491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample260731-g33kvsxtds
SHA256 491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2
MD5 5ee8d4ed40e9db9f5f74dd6ae092f07f
SHA1 9c455e63e9f2dcb1444189eb1eea914d6b700222
SHA512 afc7716726ecb6a36d36139918c4bfed68e40b74629302a86116c8ba54d34f7423edf90206f04a4e072d6ef448b7581be76f7d7a342830f6a89a25812eee3af3
SSDEEP 96:CWUK8pz1E/4kF5kyJ0ifN8uueKQMdcwFdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:98/SVPmuN3C/Da7d0JuCidI
TLSH
T191E1966BB5405376131143B16006217A733300BEB79D464654DBE62EBBA23B4AF7F4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4240	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299525263913319"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{09C6A63F-82F7-4215-9C66-1ABF39A3D965}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4280	4604	msedge.exe	84
PID 4604 wrote to memory of 4240	4604	msedge.exe	85
PID 4604 wrote to memory of 4996	4604	msedge.exe	87
PID 4604 wrote to memory of 4444	4604	msedge.exe	88
PID 4604 wrote to memory of 4996	4604	msedge.exe	87
PID 4604 wrote to memory of 4996	4604	msedge.exe	87
PID 4604 wrote to memory of 4444	4604	msedge.exe	88
PID 4604 wrote to memory of 1256	4604	msedge.exe	89
PID 4604 wrote to memory of 3868	4604	msedge.exe	90
PID 4604 wrote to memory of 1256	4604	msedge.exe	89
PID 4604 wrote to memory of 1256	4604	msedge.exe	89
PID 4604 wrote to memory of 3868	4604	msedge.exe	90
PID 4604 wrote to memory of 3868	4604	msedge.exe	90
PID 4604 wrote to memory of 2472	4604	msedge.exe	91
PID 4604 wrote to memory of 2472	4604	msedge.exe	91
PID 4604 wrote to memory of 2472	4604	msedge.exe	91
PID 4604 wrote to memory of 2368	4604	msedge.exe	92
PID 4604 wrote to memory of 2368	4604	msedge.exe	92
PID 4604 wrote to memory of 2368	4604	msedge.exe	92
PID 4604 wrote to memory of 4504	4604	msedge.exe	98
PID 4604 wrote to memory of 4412	4604	msedge.exe	99
PID 4604 wrote to memory of 4504	4604	msedge.exe	98
PID 4604 wrote to memory of 4412	4604	msedge.exe	99
PID 4604 wrote to memory of 3192	4604	msedge.exe	103
PID 4604 wrote to memory of 3308	4604	msedge.exe	108
PID 4604 wrote to memory of 4264	4604	msedge.exe	109
PID 4604 wrote to memory of 744	4604	msedge.exe	110
PID 4604 wrote to memory of 2572	4604	msedge.exe	112
PID 4604 wrote to memory of 2572	4604	msedge.exe	112
PID 4604 wrote to memory of 2816	4604	msedge.exe	113
PID 4604 wrote to memory of 2816	4604	msedge.exe	113
PID 4604 wrote to memory of 1948	4604	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbf528c188,0x7ffbf528c194,0x7ffbf528c1a0
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,4353476776848987572,5352283772280970301,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,9849852240241725897,12884664902309806099,262144 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,13526055173543197276,7993191243383390873,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,10881982403267110629,16602796060910089525,2097152 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,10877608443215101644,6390645605881679560,2097152 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,2697891850055971751,7597300743270986119,2097152 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,12107002920162717045,16989593040277219536,2097152 