491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample261104-wt2pjayw5q
SHA256 491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2
MD5 5ee8d4ed40e9db9f5f74dd6ae092f07f
SHA1 9c455e63e9f2dcb1444189eb1eea914d6b700222
SHA512 afc7716726ecb6a36d36139918c4bfed68e40b74629302a86116c8ba54d34f7423edf90206f04a4e072d6ef448b7581be76f7d7a342830f6a89a25812eee3af3
SSDEEP 96:CWUK8pz1E/4kF5kyJ0ifN8uueKQMdcwFdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:98/SVPmuN3C/Da7d0JuCidI
TLSH
T191E1966BB5405376131143B16006217A733300BEB79D464654DBE62EBBA23B4AF7F4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{4EB07FFD-3EA7-427B-B9F6-62912C253584}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4504	2476	msedge.exe	87
PID 2476 wrote to memory of 5112	2476	msedge.exe	88
PID 2476 wrote to memory of 1696	2476	msedge.exe	89
PID 2476 wrote to memory of 5112	2476	msedge.exe	88
PID 2476 wrote to memory of 5112	2476	msedge.exe	88
PID 2476 wrote to memory of 2356	2476	msedge.exe	91
PID 2476 wrote to memory of 4636	2476	msedge.exe	92
PID 2476 wrote to memory of 2356	2476	msedge.exe	91
PID 2476 wrote to memory of 4636	2476	msedge.exe	92
PID 2476 wrote to memory of 4636	2476	msedge.exe	92
PID 2476 wrote to memory of 436	2476	msedge.exe	93
PID 2476 wrote to memory of 436	2476	msedge.exe	93
PID 2476 wrote to memory of 436	2476	msedge.exe	93
PID 2476 wrote to memory of 3820	2476	msedge.exe	94
PID 2476 wrote to memory of 3820	2476	msedge.exe	94
PID 2476 wrote to memory of 3820	2476	msedge.exe	94
PID 2476 wrote to memory of 116	2476	msedge.exe	95
PID 2476 wrote to memory of 116	2476	msedge.exe	95
PID 2476 wrote to memory of 116	2476	msedge.exe	95
PID 2476 wrote to memory of 1136	2476	msedge.exe	101
PID 2476 wrote to memory of 2520	2476	msedge.exe	102
PID 2476 wrote to memory of 1136	2476	msedge.exe	101
PID 2476 wrote to memory of 2520	2476	msedge.exe	102
PID 2476 wrote to memory of 2120	2476	msedge.exe	104
PID 2476 wrote to memory of 3736	2476	msedge.exe	110
PID 2476 wrote to memory of 4020	2476	msedge.exe	111
PID 2476 wrote to memory of 3488	2476	msedge.exe	112
PID 2476 wrote to memory of 3144	2476	msedge.exe	113
PID 2476 wrote to memory of 3144	2476	msedge.exe	113
PID 2476 wrote to memory of 5076	2476	msedge.exe	114
PID 2476 wrote to memory of 5076	2476	msedge.exe	114
PID 2476 wrote to memory of 5044	2476	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x210,0x7ffb40a1c188,0x7ffb40a1c194,0x7ffb40a1c1a0
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,899482786872728341,10025086050160258112,262144 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,12408015434655728243,6792472169086516995,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,597437321384935769,8687500261038040054,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3236,i,1287490828687524028,3848276162520185797,2097152 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3244,i,3693313016573221576,10701631224976105978,2097152 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,634118226584128947,2033894337846452337,2097152 