06eaedee026be2ea1a35a71cccd45173bfeb03fd0e94ab485dbc64cdb766e6c7

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CatfishCMS-6.7.3/application/admin/view/index/articles.html
Size 8KB
Sample261012-rxgrbasx3r
SHA256 06eaedee026be2ea1a35a71cccd45173bfeb03fd0e94ab485dbc64cdb766e6c7
MD5 e9ce4655168269c5af051755db35b54b
SHA1 c7ccb53604475826b22564d9da40b2944cd10ad1
SHA512 a33fd95ac7e8874d04c41b943353a29f706e77043b396050cec1af1feb525efe1ddeddca58d1df6ac41e94cd1b00d7bc61e1a9efae45d88c35026f065144e5f2
SSDEEP 96:Hgq/JUnQ6PqLvm5wo2LqwSB/pTCJ8ivGEbzZi+3kMGe5mRN:Hz/JUnXAAelUMGe5mz
TLSH
T13902ED9181D99E3AA1B3C2D6D380E355F98282CAC396211477AE13C71FFAC21DC37619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{68164D1B-A72B-4737-A662-2F6B83FB3245}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2052	2940	msedge.exe	87
PID 2940 wrote to memory of 3044	2940	msedge.exe	88
PID 2940 wrote to memory of 2152	2940	msedge.exe	89
PID 2940 wrote to memory of 2152	2940	msedge.exe	89
PID 2940 wrote to memory of 2152	2940	msedge.exe	89
PID 2940 wrote to memory of 2376	2940	msedge.exe	90
PID 2940 wrote to memory of 2376	2940	msedge.exe	90
PID 2940 wrote to memory of 456	2940	msedge.exe	92
PID 2940 wrote to memory of 456	2940	msedge.exe	92
PID 2940 wrote to memory of 1788	2940	msedge.exe	93
PID 2940 wrote to memory of 456	2940	msedge.exe	92
PID 2940 wrote to memory of 1788	2940	msedge.exe	93
PID 2940 wrote to memory of 1788	2940	msedge.exe	93
PID 2940 wrote to memory of 3976	2940	msedge.exe	94
PID 2940 wrote to memory of 3976	2940	msedge.exe	94
PID 2940 wrote to memory of 3976	2940	msedge.exe	94
PID 2940 wrote to memory of 1912	2940	msedge.exe	95
PID 2940 wrote to memory of 1912	2940	msedge.exe	95
PID 2940 wrote to memory of 1912	2940	msedge.exe	95
PID 2940 wrote to memory of 2824	2940	msedge.exe	100
PID 2940 wrote to memory of 2316	2940	msedge.exe	101
PID 2940 wrote to memory of 2824	2940	msedge.exe	100
PID 2940 wrote to memory of 2316	2940	msedge.exe	101
PID 2940 wrote to memory of 5112	2940	msedge.exe	105
PID 2940 wrote to memory of 4668	2940	msedge.exe	110
PID 2940 wrote to memory of 4912	2940	msedge.exe	111
PID 2940 wrote to memory of 4780	2940	msedge.exe	112
PID 2940 wrote to memory of 3688	2940	msedge.exe	121
PID 2940 wrote to memory of 3688	2940	msedge.exe	121
PID 2940 wrote to memory of 436	2940	msedge.exe	122
PID 2940 wrote to memory of 436	2940	msedge.exe	122
PID 2940 wrote to memory of 2496	2940	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CatfishCMS-6.7.3\application\admin\view\index\articles.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc356bc188,0x7ffc356bc194,0x7ffc356bc1a0
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,1540526283933584054,3993743644230980788,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,4310815389620899236,9724864333364509028,262144 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,16092734768439273462,7776371138978637910,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10557924727283144023,9132294703867352136,2097152 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,18001933077394222929,1953377562134646780,2097152 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,231355999027138041,10109412715759628374,2097152 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11929798354389380041,16074669112172524327,2097152 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16849258408778971460,12976236264570899177,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10082260657943850815,2607881400790822935,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,14474504157302128764,8709407183144676833,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,14474504157302128764,8709407183144676833,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12173447483475753140,13773054760086717105,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,4289481230171553234,15572325729884516572,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13776512822403727830,14792378718930612390,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,18308854682741174999,15321337200643118502,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,11795096243135994669,18324891940074857039,524288 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,11624664864639760558,9258781961499166831,262144 --field-trial-handle=2248,i,3422738212852091328,325777259179090726,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23a9ce0c-fb93-442a-a240-9ed15645f661.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23a9ce0c-fb93-442a-a240-9ed15645f661.tmp
Size 20KB
SHA256 2d7ae6a4dc3c19686400f0fa1d41aa843c8e4dd4b7093f91d15a6ddea3bfbc88
MD5 58b01161f6754d00294f9308a4136716
SHA1 5aa89d891fc9e737cdd9943b87d9441217e88231
SHA512 91563807637ed6f65ff5c5d88d3eb44b28896749947bc8b415e488726e724d79446dd6c80c8b8ce9e44606e80b4c6ca85e844d926926d13d9e29992205b4c031
SSDEEP 384:5iFiZcIMzsNn8TUNTUlIlUu75KOEToNBGYX5EN3862XOrXi4/uANEbEeUm:QFQwqwgb9vGYuNL2OrXLJCbETm
TLSH
T128A25C7398F4D87F6DE7AA45F94A35138FF8503BD681BB90E2DD9A1D009A1DC030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

