cadbc65f11f9219344d672c992b13f0950089e13e04967e3b5839ccfa4e1e61c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
processwire-master/site-blank/templates/errors/500.html
Size 298B
Sample260928-e679eawvcz
SHA256 cadbc65f11f9219344d672c992b13f0950089e13e04967e3b5839ccfa4e1e61c
MD5 a392b1a2ec7cd2792786ef169dfaf29a
SHA1 2f70638cce52a44c33438474c5072ada1bde9838
SHA512 8e93e6efa587c44939054a6e7cfe4d68f0ba7bfef646307d36afb22d2131e2fb9df7a6a56b314d12e5493690b5ae135038405ec320e8be3054707d8d7bd90f5c
TLSH
T1B8E02BEF810B62435062844876C211C03F60265765E2A5D40585E5FBF9C31A9D70F2AC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{B379083E-ECAB-4738-80F3-25D809ADB33F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 4028	3604	msedge.exe	89
PID 3604 wrote to memory of 216	3604	msedge.exe	90
PID 3604 wrote to memory of 2624	3604	msedge.exe	91
PID 3604 wrote to memory of 2624	3604	msedge.exe	91
PID 3604 wrote to memory of 2624	3604	msedge.exe	91
PID 3604 wrote to memory of 2628	3604	msedge.exe	92
PID 3604 wrote to memory of 2628	3604	msedge.exe	92
PID 3604 wrote to memory of 3720	3604	msedge.exe	93
PID 3604 wrote to memory of 3720	3604	msedge.exe	93
PID 3604 wrote to memory of 3208	3604	msedge.exe	94
PID 3604 wrote to memory of 3720	3604	msedge.exe	93
PID 3604 wrote to memory of 3208	3604	msedge.exe	94
PID 3604 wrote to memory of 3208	3604	msedge.exe	94
PID 3604 wrote to memory of 3132	3604	msedge.exe	96
PID 3604 wrote to memory of 3780	3604	msedge.exe	97
PID 3604 wrote to memory of 3132	3604	msedge.exe	96
PID 3604 wrote to memory of 3132	3604	msedge.exe	96
PID 3604 wrote to memory of 3780	3604	msedge.exe	97
PID 3604 wrote to memory of 3780	3604	msedge.exe	97
PID 3604 wrote to memory of 4040	3604	msedge.exe	103
PID 3604 wrote to memory of 4040	3604	msedge.exe	103
PID 3604 wrote to memory of 2092	3604	msedge.exe	104
PID 3604 wrote to memory of 2092	3604	msedge.exe	104
PID 3604 wrote to memory of 4780	3604	msedge.exe	107
PID 3604 wrote to memory of 1704	3604	msedge.exe	112
PID 3604 wrote to memory of 4652	3604	msedge.exe	113
PID 3604 wrote to memory of 3444	3604	msedge.exe	114
PID 3604 wrote to memory of 2552	3604	msedge.exe	123
PID 3604 wrote to memory of 2552	3604	msedge.exe	123
PID 3604 wrote to memory of 4928	3604	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\processwire-master\site-blank\templates\errors\500.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb9188c188,0x7ffb9188c194,0x7ffb9188c1a0
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,8126748477664574082,8048435484571284027,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,1487426615215589157,15989426751551338776,262144 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,5131394712735792136,14418396300126764735,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16382600629074527260,13119815858413730882,2097152 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,11171624331861645939,7740974922515414385,2097152 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,3107060165865772839,6890348556693755977,2097152 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,13743966600049678528,2535429480513708932,2097152 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,796954172014924154,1591534092374376842,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11029958606000683254,8243018582291366180,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,6669990137794145264,12026300562826117161,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,6669990137794145264,12026300562826117161,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,13177318628844737992,5103481499399004280,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,339870676251396861,10613849429924403345,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4722304966446070306,6209019336485195067,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4240172355854566839,5128764423690420886,524288 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5784,i,5207556220031891662,14878094048805562248,262144 --field-trial-handle=2352,i,11034003397767653060,7781194575608311674,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35ef0e500878a558143b57e807d7dfe8956563679342232fc84e6df6d851b950
