ede54b0d46f7e4d7953d247960fb676605ce48e6ddd41258bcc0600448a58166

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CatfishCMS-6.7.3/application/admin/view/index/comments.html
Size 4KB
Sample261012-rxgrbasx3r
SHA256 ede54b0d46f7e4d7953d247960fb676605ce48e6ddd41258bcc0600448a58166
MD5 59cb48b0ea5212f255a4d81d2e9566c7
SHA1 13a6853d56c0c7a5d9d4a7c4667e31f66c71bbc8
SHA512 a17b1f79e4075bbbab3adc6be59efd15cfba80ab6984bee7436711cf703481d4059d487889e7c24d28f4f2cc67ba05ff98e32a0040aba37d350684790e81af46
SSDEEP 48:HgqJUnQR56cboRpiJi+OLgZkRuWmzW3bN:HgqJUnQL6GoRui+OLwkRAGN
TLSH
T1FD91CD6285ECED3AA1B3C2D3A3409755EDC3818A8367521477AF13875FBAD22D933219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{03F4D210-DD5E-4396-BEC3-F76C70F321B7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
236	msedge.exe
236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 3252	4232	msedge.exe	89
PID 4232 wrote to memory of 4444	4232	msedge.exe	91
PID 4232 wrote to memory of 2056	4232	msedge.exe	92
PID 4232 wrote to memory of 2056	4232	msedge.exe	92
PID 4232 wrote to memory of 2056	4232	msedge.exe	92
PID 4232 wrote to memory of 4172	4232	msedge.exe	93
PID 4232 wrote to memory of 4172	4232	msedge.exe	93
PID 4232 wrote to memory of 5352	4232	msedge.exe	94
PID 4232 wrote to memory of 5352	4232	msedge.exe	94
PID 4232 wrote to memory of 5352	4232	msedge.exe	94
PID 4232 wrote to memory of 2628	4232	msedge.exe	95
PID 4232 wrote to memory of 2628	4232	msedge.exe	95
PID 4232 wrote to memory of 2628	4232	msedge.exe	95
PID 4232 wrote to memory of 3056	4232	msedge.exe	96
PID 4232 wrote to memory of 3056	4232	msedge.exe	96
PID 4232 wrote to memory of 3056	4232	msedge.exe	96
PID 4232 wrote to memory of 2840	4232	msedge.exe	97
PID 4232 wrote to memory of 2840	4232	msedge.exe	97
PID 4232 wrote to memory of 2840	4232	msedge.exe	97
PID 4232 wrote to memory of 3724	4232	msedge.exe	99
PID 4232 wrote to memory of 3724	4232	msedge.exe	99
PID 4232 wrote to memory of 1524	4232	msedge.exe	100
PID 4232 wrote to memory of 1524	4232	msedge.exe	100
PID 4232 wrote to memory of 6016	4232	msedge.exe	102
PID 4232 wrote to memory of 1632	4232	msedge.exe	106
PID 4232 wrote to memory of 3592	4232	msedge.exe	107
PID 4232 wrote to memory of 1304	4232	msedge.exe	108
PID 4232 wrote to memory of 5864	4232	msedge.exe	109
PID 4232 wrote to memory of 5864	4232	msedge.exe	109
PID 4232 wrote to memory of 236	4232	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CatfishCMS-6.7.3\application\admin\view\index\comments.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe7a2ac188,0x7ffe7a2ac194,0x7ffe7a2ac1a0
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12067653837797635806,1555444209751177773,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,7583588012725069451,16656289614517981761,262144 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,2339618468267413928,804355417786356170,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16245052638946375898,10005752513289009283,2097152 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,8280790727637320484,18317926304771846067,2097152 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,10077492684523529417,17163035708911924632,2097152 