500de6f0-b456-41f0-bae1-c69beffe018e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\500de6f0-b456-41f0-bae1-c69beffe018e.tmp
Size 8KB
SHA256 d88808276ea26d83e00d264bbda9178b0ae051cf232ed13f86b6796f8894eac2
MD5 ab50c7bc325068510baf6bc7ea4b1c72
SHA1 269204a51749141f6d94b3b094cdcfcb719a63d4
SHA512 1773593fcdb630dd3c844af8403f644591b7ae8225c7828088823758c57058ef1d8245a65b416062e0d75cd8e5a1a75c6b170bb7c3024422d87c5d20c2535869
SSDEEP 192:HONw6DphIqQmiUyj86PwGYX59ez8CvjzorQRf2XpETkIIOq5FU6:HONw61PUdPwGYX5EN3862XOUXU6
TLSH
T19D121A36E8B8AC6B1DD3A545B48B35139FA8502BEB857F50D6EC1E1C01DF2DC530A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77da2da8-9f3b-4fb8-ba19-3aedcd6d64a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77da2da8-9f3b-4fb8-ba19-3aedcd6d64a2.tmp
Size 8KB
SHA256 92573f63cb66d9fd91042ec841818313328d47ecd2e99ca9de12909cdd21b0a1
MD5 ed0a54bb185f884029bd0b3778987220
SHA1 dae0852dcef2bc98f59e41dd548d43f2688153e6
SHA512 1269adbaa632494593b9a6bb771914c9867fd52b35fdb0e903ca19c40d58f6aca4bb2eb0645a3d13d831134341ab6789c9791c2585c6303475c4ed88cf902b62
SSDEEP 192:LJON96DphmqQmiUyX6q8wGYX59ez8CvjzorQRRkk7MgU6:lON9619JRwGYX5EN38wJU6
TLSH
T1B402E835A8B87C7F5EE3AE45B48B26139FE4102FAA956F54D6EC1E1C01C768C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a68c46e-f034-461a-92b0-f59c727d42e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a68c46e-f034-461a-92b0-f59c727d42e2.tmp
Size 18KB
SHA256 e388d0be7955824e1f667f12d3428514af371f495d416e0363b48aba5542225b
MD5 c5a79d182e1ce251d4c2f450f2fbd2c5
SHA1 0cfb4f323be0dc439b94acef7cbde87ba2ee2a64
SHA512 04620a91059ae7dbdf1611b5a1973ed69f642a7d6a5189fc70f3ca66d7e3ff087e9bcebdd539f8e2fd11ced570397014af4b917cfcd4974cef840444ce5f4ffe
SSDEEP 384:5ZcIhsNd1u75KOEToNBGYX5EN3862XOzXi4/uANEbEeUm:Rhh9vGYuNL2OzXLJCbETm
TLSH
T115827E72E8B49C3B1DE3A546F84A35134FF8903BE7847F90D5ED9B1D01DA1E8130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93ea18da-90df-4c62-b570-8957f8cf74d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\93ea18da-90df-4c62-b570-8957f8cf74d7.tmp
Size 105KB
SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
MD5 71eab00578b8a3050d0ce445655db7b7
SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

