943dab096faccd1bebc64f0fdb0bbb066eb38ffac46261fa154b587b2e71026b

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample260820-wz1z7atbme
SHA256 943dab096faccd1bebc64f0fdb0bbb066eb38ffac46261fa154b587b2e71026b
MD5 2ce2a1951e29c969de54e24634e11396
SHA1 bd712c6fd62d4a03bb8933729d614d4c715d4aa9
SHA512 6e6c2996e3bbfae17a3af48049bf360e738b2b960fabf8e13b1692995d19484458c736d3c234a4075857cf774b0ec45658453160a6bd644cd9abb8439db25e30
SSDEEP 96:CQUK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdcwYKuID9kKCZxjD+9+25tdLwGg1IZzU:n8/SVPmuQ3C/Da7d0JuCidI
TLSH
T18DE1A56BB5405376135143B1600621BA733300BEB79D464694DBE62EBBA23B4AF7F0DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317238302260264"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5E51302F-684D-4399-9A18-E1E399D4F775}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 744	1940	msedge.exe	84
PID 1940 wrote to memory of 2220	1940	msedge.exe	86
PID 1940 wrote to memory of 3204	1940	msedge.exe	87
PID 1940 wrote to memory of 2220	1940	msedge.exe	86
PID 1940 wrote to memory of 2220	1940	msedge.exe	86
PID 1940 wrote to memory of 1688	1940	msedge.exe	88
PID 1940 wrote to memory of 1688	1940	msedge.exe	88
PID 1940 wrote to memory of 2980	1940	msedge.exe	89
PID 1940 wrote to memory of 2980	1940	msedge.exe	89
PID 1940 wrote to memory of 2980	1940	msedge.exe	89
PID 1940 wrote to memory of 3276	1940	msedge.exe	90
PID 1940 wrote to memory of 3276	1940	msedge.exe	90
PID 1940 wrote to memory of 3276	1940	msedge.exe	90
PID 1940 wrote to memory of 3216	1940	msedge.exe	91
PID 1940 wrote to memory of 3216	1940	msedge.exe	91
PID 1940 wrote to memory of 3216	1940	msedge.exe	91
PID 1940 wrote to memory of 4260	1940	msedge.exe	92
PID 1940 wrote to memory of 4260	1940	msedge.exe	92
PID 1940 wrote to memory of 4260	1940	msedge.exe	92
PID 1940 wrote to memory of 2776	1940	msedge.exe	98
PID 1940 wrote to memory of 1364	1940	msedge.exe	99
PID 1940 wrote to memory of 2776	1940	msedge.exe	98
PID 1940 wrote to memory of 1364	1940	msedge.exe	99
PID 1940 wrote to memory of 3028	1940	msedge.exe	101
PID 1940 wrote to memory of 4564	1940	msedge.exe	108
PID 1940 wrote to memory of 1276	1940	msedge.exe	109
PID 1940 wrote to memory of 4828	1940	msedge.exe	110
PID 1940 wrote to memory of 1216	1940	msedge.exe	112
PID 1940 wrote to memory of 1216	1940	msedge.exe	112
PID 1940 wrote to memory of 3060	1940	msedge.exe	114
PID 1940 wrote to memory of 3060	1940	msedge.exe	114
PID 1940 wrote to memory of 3372	1940	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff910cfc188,0x7ff910cfc194,0x7ff910cfc1a0
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4431965062373703599,17009946263572297240,262144 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,7993245050885348246,17757499322222995469,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,13592533286866459281,4282870647919006843,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9201162990587814524,1028100070547583584,2097152 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9636572317863406614,8263744822853147993,2097152 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,6256564054150923170,10251030608576649205,2097152 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,6568928464976036176,4988954104174849855,2097152 