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,8698301535786566874,10622584970284611906,2097152 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,3743627447029108259,18395323677695953658,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,15266537967839208401,4750193625432161420,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17316881930097043817,14430930967544155392,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17316881930097043817,14430930967544155392,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,13225253790025909309,2905452231779781847,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11499763634187576558,14306172513334266821,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,1164721582424732427,5455507753508262059,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,2734192093831686619,8544684128966322472,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,2800371803494457491,6944537701683697294,524288 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5332,i,6552411296852573851,6185744639002459904,262144 --field-trial-handle=2172,i,6957459838277666532,9622746306533908181,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1d57d37f-66dd-4033-9280-c50ba662d637.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d57d37f-66dd-4033-9280-c50ba662d637.tmp
Size 18KB
SHA256 62d7a4d7947ff891f469f2e95d83edc64e2c56525b484c8920f5c2f2d71e281b
MD5 b56710ffc61399983c5c0e3e8616b668
SHA1 40dd2dde5a49161e1ac155c3946e1200e37aca1c
SHA512 20c66053b570fb4427e294c972123495175b2845b5585f2c02021f0a93812045ef57541653d437f5d5d1d0a27f84220e360cb57a987076a3fa17210d4ff5fc99
SSDEEP 384:oQkUSv0sN6ttmGD1mLNzIGmhScxaGBi1iH7vBEcfwIIlk:g0vwx69Bi1iH75ExLq
TLSH
T17D827D72ACB87C3B5EB3E550E04A3E239DB49117D6D81B90E5DD9B1C01DF29C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73f36379-9263-43b2-8c7e-e14e48c3392f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73f36379-9263-43b2-8c7e-e14e48c3392f.tmp
Size 21KB
SHA256 68e596a17ed356eade2cb53a7579b1c769d037dd491cabf2f3c71e091122c378
MD5 fbcaee5e50253d5cdd306f5fbff05564
SHA1 6319544fe3d68538826465d65c26294ab85f72ca
SHA512 2de27a2f2ff062158c781c0f2f1e1a1d1b1f51d1bfe944b34b9a07e7a27bc5b25b8a2bdf3590b158616854516e69ba9dd95baacf65af2260807042e12828f2c6
SSDEEP 384:9iFzQkUSvJzsNC8TUNTUlIlEtmGD1mLNzIGmhScxaG1si1iH7vBEcfwIIlk:0Fdp/wgAwx691si1iH75ExLq
TLSH
T168A27D739CA8AC3BAEB39F44F54A3A13DDB08167C5D56B90E6CD9A1C00DB29C134BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ba9db88-b9ae-4c1f-ba22-59480efe606d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ba9db88-b9ae-4c1f-ba22-59480efe606d.tmp
Size 8KB
SHA256 37c83c4fa775ea6458ca0dfe3f446dfedbaa033f1f2775d936a9634895b790fe
MD5 003c5fb3de1ce828ecc4013b729813a5
SHA1 9869140376a464e1719f5e2776ace34781708ec4
SHA512 0f8e56cc4b55a677a8d448a7823a97207ae60d024fc785ca01401f382275391e20c81ea50ff76f1bfd50b9e58eb63a13a312acce5b85808caf234ea1d17156d8
SSDEEP 96:3qONk4Qsjpfe/tyng7X5ih/cIPURHl8h4otop5DYDkWNBnP9ZvEI0IG2jb00eL0y:aON86IE7QmiUyKTTPuIGmheLNC7szjU6
