hxxp://smart-heating-solutions[.]com/wordpress/sp/

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://smart-heating-solutions.com/wordpress/sp/
Sample260910-se8mratvct

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335262232580022"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{24D7B183-F0DF-4056-A796-7B2DD77E0178}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2040	4308	msedge.exe	85
PID 4308 wrote to memory of 4732	4308	msedge.exe	86
PID 4308 wrote to memory of 552	4308	msedge.exe	87
PID 4308 wrote to memory of 1840	4308	msedge.exe	88
PID 4308 wrote to memory of 552	4308	msedge.exe	87
PID 4308 wrote to memory of 552	4308	msedge.exe	87
PID 4308 wrote to memory of 1840	4308	msedge.exe	88
PID 4308 wrote to memory of 968	4308	msedge.exe	89
PID 4308 wrote to memory of 980	4308	msedge.exe	90
PID 4308 wrote to memory of 968	4308	msedge.exe	89
PID 4308 wrote to memory of 968	4308	msedge.exe	89
PID 4308 wrote to memory of 980	4308	msedge.exe	90
PID 4308 wrote to memory of 980	4308	msedge.exe	90
PID 4308 wrote to memory of 2432	4308	msedge.exe	92
PID 4308 wrote to memory of 2432	4308	msedge.exe	92
PID 4308 wrote to memory of 2432	4308	msedge.exe	92
PID 4308 wrote to memory of 836	4308	msedge.exe	93
PID 4308 wrote to memory of 836	4308	msedge.exe	93
PID 4308 wrote to memory of 836	4308	msedge.exe	93
PID 4308 wrote to memory of 4900	4308	msedge.exe	95
PID 4308 wrote to memory of 4900	4308	msedge.exe	95
PID 4308 wrote to memory of 4900	4308	msedge.exe	95
PID 4308 wrote to memory of 3444	4308	msedge.exe	97
PID 4308 wrote to memory of 2160	4308	msedge.exe	98
PID 4308 wrote to memory of 3444	4308	msedge.exe	97
PID 4308 wrote to memory of 2160	4308	msedge.exe	98
PID 4308 wrote to memory of 1668	4308	msedge.exe	102
PID 4308 wrote to memory of 3748	4308	msedge.exe	114
PID 4308 wrote to memory of 1552	4308	msedge.exe	115
PID 4308 wrote to memory of 1744	4308	msedge.exe	116
PID 4308 wrote to memory of 3332	4308	msedge.exe	117
PID 4308 wrote to memory of 3332	4308	msedge.exe	117
PID 4308 wrote to memory of 3332	4308	msedge.exe	117
PID 4308 wrote to memory of 4972	4308	msedge.exe	118
PID 4308 wrote to memory of 4972	4308	msedge.exe	118
PID 4308 wrote to memory of 4972	4308	msedge.exe	118
PID 4308 wrote to memory of 3356	4308	msedge.exe	119
PID 4308 wrote to memory of 3356	4308	msedge.exe	119
PID 4308 wrote to memory of 4076	4308	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://smart-heating-solutions.com/wordpress/sp/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8b18c188,0x7ffb8b18c194,0x7ffb8b18c1a0
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16780491225812394171,7109624059157288929,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10349339656756904040,8237080718114532927,262144 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,9439873947053066052,5170853278201037484,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16261315913690668907,8787784472195307988,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,9709562120707017312,10072328457088932769,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,16949893624119819397,6221940590637734116,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,2885284878213742555,4120861613754562196,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,6820042416278411855,12546083085341393556,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,1365659663107637947,2845792819281528568,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