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,16593869966632333341,8811172126818124770,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,14917577073908826151,5805529314268289440,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,12958561808640768957,8338126824162292669,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,12958561808640768957,8338126824162292669,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,16998637416200243125,17984832509520093008,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,11180609642167664022,5641455296253165033,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,18302708381243665744,10227630819601786205,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,2313854280727574279,15166662797541747909,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12854296568810165678,7824942722134391174,524288 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5404,i,7486930618220817624,11365586527174710904,262144 --field-trial-handle=2388,i,16514132698829820497,10158876175562956111,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 015fb3077970e9035a1658d1b1757b5f1151c502ca5aba72322677dd389ba262
MD5 a332e5771886514700151487fc0803e3
SHA1 fa223baa69dc6c50019b6b01c0dbdf1c52de150f
SHA512 98ff8ce5a74571dfbd8813fda54fa21ed146df8d130405d052cf93d1536c6572a6b23be98fc604180e5ec939533ad70e021ad455ebfb2f457b79ae2658f84ef3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7M:fwUQC5VwBIiElEd2K57P7M
TLSH
T1BAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0b7463b063e41d9ce75ebbb729cc39216527ec519266dd8cf1fe7a8bc5cbfec8
MD5 604271fbbee4f42e87ee3a061b213184
SHA1 1f7f12cafc4fbea715606fc276645805ba78bd1f
SHA512 752a539ad8c57cc5e30573f0d65196b66f76fa5a6846e747fc6681ba98515afb501d625bda923ff908eef71a78583e2329ec9195379eef00e2b0d4e071f36287
TLSH
T10A612A0A87534CE1F3701173F4AE424A3BB1C159FBB79E10A4E484BD772CB6D856652B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ad04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ad04.TMP
Size 3KB
SHA256 606763db960558bb681ea9e7501d6622b8cd6b3db15e4ee086eb9c359db1f685
MD5 205bf605bee99348ca4ee0ffa4718b06
SHA1 a600e573fa047e68d286183c2f519a43db5df490
SHA512 1e058a9754543e47ec6d9b4a7b6e0d57037b8f8e0dd769d2de356f38b437146c7c18e2c970903ebde4a40874d0538cd4e0ae282b8a5cf9c53b475627fd9fc460
TLSH
T1C7612A0A87534CE1F3701173F4AE82463B71C199FBB79E10A4E484BDB72CB6D816652B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 203fc01406aa7c9d062ad97c06fdd034c9abb7a613b992657ca38c1fff46e84a
MD5 ca8751fc3a26fa776a1d6a6d9112e2c8
SHA1 f71c8dd3fdad50025b20b3cd206240e791755bfc
SHA512 cda6f581d927f642f09402c1f01be7d03911d982d26b4437e8071f25f97c3c7ab8b11ca4cd265107af039c2fef8b8dab0886bd0b7ca9e0b8b71e04fae1f509f1
TLSH
T165115BB3C3D5956E8D1516F05A28AE1BCE1D0506421C7C1A89D4EF27D3E3065E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7256e8d30bda85a8e38e1d08587dfdef570ff99834375f499ad7a99518bff65
MD5 c8f1522fa5013f0b4137356704354699
SHA1 c89500f877e4c8f3815c2d9dbe365512ad114034
SHA512 448ca40002bafb2569df3f9770dd922cf6c4229a2a7d77be524e0ac4e5cb040fcfb61e27740b39fb78a5a5515281d8f57e56f00739dcd2d3930fa6ee7df774e1
SSDEEP 192:sxZsRmyM/jK1Ml8Mkj/fss/jMfkIdpdDHW6+WNGYLzHARgIgrJ:sxZsoMj/fss/jMf9ZHbGu9
TLSH
T1CC42F8116A34A977CCDBD209BA55BF53D6F91472A2500D44AEFCCA1C04E7EED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2e31ed13cbb25c5a7be780d71a0aed06ae59638b8f3baa61a6529f2108383ee1
MD5 9a60a47d4d5bd5b6ef999af9c0e4c689
SHA1 a8360fb70fb3ec2967b8b5557e6b05511e74c635
SHA512 40dd6ab93c2cdbb10c08b158537449714d0f2a31a6f4049ec3a0ec6735084e59ed3a60b452b737f9b8d1ceac3a6ca6e7c8e918d5e647d8a2b740ffbc7e25ffeb
SSDEEP 192:sxZsRmyM/jK1Ml8UQnkj/fssBjMZkIdpHDHW6+WNGYLzaFRgIg5ZOJ:sxZsoqkj/fssBjMZ9jHbGS6
TLSH
T10252F811AA34A977CCDBD209BA51BF53D6F5147292540E44ADFCCA1C00E7EED222782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e72454fbb4fba17221e1e98d5baabff963798c1fa70f5c9c90424f671b4b7fbd
MD5 fc29ca3bed746221cbbc5ea51cc0fb31
SHA1 cf540213debf96585b863a89e1f33d227483b20c
SHA512 8a32bf5f45b2e306bd3eecc06eadff2c87a443123df8abdde077f5d582a6766524275cb61864160ba6b5d733dfd6c4d85f069f19311c60fb2760d6353f93192e
