d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample260802-wt38csdq7x
SHA256 d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c
MD5 161dba8de49f41eee63421cce887ca0e
SHA1 b1fa0fbc7ac9176f2af1d8e1eade2215e0589884
SHA512 2de5c438949e6b349d0450ccf95a904521482593b776b3b7a39478a04500f8c752103a75db353d884723d6556b639858c5482047f81e4bd57c277ae3e3ad76d3
SSDEEP 96:CQUK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:n8/SVPmuB3C/Da7d0JuCidI
TLSH
T157E1A56BB540537A135143B1600621BA733300BEB79D464654DBE62EBBA23B4AF7F0DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301680926395373"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{9F184248-124B-461A-B12E-CF6ACF488479}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1632	4184	msedge.exe	89
PID 4184 wrote to memory of 1480	4184	msedge.exe	90
PID 4184 wrote to memory of 1380	4184	msedge.exe	91
PID 4184 wrote to memory of 1480	4184	msedge.exe	90
PID 4184 wrote to memory of 1480	4184	msedge.exe	90
PID 4184 wrote to memory of 4932	4184	msedge.exe	92
PID 4184 wrote to memory of 4932	4184	msedge.exe	92
PID 4184 wrote to memory of 1564	4184	msedge.exe	94
PID 4184 wrote to memory of 3576	4184	msedge.exe	93
PID 4184 wrote to memory of 1564	4184	msedge.exe	94
PID 4184 wrote to memory of 1564	4184	msedge.exe	94
PID 4184 wrote to memory of 3576	4184	msedge.exe	93
PID 4184 wrote to memory of 3576	4184	msedge.exe	93
PID 4184 wrote to memory of 3908	4184	msedge.exe	95
PID 4184 wrote to memory of 6024	4184	msedge.exe	96
PID 4184 wrote to memory of 3908	4184	msedge.exe	95
PID 4184 wrote to memory of 3908	4184	msedge.exe	95
PID 4184 wrote to memory of 6024	4184	msedge.exe	96
PID 4184 wrote to memory of 6024	4184	msedge.exe	96
PID 4184 wrote to memory of 3144	4184	msedge.exe	99
PID 4184 wrote to memory of 3144	4184	msedge.exe	99
PID 4184 wrote to memory of 2012	4184	msedge.exe	100
PID 4184 wrote to memory of 2012	4184	msedge.exe	100
PID 4184 wrote to memory of 3184	4184	msedge.exe	102
PID 4184 wrote to memory of 2212	4184	msedge.exe	106
PID 4184 wrote to memory of 5664	4184	msedge.exe	107
PID 4184 wrote to memory of 4428	4184	msedge.exe	108
PID 4184 wrote to memory of 3916	4184	msedge.exe	109
PID 4184 wrote to memory of 3916	4184	msedge.exe	109
PID 4184 wrote to memory of 1392	4184	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,2845986803191638430,5731738452875892170,262144 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,439869090516978038,15082673998255897545,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,17890130960432530426,783026651923064630,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,15154335369674072425,2554615984322527032,2097152 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,13008022583209716666,13322966236463154920,2097152 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,6222835569500822765,1600816673599698193,2097152 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,6549909587563688817,991298618951975832,2097152 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,2672092126150033123,9632234136821543533,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,10273983272969001344,7813749865764199022,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9415972781295646998,3316471286307943500,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9415972781295646998,3316471286307943500,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,13723322538756062809,14979116652738892255,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,5957153506464402906,14696554863270474997,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,14696402330934239773,7155951592597014202,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3148,i,5724798883453667656,15523217392480408360,524288 