9cfb57e8855c2c72998c724d512914dcabd04aa7e7b38a23bd70a2e657bfaae8

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample260823-gyw8aatcmd
SHA256 9cfb57e8855c2c72998c724d512914dcabd04aa7e7b38a23bd70a2e657bfaae8
MD5 bb5d8bd5e5cbf6e788df2b613656e61c
SHA1 3d0694d6cccd12395ddf567009ec3dd762759b1c
SHA512 a149cb7f7dae4d7e410e7d2f0435fdd6f4cb7ea953bb619347bfd8e51e6c4f7168adff09eb3de9a7f2fd0ee432095d35218b83b40780ff9183887379cc97d5c0
SSDEEP 96:4UK8pz1E/4kF5kyJ0ifN8uueKQetcU4wtcwTKuID9kKCZxjD+9+25tdLwGg1IZzj:68/SVPmuF3C/Da7d0euCidI
TLSH
T131E1856BB540537A135143B1600621BEB33300BEB79D4646549BE62EBBA23B4AF7F0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319392624893160"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{27670849-8D2F-406F-8CA5-B206EACD1796}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 452	4040	msedge.exe	87
PID 4040 wrote to memory of 4792	4040	msedge.exe	88
PID 4040 wrote to memory of 4400	4040	msedge.exe	89
PID 4040 wrote to memory of 4400	4040	msedge.exe	89
PID 4040 wrote to memory of 4400	4040	msedge.exe	89
PID 4040 wrote to memory of 4032	4040	msedge.exe	90
PID 4040 wrote to memory of 4032	4040	msedge.exe	90
PID 4040 wrote to memory of 4640	4040	msedge.exe	91
PID 4040 wrote to memory of 4640	4040	msedge.exe	91
PID 4040 wrote to memory of 4640	4040	msedge.exe	91
PID 4040 wrote to memory of 816	4040	msedge.exe	92
PID 4040 wrote to memory of 816	4040	msedge.exe	92
PID 4040 wrote to memory of 816	4040	msedge.exe	92
PID 4040 wrote to memory of 3456	4040	msedge.exe	94
PID 4040 wrote to memory of 4828	4040	msedge.exe	95
PID 4040 wrote to memory of 3456	4040	msedge.exe	94
PID 4040 wrote to memory of 3456	4040	msedge.exe	94
PID 4040 wrote to memory of 4828	4040	msedge.exe	95
PID 4040 wrote to memory of 4828	4040	msedge.exe	95
PID 4040 wrote to memory of 3972	4040	msedge.exe	98
PID 4040 wrote to memory of 2768	4040	msedge.exe	99
PID 4040 wrote to memory of 3972	4040	msedge.exe	98
PID 4040 wrote to memory of 2768	4040	msedge.exe	99
PID 4040 wrote to memory of 1820	4040	msedge.exe	101
PID 4040 wrote to memory of 632	4040	msedge.exe	105
PID 4040 wrote to memory of 3484	4040	msedge.exe	106
PID 4040 wrote to memory of 4488	4040	msedge.exe	107
PID 4040 wrote to memory of 4176	4040	msedge.exe	118
PID 4040 wrote to memory of 4176	4040	msedge.exe	118
PID 4040 wrote to memory of 5116	4040	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7ffaf801c188,0x7ffaf801c194,0x7ffaf801c1a0
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,11100937667549633016,11497663832819164027,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2922159502968178643,2417746706617024795,262144 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,13870659717863083185,5591135269185072292,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,8917564219738245352,699825720234651605,2097152 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,16266692457562299719,2420130289290587127,2097152 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,4854868001779801012,9152000114056935243,2097152 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,10169236225603148191,6731934947167764950,2097152 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,18248219150781017241,17364594196323957101,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,17456807106531391329,7163845080699447931,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8644887712368029426,14256700851152685910,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8644887712368029426,14256700851152685910,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,1165530083526925396,6874731444398248850,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,7591853859743497321,14232890669958941901,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,541285657987964661,12067605909885106469,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,12032931671163509257,3125237726865209989,524288 