TLSH
T18C02F935AC787C7B9EF3AD48F4873B23AEA5112BE5952F84D9E81A1D00DB24C1307967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cde7d0c-cab0-4b21-b073-15db03555ba9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9cde7d0c-cab0-4b21-b073-15db03555ba9.tmp
Size 8KB
SHA256 7934e178b7e0f65b9123c2e5948b7671be81bf5ddb5644c7c17139fbac8d6fcf
MD5 8b6c46dd493b4a8e50e681dfa040acaa
SHA1 ea263fcf8195799b838e4f94e9e0d104a906244b
SHA512 da6268adb2e9e7d03227971ee3c67fe0fd0269550674c21ccf93e42f9329e4d1bb95c11276361d9728f6210fbaeaba5205b9f21fa75ff266687e743632c3ea7d
SSDEEP 192:PONb6IExQmiUygTTPuIGmheLcxaFkR27H1gqEU6:PONb6DPvPuIGmhScxaGeH1iU6
TLSH
T19912F976AC78BC775EA3A984F4833A23ADA54227E6896F90D5DC1A1C01EF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecdbf099-4182-477e-a902-2ba157f81dde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ecdbf099-4182-477e-a902-2ba157f81dde.tmp
Size 105KB
SHA256 dcc5e5a44077d428b0e344ee45b3099e7eff2ebbdd8273ef1ec772721b41a5af
MD5 2b868614fa0b813f62a2463cf5176c67
SHA1 81b9a2da4d126d229190379b81cd945cd7b5b900
SHA512 34e1f30cbfede4f1f7f1c635e707b7391a5a20f0cfa6a316714dca4d73ebf5b8fc4dbe0bb321a92d46b6cfe02713df76143a1642643c1fe3dcf2ca3319f0ecb5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T16FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

0ab22f2f-d8b1-4b20-8e7b-bce5e590130c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ab22f2f-d8b1-4b20-8e7b-bce5e590130c.tmp
Size 9KB
SHA256 12f6a465fe6a01147ad64dac23101c382df049eb8c45dc4b2384da834c63335b
MD5 4e27910706c9fa8ce1921e0335c2da60
SHA1 5a8448c14ae39138ce2a331807787c8bdb74bc0a
SHA512 a8ff5741b56226ab67703670479962cefd8ec61fe19807b71978d13387d2635560d9e48d8db0e6e411e85d0cceec29ffee06b0e5ac0af6205b8791b1f27f43f7
SSDEEP 192:sxZOmRfWKY/fq6sSV1nPIdpdfHW6+WNGYaplb7GIg5VJ:sxZDwP/ffsSV2FHbGap
TLSH
T1D822B5126E68A97B8CC7D21DBB65BF53E6F9103291D01E48E6FC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19d1db23-ede0-4028-bd76-a63646e8dc8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19d1db23-ede0-4028-bd76-a63646e8dc8b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

27e36d8d-493c-4a7b-a1cb-db757d25c408.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27e36d8d-493c-4a7b-a1cb-db757d25c408.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

526acfb3-e7db-4a1f-9fa2-e365f7b54a4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\526acfb3-e7db-4a1f-9fa2-e365f7b54a4a.tmp
Size 10KB
SHA256 60fd27a313585c2198befb6a3ed6ba4e02c3da510e6718ba7906ded434e534c7
MD5 4bcc0d9397d752037734839dba54e09f
SHA1 a29c494c05b10589512982daeaf6b548b7bef2a7
SHA512 9dc9a36dad1da0f3f523195b68738ff9b3d24c1fabddee92acd993407a8d24f96d6d84ae17796ba99a204cdefc5fb1a18b495f1d1d23e8ec0ac7ce77fed9144e
SSDEEP 192:sxZOmRfWKY/fq6sS81nPIdpdfHW6+WNGYapPl7GIg5/J:sxZDwP/ffsS82FHbGa/
TLSH
T14322C5126E28697B9CC7E20DBB65BF13E6F9503291D11E48A6FC861C05E7ADD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bcca2b1-1d21-424f-a6e0-22a481668012.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8bcca2b1-1d21-424f-a6e0-22a481668012.tmp