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4032869948097645514,16060408041098188455,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,16201049735226461171,7734613540002339858,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3935901644504021908,8725785987371502753,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3935901644504021908,8725785987371502753,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,2791022000768856809,7236270596781727514,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,15959960515290407822,15513599437467775978,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,13543103904386938897,3628117482783245437,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13127777010725307611,15088557675940607454,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,15082447957830833819,5509576891703883560,524288 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5196,i,2142018262699577306,18356908011106645857,262144 --field-trial-handle=2452,i,18245888443503477406,9512847205280816907,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d81ffa8-ee80-454b-96ce-bd6716a16ff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d81ffa8-ee80-454b-96ce-bd6716a16ff8.tmp
Size 19KB
SHA256 558b1bc6ba98dbd10fe0d94f610ec7c6eb4ab59c82f6b9526f147699accdee5e
MD5 841040811347c372f87b126ae5773924
SHA1 dacc847e63ea213d37d7dc6c6a3214121c4c93c8
SHA512 bbf378cfd9d37a2ba2a51065c7706b3729763a80c6702342b184d51d15e5515ba727df946ccf2772e14a0d2e60c12759a9d68fe0afc9009c4e583f0e4c734e36
SSDEEP 384:rZcIhsNradMbyhOVRNVOK+t9F0VOObjI9G6w7I:zhnMHVOKs9WV29MI
TLSH
T120928D36AC344D775AF6A506F48B35274EF8907BE7C81F84D0DCDB0D06DA8AC1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c43b111d6b1a44a2988949af4dfb8ce0e9848e06f179c6ae35b309dd1f8f7f6
MD5 ed022d119e09dedf6dcfc9db916fbc02
SHA1 8cade4abe6f1ff36efd339500f91ed62de8f9f87
SHA512 bacba78315dbc99f32dfbd79559b06fec6264805f56efa4ad9d314f4513b33114d6f1d86ac02c7ab80e3f32c4add3e2263b0711562f165fe86ea23b1306083d1
TLSH
T11B715CB04EDB0663FB60803268E333667731B7FAFC175E9902E24B342795762F05A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589025.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589025.TMP
Size 3KB
SHA256 06708dddae4cd759ba3c68c1861decf1208c5d4036caa8001b597abb5b44aa4b
MD5 bde89dfb397718e3c1f28aad644e85b2
SHA1 26b9a997e6a6f6e3758af987576c08f8c149b47c
SHA512 82dd324ac42fb66e8232be204759b595d3a2c822d5ab8e5c6dc28430f05681c10899e1ac75bd44dc738137b04685bc1c84ad6482466e191f9bc96e4c910e045e
TLSH
T198714CB04EDB0563FB60803168E333667731B7FAFC175E9901E24B302795761F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e5238edd96e98ce3abdb7be91fc6891a912f82b3ea65b2c0f34ce04737610581
MD5 adb6cf852b997d903cfc19cc929fb03b
SHA1 f1d5dc41906d87665e302ae87976ff38e356c13f
SHA512 3a44c5d5c9bbc1cd51c671f3fc4bc66bdaede81141082ebc5c691f6f26dc05315b0c0957227ebdcbf544f05165c12a5eb1ec594a710e68a1ba9fdeb7afa17186
TLSH
T11E117DF3C3D5956E890557F06A24AE2BCE2D0605421C7C6989D4FF27D3E3475E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 305441d6a6c2a6c419fe3de9a58cf28e600f1435fb8594b6ec6b7d0eff84cdd8
MD5 f106e9b9731913f6b9e83414ba65b4f0
SHA1 b82c7349bb751c0497f24dea527000d11adbd8b4
SHA512 e362ea9eb155418bfeac1114bed56e3d08660de2df28821b59a1f9c7d55ddb576831910e4b90d1716f576d8ee330f8c7131a4bb3e5760d6e7ca8fff98c550364
SSDEEP 192:sxZTRGyM/jK1Ml8MkoW/fSsmPjOIdpduHW6+WNGYIkXU8IgrJ:sxZToMoW/fSsmPDAHbG29
TLSH
T1E642E616AA34997BCCDBD209BA557F93D6F50463E2940E44A9FCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0b7070f49b5b5e779f3163d0d3f52e6a4f7b43176ab8c2efd470a09bd1e0ec59
MD5 9f7d2cc44f6ff955345552c8ae43a5ce
SHA1 eb32ed47541c7d896e030dc44e54908931a24c46
SHA512 029ae22310559ad3ffc59f213ba3ee00d34d629a2eca7231aca4bfc511892a8b4675e9a72ace124294fba997d9e86fd1d7641218be049548b71d2559db3be15f
SSDEEP 192:sxZTRGyM/jK1Ml8UQ+koW/fSsQCjOIdpHuHW6+WNGYIYGKZ8Ig5OJ:sxZToqVoW/fSsQCDOHbGxQ
TLSH