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1044,i,4521341994874018667,9337736871732601287,262144 --field-trial-handle=2248,i,14971351301055196975,14109500929759635919,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e8bfebaa7281d9faed3a365b9793e1dd54436d25d0edb32f1bd7a6fa818e87a
MD5 7cc90c224e2e9199d0aba4beeb14979b
SHA1 d9ffe6d59006e2c7c274b44b0cef9da0e0d52690
SHA512 54d824cd1d45c31465a7be46c5e805aa427ef395bf2e7ed0465e09c62c703f88dc2448cbe3ab6228fb75c8fdf5f91d139834f91370ccf608f6b1d2732b384059
TLSH
T1FB717F59C6590C91E7601CF9EEF2B27130B284C80993CED5951049FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586944.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586944.TMP
Size 3KB
SHA256 551a000faf5e992eb516de188bc336fbc4f65333f6570e1cf227fd9fb06a411c
MD5 60ea0e488e3bc96fe2fe5a5adcfc8c39
SHA1 64e2da238be796b5f2efd4035389b54c2e6d5c08
SHA512 85b6ae4b9d11c5853e842580e4a6a9fd0fe82408cea56dc8c46a1b16c34d6fdcaa53ff92f6c2a28b4061c4362d0196523a8c5213fce6c0154b8cecc3457e73c4
TLSH
T146717F59C64D0C91E7602CF9EEF2B27130B288C809A3CED5A51049FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8b729310288d0a1b9e561e3a82a9c6ac8c0070b6028209f584896873a7ff3c55
MD5 73670566268a45057e042e754867353e
SHA1 823f15d207a2182a896f9f9286fcb30ac216c94c
SHA512 acd325ea92117ce61f240315ab1a47a999fa4763e7cdee46ce5f425ccdd7e18040d11c2d15eeb542164b4970dace0c33ebd8e13e430d02ff4865dd5974bb0ecc
TLSH
T101117AF3C3E5856EC91516F09A28AE2BCE2D0606422C7C1999E4EF2B93F3475E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ac9c508685c954e271017cb8ba16119e5e26a8a54884e48dbf406de610cb3439
MD5 0debcccd4a0851b3951a18ff9a23dabd
SHA1 b9c791abfe847d72f32b0e3d992dc65c85af0848
SHA512 ae378378d2d023f18ad6a8e24f1198759be645f8ad115b9cb9fffe1c2ae544815cb2bc78d6cee728f3e1d5f972ca6819ff11bd8a085c097dd69eb39fd7036a2f
SSDEEP 192:sxZbRUyM/jK1Ml8MkB/fTs+4HIdpd6HW6+WNGYLzc8HMIgrJ:sxZbaMB/fTs+4IoHbGMQ9
TLSH
T18C42FA116A38A977CCDBD209FA51BF53E6F9443392540D84AAFCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 28e5a5991111665b40df83afa96f3bc3f9843eda3fb4b9df38c8804a9a91e618
MD5 827d3f1f37ea450ae15612e802bb57c7
SHA1 2aa3143060db7e6cecbccac175c9bdc12336e2a5
SHA512 f26098f517e37cb8513db5a94dbae3951fa85fd99f00c6bc8a02cb21baf8907977f408d3610c32dd92869153f6162abb3f92cbd289b5284e473d340427ceb5d0
SSDEEP 192:sxZbRUyM/jK1Ml8UQwckB/fTslIHIdpH6HW6+WNGYLHHOHMIg5mJ:sxZbaqcB/fTslIIaHbGHQI
TLSH
T1E852E9156A385977CCDBD20DB941BF93E6F9547392500E84A9FCDA1C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3245d324f08d842fcc92fe4383d61dce1b673d6fb3cc945de66eff3961b740be
MD5 6564ae09a6ec0fab5bbb82d4bb715fce
SHA1 2c154e67a8420a756d924933638aaa2acf1892d6
SHA512 0548c0882f5edc71598910ebf23fb3a7aa37cefd1fe9a9afaced37a60b8292ba185da53710fac18d85b5c96982bfe789f4ea11f0e878d0ed29988699dc12e011
SSDEEP 768:NJs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNKrorq:NJs6pD1WvxzWju1jahILIsNhrq
TLSH
T176D2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB94899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 cea9ae42b6dabe57ca68c9fa1c1ecc12fdf0df18dafea46c4b7d2e5b9ce17a54
MD5 ce564f4b05e5315b128680e1d1374dc0
SHA1 4adfaf4a5ebebf47a1eb5c4f525aeaf4ef37c41a
