wrote to memory of 1292	4164	msedge.exe	94
PID 4164 wrote to memory of 5400	4164	msedge.exe	95
PID 4164 wrote to memory of 1292	4164	msedge.exe	94
PID 4164 wrote to memory of 5400	4164	msedge.exe	95
PID 4164 wrote to memory of 5400	4164	msedge.exe	95
PID 4164 wrote to memory of 5856	4164	msedge.exe	96
PID 4164 wrote to memory of 1616	4164	msedge.exe	97
PID 4164 wrote to memory of 5856	4164	msedge.exe	96
PID 4164 wrote to memory of 5856	4164	msedge.exe	96
PID 4164 wrote to memory of 1616	4164	msedge.exe	97
PID 4164 wrote to memory of 1616	4164	msedge.exe	97
PID 4164 wrote to memory of 3580	4164	msedge.exe	99
PID 4164 wrote to memory of 3580	4164	msedge.exe	99
PID 4164 wrote to memory of 1400	4164	msedge.exe	100
PID 4164 wrote to memory of 1400	4164	msedge.exe	100
PID 4164 wrote to memory of 2976	4164	msedge.exe	102
PID 4164 wrote to memory of 1120	4164	msedge.exe	106
PID 4164 wrote to memory of 4584	4164	msedge.exe	107
PID 4164 wrote to memory of 3976	4164	msedge.exe	108
PID 4164 wrote to memory of 2132	4164	msedge.exe	109
PID 4164 wrote to memory of 2132	4164	msedge.exe	109
PID 4164 wrote to memory of 1328	4164	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x280,0x7ff9fc45c188,0x7ff9fc45c194,0x7ff9fc45c1a0
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,11553625165688728997,6395181978017823769,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2596644107377435555,7639782979580986134,262144 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,4630730963016283959,17388154897252664342,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,3936450344435331747,10322524541469821776,2097152 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,17184469977435901277,3304377742340802387,2097152 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,2910941416783795562,16243488492191543267,2097152 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,1525330853846618790,9045163692321392249,2097152 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:9
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17073162748454491229,9412807197682675707,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,16655103981811853159,13429027423484725577,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,10006278809654678139,14716448976605949217,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,10006278809654678139,14716448976605949217,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,1317435237734478519,963483589214517789,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,1298915356120535289,1428904304743668232,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17460731695197503793,15201559946289310187,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,16298765624483047048,6690882942613751470,524288 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6580,i,6891177741853590624,14574823025107690251,262144 --field-trial-handle=2556,i,11623930807744205590,8334462960593424733,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 74d487899c0b7203fd2cf2d72770998769f4618b66a4b3c93dd498775556f482
MD5 def38f4cc5b60ecf6352b17ac824fdd5
SHA1 9f4663967657c01a6ded0652128b1eaef6335da9
SHA512 38b03fbac303730917662a899faeead8d0b759988ca78f4fbb10de84a847f6a1ac3d74fb2e1545702c2c55dba9c6ea972f62688f3dacc7c3210d023a7a406e16
TLSH
T166312394332409EBC769AEF551F48BE7333D8BB94A079E11C58473BE4D72BA5F012028
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e2bfe04-5eac-4d3d-8618-5e3e831a88f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e2bfe04-5eac-4d3d-8618-5e3e831a88f2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3d2b58bd43b54019c184359bdfb1957d32f912de49646cd750d65c06b9c4bc31
MD5 04527fd3d16ea51dfc3affc67b195d6f
SHA1 24431574e3832a52517a424de6a7d2d0b2831918
SHA512 fc0fcb153c0496604d8b21ab8629e5d11e1ca2279bf4ed6998b40e4adc21ed30896a54c58dc67236fe0f3576f34e0f1b9f3d3291a6ed1c03cedc8ecc6946ce4f
TLSH
T16D41C0F3C3E8856E890556F4AB146E2BCE1D0915832C3D56C9D4EF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 52b6deb74439155e5e00d48d7fa114cb04916467e90ec99a021e0ebfc3b7d487
MD5 c6c51d83f06d3f44c0b69dffe456e730
SHA1 97028cf88e6e84a825037b6c622e3da83c2d17e7
SHA512 5109bf7bdaf7de9ff95d0fa31e316ba9c166dda9355d3869d56d0373ddf100855624e22deaa98e3a6ad69b1c7ca6feef4742ecd57d3e8ae12bbe72f8066ef526