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,12937159361370760080,9659123245003831835,262144 --field-trial-handle=2512,i,1235363878678902256,16226796896309689862,262144 --variations-seed-version --mojo-platform-channel-handle=820 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

61e51917-ac83-4b38-aec4-bda8fceda2ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61e51917-ac83-4b38-aec4-bda8fceda2ba.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2d0ce0e05b8281948797c5d249d7419bf57e1a31e0adc3c8a79b46910c1f7ae2
MD5 a77f5f17aff777aa1ad29ca0a6c02f52
SHA1 8efb3d4f0aa6371b01223a1a0486e8b2c14d1429
SHA512 bd3972de44acd45401b56ef35819374a1545b48fa25678211ac0c194310cc1bd91e40cea9a661821cf1695f5179d144c189aebe6abaf1190ef109f122e45a876
TLSH
T1EC51BEB807F129F2CBA446755AD1E20A32F8889900B3DE4B40401DB55B07F6D16C2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cf3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cf3d.TMP
Size 2KB
SHA256 1adfcaa362c2898d981c86ba442410fd332763b70d0a206074657dbd60112331
MD5 ff193f351c027fcb842b3940a9fe67db
SHA1 7270a11efb4bd479011d49d7837bb1483e9d8688
SHA512 4d802ac065a491ed02a461c15b742bea66aee4ea5cf67eca4935e7cf735774f42d88acbc538cbddb496fbefebfbc7f6ae37c71e22e2a95a44efd9fd3f4109930
TLSH
T12C51A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 253cf81910e4e2ba89b23e38086286a418f817cab6ceed6b70c4dd4793d521dd
MD5 3cb6889ef4ebb485191a843465410e6d
SHA1 1a9c74eedf6f3bdf2c9dbfa78eefd19c0708cd79
SHA512 8950b1957d1b1d6faf7905828625686f932cdd4756e92243502f42aec3ba31ccc53fe38952da901c715f99eb0878656dfeda3682306f50cd1d409a81865867a6
TLSH
T1E941CFF3C7E4893D890156F0AB146E2BCE1D0915432C3C6AC9E4AE2BA7E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 02a7a198f6a81e8085ac562325f08a718224b393cdf895fdde08f2ee5ecca71d
MD5 2b9f8fd29bc0ac8edd6e21bf8f763017
SHA1 ce78f1d59cab57f9ae5a56981678da6bfd199c9d
SHA512 9645e77d2baa3eebfd00c23de58c1f5953b3c5810f5503dd14c22a1b87181c7dc2c73834345b09167682962aa99ae5168a13e053f67baa197823a05ea78546e8
SSDEEP 192:sxRYRVbv/fDsiqDde5lSyzoD8p4o/g6+WNIYCfuOQGRIgDANJ:sxRYrv/fDsiqc5lJ5/5I3B8X
TLSH
T10342C6166E28AD3B9CC7E20DBB55BF53D2F9503261902E58B7FC961C04EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 330a8efd036632b931c4a2271a68987d78dd0be0ac6d06530a9d8207a471499b
MD5 89c5d9ef1ef14ee32e7bb2546672c404
SHA1 b01fcce2fb55cd39872cc088265086a904059289
SHA512 a27bc30bff4faec66cde904a31310764427fac26ebff75274c419922bf98058b4d5913f299e234a43f784cde30197b91fdb4d6a4dd8259d1dc91086d93bb803d
SSDEEP 192:sxRHRVbv/fDsk1Dde5lSyzoD8p4o/g6+WNIYCyuOQGRIgIJ:sxRHrv/fDsk1c5lJ5/5IQBs
TLSH
T18F32D7156E28AD3B8CC7E20DBB55BF53D2F91032A1902E58B7FC961C04EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 899f22c17b119eff40a8a5cfa67efe27326e841aaa1aca40989490ca44589a68
MD5 26d98645efb9760b6f7ff8ae201fabe6
SHA1 42935d487b55d8db54a9c7d32b198b3fec0e6270
SHA512 0aa44af5555535cbe22fdab70d0a460871c12ed8fb2a7b392ca599256c16d7f43c3472104bde9c1eca0c21cc10306e8c5d669ba69dc907e125f6cabc6bb55464
SSDEEP 192:sxRYRVbv/fDsi1Dde5lSyzoD8p4o/g6+WNIYCyuOQGRIgDA7J:sxRYrv/fDsi1c5lJ5/5IQB8N