,11206849181394431924,18083538254726184977,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14016612827464732144,2160284033534557176,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14016612827464732144,2160284033534557176,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2227713031739113297,17038099613969961146,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2611709131158955305,3932713566773155336,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12390927180929011960,15691428884799781116,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4692,i,18244744559872112841,1860867222016281726,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6388,i,5038718553165646512,14767088159115193846,2097152 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,16247336795964358662,3753533324252645033,524288 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3712,i,3052440473588329687,1165932997846237223,262144 --field-trial-handle=2332,i,16773125569188969237,9621957880385595918,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 96c13b45fa586ab1cb4970b1c501f23cc1b5420341496906ab54c0b3e7145219
MD5 06ef9b438a7b55e51b2528a4ba9907a0
SHA1 9aa8639d141d63bde6c1aa7deae75cc3c328e84a
SHA512 30ed19b4f23a30dc36d5e924db7c7fb4e04e8ae05b553fb7e6fac54bac177a3f815d6fc11534932c9c0d5a5c499ef9b941970a96f64e16cab2761aabb6eca3e9
TLSH
T12871533933108058E3220872DFD956EB763685E7FCAB3E8111F2BC749521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a969caf7f5fb10967c3f32a5a0ae493d0efca03f9fcc1ec26875f5505642dda
MD5 6e8598ef24cab96385336e56cf5b074a
SHA1 a4474632157bfd87a492b186df93ab4b3e5d8a03
SHA512 a862a367bd26dde29ba9879235cf2f9de5588af9386a3bd17a95f62dee882ec9b2b09838b46081ded705b8523b2fc074aa914d2e5cfaa68d74d99c0201c33330
TLSH
T13771733523508068E36208728FD916EB763685E7FCAB3E8211F2BC749521F768626B5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589313.TMP
Size 3KB
SHA256 a49a41246f52cdc9a3dbb2a1d9bf5587e9e57580ad0e8c9d09b64aa438f7e2ba
MD5 54c0a85cfd8b9b1535f0aa8099f1d280
SHA1 b0c326d702b0385acfad9363570d3a75927564e4
SHA512 efb3a8248f621a541c135a91cfdf6ecd808f2a595eea2a3300730968a17252ec5375a7b94ceb9232bb78d26cf8597ea02bd30b0aa67953046bef5b2810aabb8f
TLSH
T18971433923108058E3220872DFD916EB763685E7FCAB3E8110F2BC74A521F728667B4C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6a6ed3c5f7a711cda1eabfa63f1b9399739722c1fab8f12f7afb72f8f760f640
MD5 c2dca2da872f762239d3d16ae4982f4a
SHA1 078bf41143968540d72dd949266e652dc26d537d
SHA512 2e786914262f1719cb7bf2f16e2504f1de378dabc8691c347a6d18e9b2f3733d4108d01fefc0ceb0cc46c5aa711046633fe17b7b730d6acf4c3add222d183a76
TLSH
T13F61BCA2C7E9563DDE1243F0AA147E36CF6D0D19936C380A86D8BF8B53A2471D14698F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e4e9beb7d5671d2210ea72727f58b21b1ab5df2a969b61238d4a4fc0d37c1b42
MD5 e94c7d783b68ff669399402b10b08e44
SHA1 2d46ff72dd80bbbbf095a5f2900373b84c573bce
SHA512 d2cbd2e16c6ab1673a3902d65768e89e6b3307137d4252cbcc8185ef26b480caa944f0f8596caeb35b7094896496a3cb3d1426af21d28a2f180b349257de606b
SSDEEP 192:sxZYRTW7k/fCsCAVGEdpr+HW6+WNw/s/Yv6j5+OIgrJ:sxZYgo/fCsCkiHb7/9559
TLSH
T1D522B8526E38653B8CC7D21DFA25BF53E6FA503291D51E48AAFC8A1C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 27d6e2c1b3ed13f547193f66e8c782eb91a7060a97b070498dd37a5aeb193f0b
MD5 76463621ceaaf4d9c74a141e7c51a424
SHA1 b87b7bc30e886eccfb526ca2686a1c45dabbfdd9
SHA512 1ff634b04ad9ad034fb9fa83a8883f207b0cefb59f16a9030b6e87c607af6a9a7643bf9b8fe437b591c2b63f149bd658af37714a6cffc79aedbe6acf29f148c6