MD5 ea9596a1088f2d4c6c5655ecf2b1fcb4
SHA1 6d083fc237a4cec5523264420359326702e00ed3
SHA512 69599fb722306a7f5639535e5bf5a0bead074ef2b585779c4059aa919d02ac4dee2287273e905c2e2b2e5903bbafe2520003998367b596ba1c588a7b471af7ef
TLSH
T10C617383594040A5FBFC603193F01E8F37F68E81A94B7D63319CF4A7DA06F169139894
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59072a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59072a.TMP
Size 3KB
SHA256 fddefcfe34475964fcfc4f4ad6d3c00df5a51f48a3f3b3788f3ebdfe8be0232f
MD5 2fc6cfd2649275d2da8ced48d12b9061
SHA1 e8c514542346863c908429267d694c161bbe49b6
SHA512 93610df02faa5d1ee83031dd4396a56375badcf643f636118e742b1b1a44dea85931187764dba68dd8553d7ed50b0695b094d4fc72986ccb706746acbb8d1214
TLSH
T166618483594040A9FBFC603193F01E8F37F68E81A94B7D53309CF4A7DA0AF169179894
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5d0ac86fed8062de8a8dfff8341d21bbd649e398aa0d928ad575f587b47ed7ea
MD5 a326965dccaf754667a6b33b75a00b72
SHA1 3b1a2cb476fd56e79cae15479a3ce7bee0d07a13
SHA512 738a3642308146bc67b97c8d89c71196576d9705ffaf09e634c063ba79f1043135d9c1b483e04c03a5e9d69e1f6fa3ab7eec409bb320aa5ba6ba67b7564ec702
TLSH
T124117DB3C3D585AE8D0116F05A24EE2BCE1D0505822C7C59D9D8EF2BD3F3075E10299B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0779627b205c0965fcd261b8ef722d9a764119cc36ca6f242103d7536d966da8
MD5 a7814768c5657f34e8cfcfabd6b4ceee
SHA1 88dc462ca3ec9e0d701ec24f37f51e29354e7279
SHA512 a076844241fdf38c40639b80682b5791ed67b17d621a2394dd2da351a3cde52d707c99b144693b24785ca7d700e0e363662ab29d24a6354faef76bb3a9032c9e
SSDEEP 192:sxZJRaWd/fnsxg+IdpdjHW6+WNGY3RysIgrJ:sxZJ7d/fnsxgvdHbGC9
TLSH
T10B12E7516E38A57B8CCBE21DBA257F53E6F9403250951E48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a03a766bcb8d75acb1eb6bcff17fe70e39c8f94d8cfd4cb2e74fd5615b042690
MD5 d5184b4113e0769f1b4e5a2b796b0a0d
SHA1 c9ed889fe707ec62e67919fd11342b64557431c1
SHA512 8fa89c3cc5c8a297066d0088b763578493a93c8566e059c383596807e800de6cece389e7156ce16bfbf164afc00198b27137ca1d348c8b8c8c2d9ed1e562b6d9
SSDEEP 192:sxZJRaWd/fnsxy+IdpHjHW6+WNGY3BysIg5RJ:sxZJ7d/fnsxyvDHbGM9
TLSH
T1D322E7526E38A97B8CCBE21DBA157F53E6F9503250951F48AAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d0e22d9bc6e2d0cbb45fe6e4f78b5cdf9ca7b1cbb765ad9108ef8aeab10fb691
MD5 b650e0eb49501b32fac796c1c783e600
SHA1 2aae6eaf7e13587b54f69d0f849503cb8303c468
SHA512 35ebc9a3a0650b8d96765b0dd34f66a0f808db9fde73b18af1ae9424b6034f292da7ef4909ea4cd870bb6872c8bb8629b4e9b149f6a3c26576725ef41fe7cc82
SSDEEP 192:sxZJRaWd/fnsxg+IdpdjHW6+WNGY3RysIg5DJ:sxZJ7d/fnsxgvdHbGC7
TLSH
T1B322E7526E38A57B8CCBE21DBB25BF53E6F9403251D51E48AAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 04da7d5b53a4de5fce6ba9cce0f360ffaca842df452234ebad5be37fa6f9f98a
MD5 1f6c3653819e7f5060c9518abeeb121c
SHA1 f4f446bf4c4656d6f70b83190b0acfdd4aa05e03
SHA512 f6afb16ff41f2b3155f5a1723e8cd369fab14b3243546f37f90d7157ecda8e1fb8eda39ac311279cca65f299717ae6c1a4a11f1e005b5c4d6ef655732e40ed6b
SSDEEP 192:sxZJRaWd/fnsxy+IdpdjHW6+WNGY34ysIg5RJ:sxZJ7d/fnsxyvdHbGr9
TLSH
T15E22D7516E38A97B8CCBE21DBB157F53E6F9503250951E48A6FCC61C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 84077408d18efead85f827d3902e0af28eb8833e12871845667c81772a46d957
MD5 fe2857974aa290e3f2ab27d7af3c7b69
SHA1 02b841793af6dd9fe3fd87375a0a33aee3c5caa1
SHA512 8880bb506c6bf5ccde24969fe806d7f6f518779b3dd9072e59cb9a266ce64b24d46ce34ead28d8f4f822f9d9b801e8f6e46c433e464fd099e8e2198304a9295a
SSDEEP 768:Ag30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72YrolZM8:Ag30AbSWvS2l9u1jaLmLZ12j3