TLSH
T18232C6166E28AD3B9CC7E21DBB55BF53D2F9503261902E58B7FC961C04EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

befc30df-d3e8-4ba4-ac02-be6be7a9476c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\befc30df-d3e8-4ba4-ac02-be6be7a9476c.tmp
Size 23KB
SHA256 d9522b03d514364821735fb9ee49a2135c034e9a6163eeb0cddc03663a8a8e38
MD5 c154a03206beba42684bd0752d781bb8
SHA1 7ea3ae983024ab273761eb96b29c4df5c66eab65
SHA512 e33ae9ef28d86222e12049c45e244cccd1b5695bace6fe3cc131fc74c8f58d9302608b915b3751d4d48a54ae3d851d893b3b531a3614de3a0d6782ed2f878572
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvUroZSL:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VR
TLSH
T120B2EA2B600DCB7F4F800AADEC596FD76DA802CB97589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 86a3c50a828d8332ef2c7760c09c7a81e77d3d3c1c0b36c14e1663c875b0b962
MD5 e2fa3f3887d818fe1d4c7b09f09a28e4
SHA1 08cb62f8f0700ef7f306b50f7ffc9ccfdd1c264c
SHA512 1ced03834d380bbda34474768a3b3c53752e08e4cc6981e75feee1ced083cc91c035d0975cbbf4b3c8dab2b823dad53a01a3d529157fcc8355114d68a68e9dff
SSDEEP 768:yrv+4UNbdU3Bw/KnVp8+p3bd66j+4BRv86aLIWV2ewBKZOyW0:ybsb63Bzj8+p3Z6n4yf2evZVJ
TLSH
T13313BE72F868AD739CE2C648B14776437FB85193A6C01EE4D9CD7B4D119A1AE630BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c998acd835063bf0ab01b0b78c7d34d390c7eb2d3d851471b478ac7389780086
MD5 b102ef42a4065889e3503b0ef9bac799
SHA1 d0c1a4bd206c62cc341f56d6051d55c4e45063da
SHA512 450c6348b9629de8c8fc75e192e82b831d2aa48aa1e1ec6b08b1e66ef91b56e0ad6eaefcda967c3c3c11ec24cf3edce4bb8bd5387850f754e5b7aa879270134d
SSDEEP 768:vD36w/Knfp8+p3bd66j+4BRv86aLIWV2ewBKZOyWa:vD36zx8+p3Z6n4yf2evZVz
TLSH
T19FF2BFB2F8689C739CE5D644B6463303AFF451A3E6C01EE899DDBB0D10961AE570BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 723681d0a6a1470ab14b673d0d25daf3cf3558651fba10130ac3a16214f11fa4
MD5 e1de08deafd658609bc40e000969bdae
SHA1 387a08cdb48c31b98518b99747910f564f982269
SHA512 730bbe2166fbac1c3c39bcb1f792a9bdb2e32164ad7909d6e7b112df8840ab3ac175743f952cbd8ed411e6ba0eed3a4bc613a8cb2d7ecea6d1a779d8c01aa144
SSDEEP 768:WD3Bw/Knfp8+p3bd66j+4BRv86aLIWV2ewBKZOyWa:WD3Bzx8+p3Z6n4yf2evZVz
TLSH
T1A7F2BFB2F8689C739CE5C644B6467303AFF451A3E6C01EE895DDBB0D10961AE570BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9a6fe3c85e4bdda0d86df5d9a9e026f1ab7ffe18eb472bc21ee1628a6935c698
MD5 a3ac5db37edbb5c17ebe356372caa233
SHA1 7ae0dd26bb39e4f12926aa1c3d7c22845473bdda
SHA512 c0bb7723280da5dd5d90ba1b564f26558af4f4c7a9e9326b1d7664741b6c2e8f46f1dbd0682daa5760217801c5a296917eba6cf5dbc70be240826f22585832b3
SSDEEP 768:KB36w/Kcp8+p3bd66j+4BRv86aLIWV2ewBKZOyWa:KB3628+p3Z6n4yf2evZVz
TLSH
T1DBF2BFB2F8689C735CE5D644B6463303AFF451A3E6C01EE895DDBB0D10961AE570BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d08c20a1750d0de7b133cd3651ea8fc16a7d44ddfec065b84a78e40c5f16cfa6
MD5 1aa26c20e21892630e19c32c406f91ae
SHA1 b60a9eeae2fb8a1761f95b6e4598ac3475551c50
SHA512 1e3b86c168e8994363144cf2a0487e35dc30a9b6583f5e36b9bee62ec8e1215e003d569407420358eff0e967d121792e23bfbe3d45330a502eab169ab2311d7a
SSDEEP 768:Irv+4UNbdD3ecwNp8+p3bd66j+4BRv86aLIiR2bwCl1:Ibsbp3uL8+p3Z6n4yL0ww
TLSH
T18203CE73F8A899739CE6C644B2467A437FF811A396C10EC4E4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e365b25-f183-4e4a-8cab-48bbcf405f16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e365b25-f183-4e4a-8cab-48bbcf405f16.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download