SSDEEP 768:WGPZs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNP4roOF:WGPZs6pD1WvxzWju1jahILIsNPDOF
TLSH
T137D2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9e205d699f3d991c151a55c0724b12319b7fc274bda92af6cc72b212d23f715e
MD5 405d7f93b7ecbde1e085c86a91f64590
SHA1 524d212044053287f059ceaa97666fd86e8ffc7e
SHA512 9a055b4a022316f0ea78eb41cf7fe11e9fab8a13a5953d6e15f6313372246cc29a60703c37d65e47030859c9e7c54e4b0590b7c7728378cdfdd3a841604fda49
SSDEEP 96:KUAAKtePGhOKy46CK8K/aMHeKIoWKqsKHqD:ii1Z3CN/8
TLSH
T140E17B4272BB02123C7E690C929987275F8277633418E42B7BA840F64E76E345DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594c90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594c90.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b20daa21ae81789f04a5aa34129bd40be51871585b2a20073eb64a23e15c4358
MD5 8a8d058af5f5bf14a06a06754992205f
SHA1 6c02873076f6c4ccc33cf38145e45a8bc9bf4e13
SHA512 31776b14879b1d8548b1810aabb4ddc4e9ab0b1d2e814d3f96da70a86dabe98006f0d0b32b53bc70b635cc676567b40a467f627457e0b3111500a452259a73dd
SSDEEP 192:udm+xasuheOwQxMGsNapQeZNuyi3O7+3vKCnQmiU11IlB4atb0/+Fd15GqLMXq0L:jZcIhsNapkNNv0lua9pd1cAiv7mon
TLSH
T164827D315C786C7759B6E141FA8B350B9FB490B7D6C9AA40D4ECDF2D00DEAA81317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f8acb144fd481e568303dff1d7e163a2a164f35a56f9c409c06632ba3cc37cc1
MD5 464651bb191470ff630c3dad853c0a01
SHA1 f64b984d537cb05c57b273d8283f5c6df58ab628
SHA512 12f8905f9ce6a360830da11826837488e54be6452bd6c095a4470c8f686a0fbd88b274cde8aa55e40165fc157c0871b84b19b75969518c09ef53c703c5b3d104
SSDEEP 384:FiFiZcIosNi8TUNTUlIl4kNNv0lua9pd1lAiv7mon:MFQo/wgNUZb9AiDm0
TLSH
T1C1A27E325CA8987B6DB69A81FA8A31078FB440B7D9D9FA50E6DC9F1D009F5DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ded2091a7e6250a1eb57834de0821c09329e65096ea83714cf6dea4995a8964
MD5 86f7d25e18a5fca0d4750a3bc7248f63
SHA1 9c12dd5f058b90dd7c5d505cc80e1f4c7c01ca5f
SHA512 78bf36371d63415f25312c60972498093b75f50e7e579affabcaa988e6c516fa392a877028957e9d3f88623860b61a21823ab1625a267004b7c9fac4446ed63c
SSDEEP 192:qON66O7+3hQmiUyhxGttb0/+Fd1DgGriU6:qON661sGt9pd1H2U6
TLSH
T1A502F7396C782CA78EF2AD46F68737174FA5117BE9A62B40DAE81E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b21e5c5c813e1e65d972c6d7579f499b20802d42189576aa98bc7b2d5672a9ee
MD5 0408f76bcbb8999ad5fdf36ee41f8702
SHA1 3f688e4f7eaafe47e0daa9f26d0cc48e9e983ae2
SHA512 21962dc6a79e397acc0a693cc6727f0b29b382434d6baeb7ccc173e08474a8c651df4d80db47f4e99ac849e5dce6d4eea78fad0ec4dcb332d38daa1e0b7d7d8f
SSDEEP 192:gONr6O7+3cQmiUyYxQttb0/+Fd15G8cNXq0SU6:gONr6GTQt9pd1sAU6
TLSH
T1611209356C686C6B5EA2B441F5C732178FA5827BDE8A7F40D5EC5E1C00DF9AC2346822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7f819274358e53e9fffd4b2f1f19c4e29b19d386dbb7fd0f7d27d414976eb617
MD5 5ff97bf9f46d40f22253aec3d0aa62cd
SHA1 96b611d8bc571bac4b4818a85631bc94503c204c
SHA512 226ce576397d725278e4b394ad306d9ad3507973fa86eadd069474914a2f7e34b20a8e1a6eeb321dfdb62e250820714b10e6e022c472c6a06547c01a2d110b04
SSDEEP 192:u0m+xasuheOwQxMGsNa4QeZNuyi3O7+3vKCnQmiU11IlB4atb0/+Fd15GqLMXq0L:2ZcIhsNa4kNNv0lua9pd1cAiv7mon
TLSH
T195827D311C786C7759B6E141FA8B350B9FB490B7D6C9AE40D5ECDF2D00DEAA81317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 52746fd76862440185b190c3b26ca1fb3fd63ed2ce0bb2dea71d9919f00bcf32
MD5 6af36337f4c6a342fd9e7a74bc9d6a1f
SHA1 33749da92fd0c0dfd0b2a8dd6c8609b3dab717b7
SHA512 a9feb006d85da70d88d66fd8450081603b4a65bba51499147b6b67235b4c3678021802e3660b9488f362903828665ecb02a8201a28a0c2014a12684245e940c4
TLSH
T12A41179CB6FA2104B3B77E5A9BF6A86C847F78732F0BE45D10110E4F0626A41C861737
MD5 SHA1 SHA512 TLSH

Submit Download