Size 10KB
SHA256 e9c46146a087341cb831bf17a13e3fac3ab34119a7ba97f5ea02e78c2e6ae4ba
MD5 7e9b8ba642ba1280efd0e1c83041b796
SHA1 dd42132ae99099b6893cc95ea25b6e2cb0821161
SHA512 b8f206847c3ecd78eb4b33df80364dd00c4035cce361bed67d8ae859a92f0b89750c6c6983ce84bffcc4dbf516ba71c1a2377d7f5b6973fe07adf10950ba4033
SSDEEP 192:sxZOmRfWKY/fq6sS81nPIdpHfHW6+WNGYap/27GIg5/J:sxZDwP/ffsS82/HbG//
TLSH
T10E22C5126E28697B9CC7E21DFB65BF13E6F9503291D01E48A6FC861C05E7ADD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f6afc730c77f12f7c3d1a849cefccfc19aa68a05f3912ad286a9fb18056e465f
MD5 6e57535d6974c4c51de04f584a830dc8
SHA1 882e6520894ad454edede77037f223940378d809
SHA512 d793b3b178a5f48ca4cae501f859a266a54a765416546871887dbdc2ee4f967d1f623aef447d58cd1177c0e4147ba3aa0981ccf453bb303eac203599481b85c5
TLSH
T15BE07DC858CBCA3EAA99744B01F8574C93E07A5BD3C0790E1F00C5887483094F7CE6E0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 81d352e0aefcf93b237bb7fdaf17eeb3a3dede833bec6ccf8576b152f84b1f0a
MD5 7e4ab50db3d0394eacf936ca1465914c
SHA1 ad82dcd3be26f37fcce2d3f0d08683ce38962f72
SHA512 849afce5b7c67c8f1871def97646d3191a8de5a776bf3dc9c670d03157d229e4c2f2f5baa47abaa3a6194e6304eda242544925eb04c95e9f1027421de16b6e97
TLSH
T17661B59D81A0469DF7D8613092ECD0EB3AFE8D62B5B34F9122E6D7B55C06F54B81C48C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7414ffffba461c7f7995504efc592d57cd560478be86e78d0fcaaa99c8b4fd85
MD5 808b169d2a60b5c814298b2e533eb0d2
SHA1 29739737c6b2322cd518a957bac87d628de4239b
SHA512 7ce8a8496930642e4f9c09d81465158db43b9d2d852115a28b1478dabbae9e7967be4279be0b4c4c98819a72a4567b8010398dde277dad6d16403b95177cc644
TLSH
T18461B68D81A0469DF7D8613092ECD0EB3AFE8D62B5B34F9222E6D7B51C06F54B81C48C
MD5 SHA1 SHA512 TLSH

Submit Download

692d6959-652b-493c-8147-0271c82aac53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\692d6959-652b-493c-8147-0271c82aac53.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

724ea617-3c77-40a0-8623-089a83146e9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\724ea617-3c77-40a0-8623-089a83146e9b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

73a4a4e2-cbae-4d8b-82b2-146f7b7ee1b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\73a4a4e2-cbae-4d8b-82b2-146f7b7ee1b5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a52d40fe-008b-4b7d-95d7-463aa7ae269f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a52d40fe-008b-4b7d-95d7-463aa7ae269f.tmp
Size 949B
SHA256 9d5b8fb8b34a68e9e3bab5e4882ceec5ab0aa13f3e2dc923cb9ac43b6cce080f
MD5 26ede27eb9a2cad299a26be6c90964b5
SHA1 e92caa8cee2d91b64fbc0a87cf211b9f70d04fc9
SHA512 d399404822bbcb49ed2cf92d780dce719016dbf19640d235cb3f9a5657f6a7a10476c9e21ef72a68897c11bfda0ee2cad2fead000b002e5c6b31b3f38dfef788
TLSH
T15F117DF3C7D585AEC90156F05A24EE1BCE1D0906821C7C1985D4EF6BD3E3075D00255B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0ce9ca9fa6ca46f5f26bea83f000b6e5202450363667334cb11125dc5dc32fb6
MD5 bd7e08ffc695f650b89887dae88eb9d9
SHA1 d493e453618aadd5bbe30442d95b1de152d4490a