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,5147347572978733605,301975784976281583,2097152 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7958897342683790470,1214456272666925497,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13230324173214948839,2911382273348999159,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,7992255770929803157,7235443606956707374,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,7992255770929803157,7235443606956707374,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,6675472747168541018,8974664854176567801,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,5772640275190409127,4994004070813065333,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12402921903001358083,907245991347704058,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,11777772841480463602,14853191794457083399,524288 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,4974563124356402006,1774389277704495648,262144 --field-trial-handle=2816,i,13488810410607087179,9237252335283203542,262144 --variations-seed-version --mojo-platform-channel-handle=808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4956f289-7b89-48b2-b664-d0f82e428f05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4956f289-7b89-48b2-b664-d0f82e428f05.tmp
Size 36KB
SHA256 ee1f92d4a12ec0c48ead7f3ff1c7312a66d42434d6d71a4cb2cc07a47942bad0
MD5 957f1bbe2a84f706d8500dc7ca4b7570
SHA1 af577dbb69b9b5a11de1f01454f6d3cd1d882807
SHA512 886932ebcebb350a67ff38e4265b0810164b2cb6fce048ea6041e49cfaa02b6622a2270a5d84c7837136e62ab45bca163b3edddfe51bf870d660ce20251100ff
SSDEEP 768:6FQp3SwgjUWybNb6Ojzt/OeRFZD1fTos7RjPGJCbETf:hp3+tbY1fT/RrICb8
TLSH
T198F2AD33FCD08D379CFAE685F64A3506AFF441B3D999659492CC9E0E009BAED030B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d3b1218-4fe9-4ded-b2bd-18a8ca7d9479.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d3b1218-4fe9-4ded-b2bd-18a8ca7d9479.tmp
Size 33KB
SHA256 ce7ff9dc8e952ec1bc54b5cfc2dfc5386afba2c885591031a68375ee328d203f
MD5 0b4013e7ae8dcefe2666e6ae7bfe8480
SHA1 021e31beff5d34b6e4873ab66cb5b8fa742b8ea9
SHA512 a8a11c3981a52629ac38a6f01b5eff733c6e89c36a18c819273b7d2480aa4e7c63fc8fc9af6eb3aee45f2efcbc47effd5074e365e7e44f81d9c20c6fadfbafb2
SSDEEP 768:XC37UWybNb6OjztEOeRFZD1fTos7RjPGJCbETf:XC37t0Y1fT/RrICb8
TLSH
T12CF2AE36F8E09D734CF6E285A14A75467FF89173D6C8298454DCAF1E049BAAD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c7d3d66-be66-4d6d-bb0b-e93162678eb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6c7d3d66-be66-4d6d-bb0b-e93162678eb4.tmp
Size 38KB
SHA256 a9ad99cdd0884d169a45e89c0115757344418538819fb2456de3f8083b12c2e9
MD5 eff58a5444981699c0e06150a3748a7b
SHA1 be3ba5ba95c69eeb6c6e34ef1c1dbcfbc60e684f
SHA512 e3ff02d8e4a73b941d4fcb91190c96e0ecba0cf2004a9248a9dd95244cb5d24e80aac25c2e8cf644730447a71a36b7e1c69d7ac22e2b8feec895c1510fbb01c4
SSDEEP 768:l/UxvxjgC+k3z30ybNb6OjztFOeRFZD1fTos7RCP/+Pu:IZj3+k3zklY1fT/RIKu
TLSH
T1A203BF3AF8D45C338CF6E244B24A764BBFF055B395C9199409DD6E0E058BBED130785A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74043a16-f144-4d9c-8861-4a435ebdaab0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74043a16-f144-4d9c-8861-4a435ebdaab0.tmp