SSDEEP 192:sxZYRTW7k/fCsPAVGIdpr+HW6+WNwUFXYvVoj5+OIg5iJ:sxZYgo/fCsPoiHb5XR55c
TLSH
T1EC22DA526E38A53B8CC7D21DFA15BF53E6FA503191D51E48AAFC8A1C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d06da318c280861aeb5e4407bd2ddbba1ee5e4b5cca1e7e3fd41546b9ac36b48
MD5 9ca22ef3816c32a0651cd2087f678eb1
SHA1 e93a2e383e8fe9c18485d3484f3360db35b8e275
SHA512 e786a28d3e65c53df907a8106459e91090460668ea5a62f17e178a0f73722ddd37b303ead6b034aeaaa8df73de65142ca25e669f3a1fcb3db7fa609dfa326500
SSDEEP 192:sxZxRSW7k/fCsa5VGIdprqHW6+WNwb4ZYvngj5+OIg5fBJ:sxZxbo/fCsarGHbDZ155hL
TLSH
T1B332C8526D38A57B8CC7D209FA55BF53E6F9503291D11E48AAFC8A1C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 30bf4c0d9da731beb888f65be27bddac2c7abfc1ebaa275dcb7eac99130421c2
MD5 731ed07b88318f5fddc3c41760ac602d
SHA1 fa01ffc3c7c167b2ad919ff122a1f077c70354fb
SHA512 e7bf243030b2586573a85533d4991b4c48963bc02bd5267427e97e9db5fd4f121832cb5b5cdd339ec832afabd0f9ced7f35c044b5b7a20906e667893a94b297c
SSDEEP 192:sxZYRSW7k/fCsa5VGIdprkHW6+WNwUFXYv4gj5+OIg5IJ:sxZYbo/fCsar4Hb5XU55W
TLSH
T17522C8526D38A53B8CC7D20DFA55BF53E6FA503291911E48AAFC8A1C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a5d5e6e90ffaa0589ca4bce149e19530b950f231c461ac277b74b1181e52dbf2
MD5 fee7dde8543309d8af0619da5297ec90
SHA1 e599341f8b55cec285b2ed0b4dd7a4475299a2e4
SHA512 0666f417bb84d1b8de807605d70e83c576e4675942f3bd27497ded49cb423b960828e185b4386a1a5c152766ca0d8b3334e877147de402c7948eaef6de6efb7e
SSDEEP 768:NYee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbOrorQ:NYee3rxWvhffnu1jatcL88bFrQ
TLSH
T186C2FA2B640CCB7E4F800EADDC5A6F977FA802C7A7548D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 af3f0fc5da1a1b6c92d4481a33ce925f80f7d28246a13db7eeff587e3a5fb537
MD5 e9965299c00be9f01e5eac620db8e1b6
SHA1 bcb546e5a114c15dec8536313a1a109f1eb245fa
SHA512 992dceff6e57c618d7d9f05af6461487cce586aa5ae9e304978c2fb621bbf3069f3b6b2a9dae7847abc212d8c9a562353bae34a1a5b197a0d0d059ca6bad1d5d
SSDEEP 192:xsN3UaQvkFM7tOGQmiU1PEFQZMTbt+FdLjv3mh5b801cqKc1:xsN3Uac57wideKDd/8Bkc1
TLSH
T191322971AC74AD3799B3B585F04B36134FB4912BDA842F54EADD6F1C01DA2AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 86d7d1521962781e7d7a2acbab81150927af72336eb175f16874afa96d9344f1
MD5 885a7e7be04cf356b41a9f98fe4ac2c8
SHA1 a74e7efc6639d244db674303b1008564bb8a6879
SHA512 d81b9ad57881fa18c915ed15d42a36702ce2f22f6dd0232dcc2106d893548b9f55b0b6fd6ded5286aaf40897d3d269f949024ccd30be455b12abc05ea5540abc
SSDEEP 192:u8m+xasuheOwQxMGsN3UDQvkFM7tOGQmiU1PEhQ4MTbt+FdLjv3mh5M8z1cqKBd:UZcIhsN3UDc57widofDd/8NkBd
TLSH
T1C4627C716C74AD3B99B3F185F48B36034EF8D12BE6C46B54E5EDAF1D00DA6A8031781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d86559c7494dc882a227ba5b7d7d8b0be4bf544f633d3431ed93ba3ebe433999
MD5 4dc4dea8f4e785326b64ca7ed7467987
SHA1 062d911e4faa49cb034fede7b93f56bf31d669f6
SHA512 fb306a58d8070022d062641946915dbde71a7128f8cb0f633eb9464d2d52a8ae114fc6a0f6c73123460d76e84ae579170d00590f24d5937c829384db5c684386
SSDEEP 384:XiFiZcIOsNs8TUNTUlIl4c57widofDd/8TkBd:SFQO1wghGLl8TkBd
TLSH
T132825C725CA4D97BADB7AA85F54A32038EF48177D6C4AA54F7DCAF1D009A1EC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df18451ea5e382dbfc3c296a1af9122ff6a5f50128ab2aa23dbe6291ca6b9229
MD5 787f0b0217e4290c69e4b351b457043e
SHA1 a8597e6610567eacdb2c03aaf94e728b7a9a24f1
SHA512 4d18d8f46500209a547a012886ceed7283e535d18b5c8fe31d1f96f85fd43439ba91a68facede45d11a5d6a25d253764f5b70761d78c3b7f2ec3111742283cbd
SSDEEP 192:lONe6vMtPQmiUyPfXThTbt+FdLjv3mR847GajU/u:lONe6UtRo/TMd/+ZU/u