SHA512 ec7adbf59053018cbe7b5d58bdc7b49f0648b318a084f8bbe2322b47a435ab77817a81d2932052e8500bd20297a76d29ddb90dff12d620d3871b4d629c966dac
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wf:KUAAKtePiwQKFWvC6EKfKuurmKA88
TLSH
T134C12F0271BB0A033D7E1B0CA265872B5B427263305DA92B3BED40754D9AE394DFC6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5903bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5903bf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f369155cd42ee07fc1b978d3a32da0c62dcde10ff07c8a6ff99818821b05120d
MD5 d24f8fbfb6e8ae3aa99c8a54241c204d
SHA1 76b3316942c275b2ffd00d0254bed5daeecb49a5
SHA512 793aacc40083e1264a721f920f06f6694da83729d8bfbfd7b7677bbdd6010bdbbcfe3424546da7df00035760c261046aa5837ad0c309ce7085db9a723896f49e
SSDEEP 384:SZcIhsN99JhW1k51lKa99d/VfcIivp+aXoM:ghwnrfzcIiRlXr
TLSH
T177828D315C7C5C7719B2E145F58636179FB8D067D6DA2E9094ECEF1C00EE9A8230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7bfc707f06771c91b188f7140c698433cb7094fc79c320e48a38457470d7eb52
MD5 89fccd190bc04dae30262412c1ae6255
SHA1 1665957c01db6ef47ea9df59ea5fb6e3f86e4e2e
SHA512 5807e23b6b5d900476a13376a42cf64e4c3a9f32e23fa5ac2c6c202b25b5d0c0f7b2c52faec5a6c32716b11d4d1a4159278963f9f91e059cfde179efdb82ba69
SSDEEP 192:qONt6O7+3hQmiUyoUGttb0j+Fd/9UgGt6W8rU6:qONt610Gt99d/9att8rU6
TLSH
T15202D6356C7C6CB78AB2AD49F58727235FA5117BE9A62F80DAE81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5d98c075bf6902d750f8b2c1904f8c29a2f4ee7958e688ed94fda912b58e5b07
MD5 1c84283dd5e323d187e176130cb1a4cf
SHA1 cb7b4de885df5ace3ec75402bdd2ad6b498a2e16
SHA512 c098f2ef65a0b03677c15cc8a4327bd9eaaee395517c7fa1615a7e9294d506645191eafb8bbba0cef51f7a431c1464b4fb3008e4c1de677500e4cc049bbbb31c
SSDEEP 384:pZcIhsN90JhW1k51lKa99d/VfcIivp+aXoM:hhlnrfzcIiRlXr
TLSH
T17E828D315C7C5C7719B2E145F5863617AFB8D067D6DE2E9094ECEF1C00DA9A8230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bf425116e7ab80ca9b03a2029261f82ee8589a9c13ab7f0514e6cba41deb7fd2
MD5 93752f3feb12c851793f2bf1b0a71f14
SHA1 6aaa2eaa73dc2c900dea7299fceed10ae7444968
SHA512 e31adbecc1eacd42e9d305fcc212dc79d1b03307af4623c2e8525acbd0bde8891394b66eb4ea8a6735a27baa593985e224baa944aa92189c1d2940a22f0c3acd
SSDEEP 192:aONY6O7+3aQmiUyYUWttb0j+Fd/cQzDRecN7qI8m+U6:aONY6kKWt99d/VftIU6
TLSH
T1FA121A356C7C6CB75EA2B045F48736175FA5416BEE8A3F80E5EC5E0C01EB96C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7bfc053-11f8-4189-8349-af0304e14451.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7bfc053-11f8-4189-8349-af0304e14451.tmp
Size 21KB
SHA256 ec179ad5933c8b25048b34d9009197230923ed8167df2da63ab811e411c0fdbf
MD5 33fa00e02a10c295b016c3187697f2bc
SHA1 eb7e8ff8ab51d5a535e017f84ddc9bf7f015c58d
SHA512 f2a9638279753860facafa4a912e5b9a170e390c0041ebdaaa0f85c888a66912418115be963f6a9318e0012e3466837baad2f77b24f3b6082c9222c5d91e20fa
SSDEEP 384:riFiZcIIsNH8TUNTUlIl0JhW1k51lKa99d/VfTIivp+aXoM:GFQImwg6nrfzTIiRlXr
TLSH
T1DBA27D325C688C7B6DB6D644FA4A32079FF58067C9DAAA90E6DC9E1C00DB5EC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2eb6c7d-331d-45aa-97fa-3229ba9a1402.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e2eb6c7d-331d-45aa-97fa-3229ba9a1402.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ee393c41f5d5590331f8899e3a2a2622d7b1d8395b5e3c0df75a57ff4bb3ab7
MD5 b3fbc5e446a65fd2940704712ebdce1a
SHA1 21b22688bf9768d29ffffc09b30fcfcbe0fe265a
SHA512 0afae645ce5b54af85617417adb823e02d766e72b56e00a018e91966a5196bed8d0546eacb8785a737011065dce838d2d932c196364b63ee5ecb73bb9a0a84b2
TLSH
T1AA41D658B6F91148B3B76F5AAFF6A86E447B7C372F1AD55D10010E4E0A22B41C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download