T11852E656AA349977CCDBD209BA417F93D6F54473E2940E44A9FCCE0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4b254ca82b2b1d6ad4154ab7fbce0e52335f4eeaad5b9973544acea029a3adad
MD5 0ba8fae73535bfff2c5f7754ff6bbb90
SHA1 747646192dfd570827ee338be3f2c82b8c68ada1
SHA512 72a802f2240cac27f7fdcbc861398be9a7e848b8b727bd6e003e45e15bbb1f0ab31d0ab6bef3ac87e4b010d891ffab07df4c275f4becb47bb12e0d045c59b9dc
SSDEEP 768:qUsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9droQf5:qUsqxXlWvJD6Tu1ja54LAs9WQh
TLSH
T101D21B3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 689837e195a0f3a9cc262e98f88eb478077a595342d28090f0938330c81bb34c
MD5 cc659e461f0d223c2cb378976b74c5a6
SHA1 87028681b4e05fd2293a70036e59168badad404d
SHA512 2d5882dd7597a65be43a1315701bdd8a414291e967d5fbff44d1b1ea18352daf9f2421af7aaebe9d146d0e5acfc67da54dcc24a8d8b3ce2d1ea1a5110c6ab05d
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2J:ExZBdPxza
TLSH
T1F4E16B42713B820238BE6D08A27696374E8373A77518A56F7FB870760E66E110DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592adf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592adf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4b9896fbbceae868b6ee0475b2b455bab6cc325cbb307d8ef896d848b45a4dd4
MD5 fac97c741c81d0b4faed061dd71385a3
SHA1 c6b836071de90094fa21c38411f2f0adb13112e8
SHA512 517fde12163af04dbacce28974ba95f5512bafb724c5d829bddd312f2e6d9d73e2c05a28e54bd662c6066dd54ed6d1625c903c7da6237131f81e06d6ae501c42
SSDEEP 384:qiFiZcI0zsN18TUNTUlIlDdMbyhOVRNVOK+t9FZVOObjI9G6w7I:hFQIMwgLMHVOKs9jV29MI
TLSH
T185A28D339C64897BAEF69B05F58B36278EF4507BD6C86A94E2DCDF0D01AB49C0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4db210b57825b1d0569967a35a97165da864daeb41abd4351bb524735bdba422
MD5 452514a41a2bfec12bc3e74634437dcf
SHA1 162f245b31826e3242e49ce7cf82e9b3f9d08781
SHA512 dc8cb81408f76976307b9f726b5165318e32fe0b68d2dea77c43f35a1b30d06b4fc019e8ac2d97b6ce3948be092b11278e792d81bc561097d871ec5d83cf19ea
SSDEEP 192:tONc6JkRtQmiUyS+W+RNVOmSY+y9h3jReU6:tONc6Ur4W+RNVOK+GIU6
TLSH
T1D002C8356D381C7B9EF26E0AB48B27275FA9203BFA856F94D6D81F0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3563c816462d66f47c46bfe4d566a8fefcb73508721acf8d40733d2eb11a391f
MD5 bdce2edfc494d43ba058737bfae6505b
SHA1 ee819d8c3f448abc99458bcf397d858bab831548
SHA512 467c60fd27716edc59f46db102a4548224e4acad7823893f32f956482e20a0d482fe8af40817be0bd6a00924c13175b7a93b5ec83d52a94abb697b868c55438d
SSDEEP 384:GZcIhsNrDdMbyhOVRNVOK+t9F0VOObjI9G6w7I:UhmMHVOKs9WV29MI
TLSH
T136928D36AC344D779AF6A506F58735275EF8907BE7C81F84D0ECDB0D06EA8AC1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 407d049c2f33d351c987b8658a420f6c4012e39f72cd9061432447a9aeddbabf
MD5 db67a1e12f16e51c621e1fef7dc0f65d
SHA1 92d308b02a2533e4b8629a5cb1810a03242b52f5
SHA512 66e22469219e8efbab9e6c47b39be08a12423f751500385a0a55ca9170802c04cc1248f9003c2acad559883f4c4e44fb0dcb79f74fbb43b1fcd2ba57703f8b4e
SSDEEP 192:FONRU6JkR7QmiUyT+q+RNVOmSY+y6l9nFYVcQqmyU6:FONu6Utvq+RNVOK+t9FvVU6
TLSH
T161120A36AC384C7B5EE26945F48732678EA55127EA896F90D1DC1F0C02DFA9C231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76eabbd7-f49e-42e7-8385-93b2cc3c20c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76eabbd7-f49e-42e7-8385-93b2cc3c20c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa4bc6a7c18dd43239dfacb5071528ffe70a39e32ca3840341b0b437f1ed8353
MD5 452273bde4a6f27f9b45d9a9ca89d47e
SHA1 8457581f404aa162f6f51e1ea33d4722b34c6635
SHA512 dfaa9d6b842926ef85bfb458713d81309006ca127854453d829bafabd3e150466e0a0b509c03b825059d5de052c8124d226149ed7734b7edfdcf5c67d43e7763
TLSH
T14E414798A6FD1148B3776F5AAFF6A4AD487ABD772F06C49E00110E4E0667E40CC62737
MD5 SHA1 SHA512 TLSH

Submit Download