TLSH
T152C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 475cf9142988c1b45bb9f1c9333eaa634e75a2e18af5b819fc97313d35ce2792
MD5 d0c210eb4924dc6f69f5b0e1a7841ea4
SHA1 246f6204e21ed9278fadd1be9f586bb61a09a8de
SHA512 e4844d4a9b0fe1f1543901ab2c5c6c9cf52c777a8c4b80817e3a1df7634f07cbc0c6350a1f7227d5fa1b5c853b61a2bfa5bb0f7e4a38d04ac6ed5ecc19dcf8d8
SSDEEP 48:K0CNCsChC9CPC7C/CgbCTCmCzISC1CgK9C11CXCgxClCwYC2C3CtCtyL4neioS20:KgfeKgYG+fSKAsbf2K08ql
TLSH
T1F491E01434BA52103C7E255D80F48B5B524132B37658EA2BBFBC44668E2FE095DFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a1f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a1f3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cd1a9123fbe0085a1eb916029e59e31256b630cc88877022c431a4eb362587bc
MD5 d0d49f79269883c74f906b5a098f2c1e
SHA1 be198a1ca6a1c35568eb4bc0a8384cb7fefe2a9b
SHA512 b14d063566a050c17dfdeb4e8752c4e8abad7d2abb43c57410c20a959ab5ec2c4e64ea706b942dc513a248b52e9d727f6a8534b37a0a445d71e83dc4e963455d
SSDEEP 384:mZcIhsN5T1e+puI5kC9iX5FECDtgOIwZOylLyoI:0hqe+IGatDXs2Wr
TLSH
T126829E32A8B85C7B6DE7A111F18B3A035FB8806BDBCD5F94C8EC6B1D01D65E4030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 036dd05879127fff4aed1f085ecedb1d329eeb3abfc41954d8135deb42760322
MD5 23e3f487d349c6e1a503b596089df72d
SHA1 f9e9f66b5fb45ad3f2e8afb16e7aa2732a5f077e
SHA512 a96219fef951db4b11464f997aca1aebfce7a8779a677e0a4c1d376fc2925ea7d618604a5e7e8e1782d1fa0b662ad71f3b529740336a16877f20def764d06a06
SSDEEP 384:wiFiZcI4zsNb8TUNTUlIlq1e+puI5kC9iX5FEnDtgOIwZOylLyoI:LFQEuwg8e+IGaCDXs2Wr
TLSH
T1B4A27D7398B88D7FADFA9A54F54A36038FB440A7CA89AF94D6DC5B1D01D70E8030BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9fb4ae853da2e1c1eaf970c5960254a0264032c318763af7d8bc69ba2056419b
MD5 b37f55814d502e955e30d70a9ed2ddc8
SHA1 8d4fa75bc8a978aa6a72373eda6bc55c78bcb86f
SHA512 e19fa9ecd34f8387b1c000f3fc90038cc8b97f6c7088dca3488268a87197d5f748c18b0f724c83cb413638b3b07d11cb81b2830fc949b4696f56be6d5c1294c7
SSDEEP 96:gqONkXQsjpfuMVwptaL5ih/cIPURHl8h4otop5ziCDZBIPuva6zx8X5Fx+xfYvNn:LONr6AmwprQmiUyt/6siX5FYRkJiMhU6
TLSH
T1A0020A35AC786C7F8EF3AE14B58B7B135FA5106BDA952F44CAE81B2C01D768C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd03180e665c211d10de1088446cacd6114c1a14f63a9a3bc2b648b180b404da
MD5 882078f8b2459f6f5db84cb9bbc57599
SHA1 12615bf5facc960c94da71b20a64c6b2eb707017
SHA512 191f1e7c94b79c6a010300caff309e91061c92270d7cd0e4ec6f7b793893c8007158f52e8bf3fc4de098e19df347c2aacb6a05ed9b19cdd8ab1180b76329549d
SSDEEP 192:LONE6AmwpVQmiUyk/esiX5FYRBBlRDq8U6:LONE6ipzhesiX5FEJDU6
TLSH
T188123B36A878AC7F4DD3A550F08739035EA45167DF8D6F94C9EC2B2C02DB598530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f919115b56489dd3d123279dc0cb25e52c9fa9ffb0ebd9932f8d8ff455b913c0
MD5 ada8a5ad3387abe47d0d4892fe8f7098
SHA1 2a06015e5a8709d6e424573377dbb3eed9ea4899
SHA512 be8b942fa89063e27b9cc736840d493d8fc8b9ffb46aef04bd7e110454c07d620f9553f83ceb9636b0f559a91c597e63409dd2274e1076da23c9fcb46b8ebb9f
SSDEEP 384:hZcIhsN5q1e+puI5kC9iX5FECDtgOIwZOylLyoI:ph3e+IGatDXs2Wr
TLSH
T132829D72A8B85C7B6DE7A115F18B3A035FB8806BDBCD5F94C8EC6B1D01D65E4030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4f776c7-c422-4da4-a28c-649f8df4d41d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e4f776c7-c422-4da4-a28c-649f8df4d41d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6c4abb1e815ec69defefb8ea8a2a4f5086854c00f498b45ef756bdc4e4a5f7e5
MD5 1796f31337ed470ca03b7f729d4a9c9c
SHA1 a04288d91540de4f69642422884d38df2af3a59a
SHA512 ae05d094874692cbee1d0791e7ca7a31028ff005bc9e56dfa52c6fdd091344e319f1cfce92fe21f13c810e8a571754352710253dda49db209c71220e7a082744
TLSH
T10F414858A6FE1108B3B77E569BF6A86D487BB8371E0AD45D00120D4E0A32F40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4780-175-0x0000014DBCE00000-0x0000014DBCF49000-memory.dmp

Download