SHA512 08ebb6866b90695032eec13ebc3f6cf651c30534909b62ac74bc1f7d2994c5e8a464ffc262d6d56de510d2ed13fa0afca6776466765fd670a70432193e4e5517
SSDEEP 48:K0XaDX5ZpCbBsxISnCK9n1NCxHSYE1XryL4neioS23bu1uIS63K9W1M3xAnY9eeb:KcMAK1qG2PuKUkvQAKxieaz
TLSH
T19D917200B06B16503ABD685843F49B6A025235F2351DE53B7FBDC8A26E6AF650DFD8CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a65b2eb3-faaa-4d41-b1cd-23ae74534c13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a65b2eb3-faaa-4d41-b1cd-23ae74534c13.tmp
Size 27KB
SHA256 16c8cd4616d04ce082d0178711cbe658117ebbb72903d063f5e9c99f2c10886a
MD5 854be8ab9e7b1707128d162acfd87703
SHA1 cec38e9ae5fa58d94eacb8e975d5b5e504dee1ed
SHA512 6dd173b376ab689eb9580b20ca332461a919ad965d60b00199399189f77b22960f83997ed1af15df82c37cccd17d0cb0bed2842c96c721db8d1b6959c3e67c82
SSDEEP 768:nNWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7uro4Ufe0mR8:nNWPcLKWvKeEeu1jaClLiF7l4UW0mR8
TLSH
T10DC2EA2B680CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE944C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b254debe-7cc3-4ccf-9f07-dcb959e128b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b254debe-7cc3-4ccf-9f07-dcb959e128b3.tmp
Size 9KB
SHA256 5743a12d7352ea06eda95e7f6a9f30a7fd8fe7a6302dfd5005903a3afcddaa44
MD5 a7e08f7f660df9cd9bba22a9693dbd2e
SHA1 9548cccd89c45ad933d2cf8b7ba7dcba43e0b09c
SHA512 3461e7131f9178d30f63cb91d697c3bfa0b2b5f8abf92e003950ec0e5c56ea8f0eaf4e0f255bf4aab7ca7a288a5ad8a946cc9d432ec82cad5a4aade524f987b4
SSDEEP 192:sxZOmRfWKY/fq6sK1nPIdpdfHW6+WNGYaplb7GIgrJ:sxZDwP/ffsK2FHbGa9
TLSH
T15F22A7126E68A97B8CC7D21DBB65BF53E5F9503291D01E48E6FC861C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85b9181b-7161-448f-90dd-be26d0ee7989.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\85b9181b-7161-448f-90dd-be26d0ee7989.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b6999587-c679-404c-a57e-1ccc3fd850a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b6999587-c679-404c-a57e-1ccc3fd850a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fae99ff6-0379-47ff-b22f-ea64591e2bfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fae99ff6-0379-47ff-b22f-ea64591e2bfa.tmp
Size 18KB
SHA256 7f6feb30c6420ec9cc93201797ca5bf20a69701917009840262449123d71f7e7
MD5 8aeeda239ac86fc7892c22519ddb0ede
SHA1 c34df0c01045ac760e07e0bdcca4d4fffa7dd905
SHA512 02e30d307f9af0ff7501173189167376c865992c4953dfa0d8af4b3df366cd621997ce78313462a569896aff115bd36ea9bebcb4d7d5b0012fee2e7636fe7e01
SSDEEP 384:cQkUSv0sN6EtmGD1mLNzIGmhScxaGBi1iH7vBEcfwIIlk:c0gwx69Bi1iH75ExLq
TLSH
T19F827D72ACB86C3B5EB3E544F14A3A23ADB49117D6D81F90E5DD9B1C00DF29C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b1ee20b5d4c05e9fed763dc63eb1e699f9d122fe724700cf08b7d228f0d0e22
MD5 2ba29d21e0ba033699c149163c45ba08
SHA1 2deb1b20c86a220647a7aef7d335f16513150668
SHA512 a878e4db1d532b1f66fff94411332ef470c6722bdc2fc5bf591348470266b9d7c799318a3c8a60b4b2e5d1b487b946c6a6874ca3a2a3edd98269eec6d0fe7135
TLSH
T195410B58B6FA1148B3B7AE599BF6996E487FB9372F06D45D00010E4F4623B40CD62B37
MD5 SHA1 SHA512 TLSH

Submit Download