SSDEEP 192:sxRyR4b8/fqsXx/4RzoA8p4K/g6+WNIYZ7PKsTGgIgDrJ:sxRyw8/fqsXxwMf/5I6xJ
TLSH
T1D532B816A968993B8CCBD30DFB55BF53D6F96072A1D11E48AAFC8A0C04EB6CD120750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d0088260c839d6e6832fa91c857595cbb4963aa668dce9c2ef671d157206945a
MD5 647af690447223155e6a808e85b7f11a
SHA1 edef4d85bc7747d7add5fc09d41c2737b09285fc
SHA512 5606b2f51c19bb9d985566eb2395e9dd5827559e2022f8ff8ae4bcf8a79e557f1b9e06e7648be4084a64983d3e4aabdfd232b5b51938e4d2e91934f9805801f4
SSDEEP 192:sxRNR4b8/fqsWx/4RzoA8p4K/g6+WNIYZ7PKsTGgIgIJ:sxRNw8/fqsWxwMf/5I6xs
TLSH
T11C32B816A968993B9CCBD30DFB55BF53D6F96032A1D51E48AAFC8A0C04EB6CD120750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 18cccb3a6b3179fb96f956c87da09604f7704de1f203de35b1e4558d16a8320d
MD5 de6bfe1e0b1a3b854fa459c7bcdce3d9
SHA1 84a487d74f9aeb9bb0fde1cb63ed53684f4a1008
SHA512 63749cbb0ff322ce5d2a97ebd28c74617738a36ee3c9ad57900c1ffb6dda0cd66aa31d9ef9e43f96ff0ee32348a49273608d7fd4c6dd543e6afc37017d08e65c
SSDEEP 192:sxRyR4b8/fqsXE/4RzoA8p4K/g6+WNIYZ7PcAsTGgIgD9J:sxRyw8/fqsXEwMf/5IPzxj
TLSH
T15342B816A968993B9CCBD30DFB557F53E6F96032A1D11E48AAFC8B0C04E76CD120750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3dd93a5c1aab1a0295e6213e22769f2ad2a837e8b71a0e72c1ceb18a3d6dc56a
MD5 dfc262429111500f9c278d3101017723
SHA1 acd5210dbc4fe326d1138309e90bda057873d8e2
SHA512 50d226e9af9fe6056f753313f7da0c6e6306d3da65311bd1039db15ca9ec7065057e0d59c3b1161cd19c469f95543d145124e04971302fc17570648da18f9f3d
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR65roOpv:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vt
TLSH
T1DBB2EB2B604DCB7F9F801A9DAC196FD67D9802C797588D4047FED90C03C77EA922A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 38438f3d9de32e570ab5168c12934bc4e4c11c905668ca77d18f072b7d3f562f
MD5 36c8eaf33e5a41f34d7e30a8a831aa97
SHA1 36c0da7d986f7a61b1b06c614a3886d92b359f88
SHA512 aee4aeccc4e0e116cc42f6c5e0f31c2ac257813706f642b97954434f09dd2fa762594e6b46784fc8949c08c3b6976e1e3a5ab57fe8bcbde2671ebe00a00aabfe
SSDEEP 48:K2V6RF7PjkzPgPIgtkKpBxDkdl0KA7l5yF1I1K2IABlkz3lDjRiXyMI1vRKUYsFe:K0yAKb6CG16K2Ixi8KTS6Z
TLSH
T11991F2D6B17A421029BE690C92B4D926C6C570B73655E82B3BE940F25F6BE010EFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a37ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a37ab.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d840b5da0a7f6322358dd1e36b5c42f3f513bf099b9c55a992ecf84583f16562
MD5 0d45ee46a1fe263abc0b7acb8488bd9d
SHA1 82f7feb8397095dea824f2f4de167177e22e2da5
SHA512 1353b3e405f8307e265a16a7b85208b95a7d99955809947c951c186667575044c57dfa6108df1da19f16fd335ab402c8008d525d4a327d09fad6499e25854c09
SSDEEP 768:/m3QIq5LALl5Aam6aQMGdjWca4Ghf9Jta:/m3VrmaME6pJU
TLSH
T1D0E2AE719C6898779CBBA296F72A3243BEF05163C5C85E8484ED6B0E06D718E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 241171a1e778d94e188f51fc4e545a17c6dfa1f22fcf6825646679224ee891ce
MD5 c63b8d6443f9d97f6e4113a0f175c682
SHA1 58aff8661f614a778452273a234242ebd153e5c4
SHA512 d3903898737b15f6478b0dea224561ba0f8c8f5d0d292d50bd7fa4863f9e7e86d8c1ad1abd967d0577fb0a633fc8cd6bc3afd2f3d3c1d25b61066c61d6b3189c
SSDEEP 768:Um33Iq5LALl5Aam6aQMGdjWca4Ghf9Jta:Um3MrmaME6pJU
TLSH
T10DE2AE719C6888779CBBA295F72B3243BEF05163C9C85E8484ED6B0E06D718E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ecb6dea3fbf1ec35be19bf068136d76324bd174d8dacb62974a0b381ccc9be39
MD5 a5ac3ac029ffece3f7b8cdd72c951d81
SHA1 c7458dc86379f9923b5eb7d25de2cb9896d36621
SHA512 1febec9214c999029ee5db186fd018755d3180548036abc2037d6acd1c7f07e9e5d8bb09f24acd136f74f988df410d8af3062b410c0ca03838973e2ca11a02b6
SSDEEP 768:wFQS3Cwg7Iq5LALmAam6aQMGdjWca4Ghf9Jta:jS3OmaME6pJU
TLSH
T114E29E328C98C57B9CBB9B95F72A3243AEF05163C9D89A80D6DD6E0D029718D1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 02fa3b36fd64cbd13573ddb581813b14e92e73a591d0d72ac6e9c786af6c7cea
MD5 f8f38d0b598b6bc770198f93cb509c44
SHA1 550a783a09018d5b08ab537ebbf6b5d4bf714319
SHA512 ab97f77efd42c62d4b60667a0e5158db05a3ee189e4cfd31bb33d6eb1d24434fe2d7c72348bc09aee83fa4d9977606c57db9ad785d01effce368de7de66bc847
SSDEEP 768:/rv+4UNbdq3/Hq5LXnAAam6aQMGdjWca4GhfBbPeU/:/bsbc38nKmaME6pDH
TLSH
T165F2BE31A86C9573DDB79A89F21B6787BEF021A389D40E80C9D91B0D439708E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download