7a1989b4-8559-411e-8742-ff5534e5b418.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a1989b4-8559-411e-8742-ff5534e5b418.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8f0f783c-d318-4189-97ae-9528728875cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f0f783c-d318-4189-97ae-9528728875cc.tmp
Size 10KB
SHA256 93b5e918c3c9f9f1c6d1e5d429f4923f61196585c56e5142d391839e6a17c214
MD5 a3dcf93e32b883a028dbf8e50445b044
SHA1 03b18276a0860e5bcd73fda05b5c369e64d9dbef
SHA512 0de37f85b95a4b9d5bbd45a57c755634f5608a625c020fc6caabb13be9e42c9e0477d9bbdbdc7f2ea8281294d6e9c0322b1292e71baa50a1e24d5ed9dd6c5a48
SSDEEP 192:sxZfRsW5/f+sUJ54CIdpHXHW6+WNGYgyEnNIg54J:sxZf55/f+sg4r3HbG5K
TLSH
T11922C8156E786A3B8CC7E20DBA55BF53D6F95032A1901E48A6FCC61C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fba3a63-35eb-4c10-834d-9b3769847740.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fba3a63-35eb-4c10-834d-9b3769847740.tmp
Size 27KB
SHA256 f8793843eeb83e9feff587db0320f7ef98e08bdf933e8fceba954c94f22d41c0
MD5 78fd3821d74012e3295d95f757905044
SHA1 ac68ece579e31f0ce5e2f7cbb3c6ac76a3470689
SHA512 907dbc7f3fcb26a13b4f3ab62c409d3040a164af10e7fad9f91723f9ef50ab3f2271f0c93c4f8f331d903e9e58ab3f43aaff97ecefc1f8e2fbbce50cb35062ce
SSDEEP 768:cFichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzHrozBA:cFichfPWvPZplu1jan+LKgzUVA
TLSH
T181C2F93B644CCB7E4FC01E9DDD1A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97fa159d-da7e-41b4-8ab0-eb3d759d28a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97fa159d-da7e-41b4-8ab0-eb3d759d28a3.tmp
Size 10KB
SHA256 4fb6191d009d8b6c45814e56b1c6ced95fa446bd60d6ac6713a1c27fba1b7595
MD5 83639e24ad0192f9242879c12ee4cea6
SHA1 637fefd8dfd97f7dd01800b88d18602f0c8a807d
SHA512 c016c372a27ce6b8b55f415c39663ed2124d55b949941c78eedfbc39980bc199087e9d3e99feab723ae34c69775bb2d3ba22074c1a4a41162c2b36febd3a11da
SSDEEP 192:sxZfRsW5/f+sUJ54CIdpdXHW6+WNGYgd9/NIg5SJ:sxZf55/f+s84rdHbGHw
TLSH
T18322C8156E38AA7B8CC7E20DBB55BF53D6F95032A1901E48A6FCD61C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 506996cba6f3f374327576a4566371944c582b74a0181c7f664167c674900bfc
MD5 6d67086abd2a46db522c86719d211956
SHA1 901f3a99a896a5b847531188013bf8ac81d6bead
SHA512 08188028443754f1a30a8b513491df30425bdd1a6076574abb4ef9ecfee9de544802dfb0ea1e7bf0c440be4cf8bc36166f284fc9a934639fbecac6eefd9bf465
TLSH
T16BE026C808C8C22FA36C664B217C970C83A0361BDBC0EA4E3704C5C4744AB81F3C2690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3a982eb1b92bbe396895631f05f0e9dcbce736ba33ae360a6ce847376c5d593b
MD5 c552b0148dbd588a1656b03bb31edd45
SHA1 19fae40c3eb28f845cbbe5b039eb952c23700003
SHA512 3a17a5535922e7eedf082385297107dd5b6f6c2aaf4b27e1d01e3378d2ebcc97110582daa529afa0f4be122e666ae7a851a4e3852c9bd79a141c79056e17b8c2
TLSH
T1EE61C6819488B397EFB4C3B8D0FA1D8B363C84B4B4834E2312F4E5B9570AF10912B9D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f5e498b8af8a42cac178ef149970bfd1241ed623dc75e838e2ad4000a2920bb2
MD5 ce69d23184aaa03efb4f9bab9f3dda53
SHA1 12e5c987511b9fba94c6576b794cb5f4ba610f0b
SHA512 8165356b306cb39e882d5ad152975cac6ff8a8d35dd85788e65f62e99baf647feef32a89e0b5e7fa6d50fa88fc056490622096bccd6237f223f61382543db369
TLSH
T16361B5419588B397EFB4C3B8D0FA1D8B363C84B4B4835E2312F8E5B9570AF10952B9D4
MD5 SHA1 SHA512 TLSH

Submit Download

9fcee149-9176-439c-b69b-398e59a312d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9fcee149-9176-439c-b69b-398e59a312d4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

66fc9d9f-a2e8-4bf0-be4d-722619dbf175.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\66fc9d9f-a2e8-4bf0-be4d-722619dbf175.tmp
Size 949B
SHA256 c597876f4d73cabc4d89f6ceadec1ee6700011870a488f39093fab82dc45a200
MD5 a47e5e4d323048f1e4fadda326e9b123
SHA1 f88db6d034dec14972e6b35e623edf8c756e855d
SHA512 a1e6d0b1f75039dc578f1553d34cf4513ee0e09e9bfebeca26fced298fb754b91b395f47e3a416d236bd75ad3b18796f9f5d4f6249455ac2c7262def3018f6d5
TLSH
T1B111BAB3C3D596AE890516F06A24EE2BCE2C0606431C7C19C9D4EF2B93E3075E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