TLSH
T1DF02FA35AC786C67AAB3BD45F48A27175FF4517FA9905B54EAD82F1C00D764C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7b7a5138bcbc3243e6427d503ebdf9059807388436f2f49f3e8c4e7b374c9045
MD5 d148d3ba562a8bc45a8dd0c29574b7f7
SHA1 f05e54d1ab5718a92770fe8946cfb25be038b035
SHA512 ce54b348a8c1e0299745786159161004db5bf2b40c89d70810fd54138a9018252d8633538cbacc70359adb0625a47d43d6e7c765fbc4f906e9dcbd97f524a6fb
SSDEEP 192:uvm+xasuheOwQxMGsN3U4QvkFM7tOGQmiU1PEhQ4MTbt+FdLjv3mh5M8z1cqKBd:HZcIhsN3U4c57widofDd/8NkBd
TLSH
T14C627C716C74AD3B99B3F185F48B36034EF8D12BE6C46B54E6EDAF1D00CA6A80317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 11e674c86cef1283fdf593bf5ed3cbf642fb865292f180a2f0556f8aa4e059e1
MD5 83ece65f2fced14415e08a8861ad4728
SHA1 a45d67581684f44a36fab61cfd087d821107f709
SHA512 685f75368da32ad30e361753d846bf7763b79eb6c1b8a34e612034c1aa917b345fcc2f2baa9c079a1530e3e8df5b8172a0ebf33ce69c3c701f1e557268037964
SSDEEP 192:CON16vM0PQmiUyPbX9hTbt+FdLjv3mh5Q80IcqKU/u:CON16U0Ro79Md/8VkU/u
TLSH
T1CF121A31AC74A86B5EA3B485F08B32175EB4922BDAC46F50EADC3F1C01DB6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 811363f94e6da79807c03e38012a1790bef1b12980896e1b5bec6683c0b70e7d
MD5 f125f7b896ecc59b1a85288bc8d3c94a
SHA1 0125383286809c430c3d8680f0c45178f06eb81c
SHA512 e2038e9f6c3ce1bdfb13cfa413d308002626b5b6a086bf11e0017e497a50e4df75da4946411940669ef0cfd4657be5363423616ebb2dd62cbba8294cda73ea8e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe590d73.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590d73.TMP
Size 392B
SHA256 5bff2f12c2fdb36bf942f72ce6234ad8ea701f1a95e2ae281997007d5d088ef1
MD5 7e038a096484726a0b22c18478912800
SHA1 dc0c8d6ba4d8c78bb14198453080530cac0fd5c2
SHA512 4df8f4538487f1271fb4682267e7a9066b49d14a573a67816fe26ac6697dc94d1a0bc14b7d2142bc099e183505e9c2574a50c01bad7c6a9b6da1bda198a33bd5
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 522B
SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
MD5 b809bb2b4dca57c6dcf6e141ab343c71
SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
TLSH
T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 1KB
SHA256 1db978eac1f2bfdb3ef11af95f0b0694617dcfd3909ba29a8409c6c09073d8f4
MD5 a69451fb81905eff575822b91d752453
SHA1 a72af8ca4afd1f7ab8b3fdff0909feb4bad21671
SHA512 1f5cfbcd4b35ee20a9ecf71825f2e09209c323e83c4dbef3e3f4b8a2cc16aba96459b7742068851c23e35ec4bb9e44128481f8cb7323eb8aae085c438b89c6ce
TLSH
T1C331196764D0238DA7CF2079FAB857413CC65DE3EAD6B8BAC4C0C3812E54519D004A50
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe589e10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe589e10.TMP
Size 584B
SHA256 5b3aa3cf9bf9766698f25fe0fc61237db11f94090bb8fb754fd8c0d0311f7b57
MD5 35ec8cb5745ba95558fd1919024c184a
SHA1 6890a3c8a65f45f587055bc0fa96b64a0f5f8f46
SHA512 72a9c768a01f48940c5a62c2ab20f449562e2692cec3a39df4eb7942f3fef5b174e6b9069ef6a730011f5b6ea2d8ce37b7d8c812d597ee8ceae8ff546d0589e4
TLSH
T143F047F5D000495AE836A034E5C37492CA4EA7D6411257517183AA46C5C549288C0B3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 92f4025eda54aeeaba42d88201a2a9c2b544f0e07b68a020c4693824761b2d51
MD5 afb04ef778cfa73b77e719d0f1429ed2
SHA1 ef59f5e006b3f8686a8f13b8b6fe4e22a4afda84
SHA512 68fbcf5e87e8a5b6701863e833b639fa6d5868f1b6b4bef8819d32f80211f15a77072c96cefcc6268f2c3bc9f54b28a1439be8e1e3d31acc9e71f0012d5d7b6c
TLSH
T1B641F459B6ED1148B3B77F5A9BF6A86D487FBC732E46C45D00110D4E0A72A40C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download