Size 40KB
SHA256 528fb15b58b9b6824343066b1555e99df6a20a80e2e2c47c53360c2e348e48e1
MD5 00c0f1e62ddc2c05f680f9ddd1055bd3
SHA1 a6197250a767aff004270d8bf0c4b4dc1090797c
SHA512 82fbbb344866739290ac7f8ce33869ac16764d4ea2da9a9602ba8de462e82f6e5e8f876eb58caaa77dcb568a42be2bc38e45024bba4a288dfa2f279b86a7af78
SSDEEP 768:b/UxvxjgC+P3iIWybNb6OjztEOeRFZD1fTos7RjPGJCbETOU:OZj3+P3iJ0Y1fT/RrICbzU
TLSH
T13903BF3AF8E45C234CF6E285B24A7687BFB445B395C9299845DC6F0E09CBBAD1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

0de06b0b-e7c8-481a-a8d2-fc750d465765.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0de06b0b-e7c8-481a-a8d2-fc750d465765.tmp
Size 11KB
SHA256 c46a47f20d3744968d449c66ca222ae5161a082f957f90169f2bfa1a3e2ecaf8
MD5 8f7194f046947c05ecf2f7b2255d1233
SHA1 12e68db798724feede0a0a5ed16e8c4845f646fc
SHA512 1376bcee369d0048868f8c3db16660a09232fda34c945a79d343db3486fb672da5bbcdc61227a991f62756c11964dcb1bd8bc5048d738719354e87df746cf3ae
SSDEEP 192:sxRVaRWbAw/fyUszK7xXrLzoA8p47/g6+WNIYDo7TGLIgDWJ:sxR0un/fvsz6QS/5Iye
TLSH
T1E432A715AD68A93B8CCBE21DBB55BF53D6F95032A0941E48B6FC8A1C05EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bf4fdba-83ab-4799-a779-c66413abcf54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bf4fdba-83ab-4799-a779-c66413abcf54.tmp
Size 23KB
SHA256 8f0aa1712c3ae7ab196d1d456a6b0d8d3c3a96d4b719145d609ba74535c6cb1d
MD5 8e52b75a2609c81ab2615738f05e2517
SHA1 c01d52e2ece77afd15d9924a77a897d08c49ce6f
SHA512 1a3f168192fcba69506dd4af8c18d1ba853e6ffbb95fce4f2949a1ea9b009bccb8aeb519e06773daaa2abb21f5b38406a35441466a195ecc67a73f09fe83ec19
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9wroTyD:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0VD
TLSH
T128B2DA2B600CC77E4F804AADEC1A6F977D5802C796988D4047FE995C03C77EBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35b82530-d197-4ded-a8ba-c18e6d1b644d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35b82530-d197-4ded-a8ba-c18e6d1b644d.tmp
Size 11KB
SHA256 df840a7c0977f84d287242306542e0c9c1ded9d6819872441346a7ec64e1ac34
MD5 0d2db5aea75d96049dea868110c9d1e2
SHA1 40b0e39e4e5f7108231477864f6400eb4dcc98ff
SHA512 c1f73d4dcca955011c007526ebaae9fc4958111104575c0b09dc1a7ae7a4750e27346c00879947c73af61265faeab6a04b204282150ee2540c4fe7b9937a7919
SSDEEP 192:sxRVaRWbAw/fyUs/K7xXrLzoA8p47/g6+WNIYDBlTGLIgDsJ:sxR0un/fvs/6QS/5IXc
TLSH
T1E132B815AD68693B8CCBE21DBB65BF53D2F95032A0941E48B6FC8B1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54465259-2653-4946-930f-f8135492620b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54465259-2653-4946-930f-f8135492620b.tmp
Size 11KB
SHA256 4c2fe85a90302ce5db1ef23996293ee0dde92bb32dcc215e784d7ffec19c5561
MD5 db92bb9235fdd7cb16b03f96d933f1c4
SHA1 0f3bd5fe267aa4a560e7af00753ba298f7d2e1dd
SHA512 b000073ebde7ad5b2ecc7fcde454f6ba435200f222ef54a7d6b34740e4a41e114b32b6bd6b322c063c8ce2f8de3839fceaba2d74ecc45f2fa01cb92ebb3dab0d
SSDEEP 192:sxRAaRWbAw/fyUsVK7xXrLzoA8p47/g6+WNIYDo7TGLIgIJ:sxRLun/fvsV6QS/5Iys
TLSH
T147329715AD68A93B8CCBE21DBB65BF53D6F95032A0941E58F6FC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 65dd14d4161fcdad4fa1c8648319caca066a8ad5950b2cd6a4150bf4331d93ef