671f923f-0fec-4642-9092-8342863a3f40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\671f923f-0fec-4642-9092-8342863a3f40.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b2719039-37ca-49c4-bad5-6a7e35295eb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2719039-37ca-49c4-bad5-6a7e35295eb5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d15092a750d852b42ee392734a22bac552943d2eaa7c3587a7a20dae843e546a
MD5 0cea93a7775a9aa63b26a86054d12f13
SHA1 721d3daf35fdaaebfa96d605875af918aac84b83
SHA512 4e192b9bf1babff4605fc358f8e55999f608bc185799cb205ad16600ec0a747c6057906188b60b2903a594570be8ab2369bb9190bb8e0e0f2ac9b6c0137c6f1e
SSDEEP 192:sxZfRsW5/f+s0J54CIdpdXHW6+WNGYgd9/NIgrJ:sxZf55/f+sc4rdHbGH9
TLSH
T1FA22C9156E38AA7B8CC7E20DBB55BF53D6F95032A1901E48A6FCD61C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7b39c0c836bcb7a6045b405b0a476d89bd66588506298b39fc99890363cc37ed
MD5 4b490b897663360efd71d67ba63b973c
SHA1 8dc34e2b53b42005b5f8602318f68feeb1d12ae7
SHA512 0aa62af8e83dd9d5f21d429e7dc5a56d830f2bd8c9cd50ba785e3d0a0305f7765941c230c8fa1dbac7e5813a3d8b86a0d9b8901b481f74de9c783218898f63d5
SSDEEP 192:sxZfRsW5/f+sUJ54CIdpdXHW6+WNGYgJX/NIg54J:sxZf55/f+sg4rdHbGZK
TLSH
T1F722C8156E686A7B8CC7E20DBB55BF53E6F95032A1901E48A6FCC61C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3fe64ffda466619b98ad6d5fc764d534a5deae498c681ebeb9e6d6636543431f
MD5 284f0b3d05d4145de12ae7ea6060374e
SHA1 a80b3ecd1f9448ff876d666dc2c493130f1eb67b
SHA512 182a76b67bb403f127701c489e4998fcb822be1c0e5de7ff94e356a1f4961f72eee056646900a52a677a1f7a425381d010588d8f6a48002e1a1e372cab9e028a
SSDEEP 96:KnH4pNf95bgpiq+VbKWi+LbCHP6RZouLeKwUfLuKI0aeDSKsUB:S35dlZA
TLSH
T1C0B1250171BB120138BD359891B69B2E5241B1733056F92BFFBC90A68E6FE581CFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd1410cf-dc26-4ee1-abe9-968b129d0098.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd1410cf-dc26-4ee1-abe9-968b129d0098.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ab804cb3-2515-4401-93ef-64daa085932d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ab804cb3-2515-4401-93ef-64daa085932d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfa30728-3311-4d69-8954-55f64cfc4a55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bfa30728-3311-4d69-8954-55f64cfc4a55.tmp
Size 18KB
SHA256 a4f75118ba71b77f27fe8dae3aa497d578c8563442afce410fb4b0e2700d435f
MD5 d61bfde5b94d418d808ae71e43d2fd5c
SHA1 21c64e4bd1fe45e5c89b9f38781b29858d7c9e02
SHA512 5fdd9a2a79edd3598ade078bb2c12fd8e0232e619ebecd6455a9f767eaf1964dfdf96054d6bb0596bf9009fa628e7983eb4f123ac11ce0bae305d0656c65edb6
SSDEEP 384:CZcIhsNdUu75KOEToNBGYX5EN3862XOzXi4/uANEbEeUm:whC9vGYuNL2OzXLJCbETm
TLSH
T1CB827D72E8B49C3B1DE7A546F84A35135FB8903BE7847F90D5ED9B1D01DA1E8130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebbf86bc-c4d7-4b91-a457-d41d3e63ac5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ebbf86bc-c4d7-4b91-a457-d41d3e63ac5d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a93f79252b5f8b3e6869a7d808e6dfded1d63d8a85d0df97999967ddadd87457
MD5 2508e50e239241130ff73e81778cad04
SHA1 23becbcc35be4bfaf69737a6ff3e917f0bc57435
SHA512 1d563b6eee838f5a52baf915f6f78894de59b8540d9f77a986c9b711ea1c2ae148a6d288e80e20d519988a599746f698fed88055b3b06d7c298adee6195bf5fe
TLSH
T10841F65CA6E91148B7B76F1A9BFB686D447ABD372F0BD45E10110E4E0A27B40C862737
MD5 SHA1 SHA512 TLSH

Submit Download