MD5 19298cfd3727a7646fa37148d0783275
SHA1 12c0181127dac59890947e9792c50e1be3cb10fc
SHA512 5f5e6e3bd2d4d2892e94271cfeab6528b30e7b8ffe3e6abf4a53145485908c38c5088e009cca1e53cc78009cb595e074605e2772499e98db1485534116feb52f
TLSH
T17051A589877B8070D7AB45B5C0D933873638CDB2B5930E4A16B6C479474EB239275C1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5f9792fc4ba6bf9cdf3a52943c7ac92d2327818c78785b969599092eebaed362
MD5 f183ac66850227d234c66079f61266eb
SHA1 d9638910870b7a255958a7b03d191022331de71c
SHA512 a9d4291c03154ece783f5f2ab6bcf58c81aabcf0480a94b394a4ae8b6976b4a7b129d8042754111a4d80e6529f0aa544fcf805e8b71ee38993eab9926c708c1c
TLSH
T1B451A549877B8070D7AB45B5C0D9338B3638CDB2B5930E4A16B6C479474EB239275C1D
MD5 SHA1 SHA512 TLSH

Submit Download

cc0546e5-8bce-495b-8590-b84c3a90e52e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cc0546e5-8bce-495b-8590-b84c3a90e52e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

19c04721-b21c-4766-9a4c-0fe4602a9bca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\19c04721-b21c-4766-9a4c-0fe4602a9bca.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7830942b-fc0d-4be3-b0d5-db4f64d80c2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7830942b-fc0d-4be3-b0d5-db4f64d80c2d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fba5f897-d706-4761-9b12-22a76f76d1c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fba5f897-d706-4761-9b12-22a76f76d1c8.tmp
Size 1KB
SHA256 9955869fdd5d2f34f04314302eab892a5a2f14b1ca02ffaf64f68327e5f4f04d
MD5 a95a64851ddcefb9a0a53b9ddc50315a
SHA1 8677816448ea791a3226ade184346719c39451f1
SHA512 f96a0573f92ddc7d1746c3df76689dad3e9b22a14a475998dfab84e2a19ebfc027da991b11ac497eb42784fef7cafa88258c35ee2792208b5f7d8533ca491adc
TLSH
T1BD31CEF783B4857E8A1186F0EA04AE1FCE2C0525432C786985E0AE2793F3472E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bdf0f563-bdb5-4b0f-9b95-986d0110c24f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdf0f563-bdb5-4b0f-9b95-986d0110c24f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2b6d285e8eef583ea90427ce23121f79379a0b42af2364233db411a8e9511b29
MD5 8732b7d7a97f558904db192394d95498
SHA1 a04be4f68e957103c1843eb69a8f31834e1d1799
SHA512 86bc7d6072a410c3bddc19462cf786bfee6909f515f467a7d8c731b3eef3db7a52932bb7c629b583a9ec942305dc71a450c900ca6fe5b908a12b5dd13fcc1e2c
SSDEEP 768:6C3oUWybNb6OjztEOeRFZD1fTos7RjPGJCbETf:6C3ot0Y1fT/RrICb8
TLSH
T1BBF2AE36F8E09D734CF6E285B14A75467FF89173D6C8298455DCAF0E049BBAD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 755589040be86bef0d28d50ff066f1ad105388d6270b6207d950ef028b4eeb2b
MD5 b9f05a79c155da394b6175406964a7ad
SHA1 f41b66501e9ecfd92dd8498e722e299429d944ed
SHA512 68597e40b6206647f14522ec5531db24df82963fb357cb40b38e6e508604ac303e3a5abad2c598f4177365d8728941297356227bfd1e848300445f139702a1b5
SSDEEP 768:z/UxvxjgC+k395uybNb6rOeRFZD1fTos7Rzg/+Pu:GZj3+k39wSY1fT/REKu
TLSH
T1BF03CF3AF8D86D338CF6E244724A764BBFF015B396C91A9809DC6F0E158B7AD1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff77081e-64f8-476b-a82f-8d6f3613feb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ff77081e-64f8-476b-a82f-8d6f3613feb3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download