f6f4c1c8f625aba6317bc3d2f7d1fa4ccfcbbaa7ad086475c6e9da99528632ec

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wordpress/readme.html
Size 7KB
Sample261104-xvertscx7x
SHA256 f6f4c1c8f625aba6317bc3d2f7d1fa4ccfcbbaa7ad086475c6e9da99528632ec
MD5 6e385f07524b577e2b22c630f3bcf9c9
SHA1 9127fa03ef6380b823a555ceb0bb8abd4e37221c
SHA512 471df67ae8c5814e4d21771ee56c07c38f1d2eb835dbb8d92399f30b7a1a3201c5f55a3b2b57d99fb8f5cf94a234bc6fcba7418981fc31b0eeeb31fffd810fba
SSDEEP 96:CWUK8pz1E/4kF5kyJ0ifN8uueKQMdcwFdF8CKuID9kKCZxjD+9+25tdLwGg1IZzU:98/SVPmuBx3C/Da7d0JuCidI
TLSH
T12BE1966BB5405376131143B16006217A733300BEB79D464654DBE62EBBA23B4AF7F4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{3A4FD91B-287E-41C2-B4A9-183756A50B6E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 5068	2468	msedge.exe	89
PID 2468 wrote to memory of 4732	2468	msedge.exe	90
PID 2468 wrote to memory of 5268	2468	msedge.exe	91
PID 2468 wrote to memory of 4732	2468	msedge.exe	90
PID 2468 wrote to memory of 4732	2468	msedge.exe	90
PID 2468 wrote to memory of 5280	2468	msedge.exe	92
PID 2468 wrote to memory of 5280	2468	msedge.exe	92
PID 2468 wrote to memory of 4196	2468	msedge.exe	94
PID 2468 wrote to memory of 4196	2468	msedge.exe	94
PID 2468 wrote to memory of 4196	2468	msedge.exe	94
PID 2468 wrote to memory of 1704	2468	msedge.exe	95
PID 2468 wrote to memory of 1704	2468	msedge.exe	95
PID 2468 wrote to memory of 1704	2468	msedge.exe	95
PID 2468 wrote to memory of 2028	2468	msedge.exe	96
PID 2468 wrote to memory of 3284	2468	msedge.exe	97
PID 2468 wrote to memory of 2028	2468	msedge.exe	96
PID 2468 wrote to memory of 2028	2468	msedge.exe	96
PID 2468 wrote to memory of 3284	2468	msedge.exe	97
PID 2468 wrote to memory of 3284	2468	msedge.exe	97
PID 2468 wrote to memory of 3324	2468	msedge.exe	99
PID 2468 wrote to memory of 3672	2468	msedge.exe	100
PID 2468 wrote to memory of 3324	2468	msedge.exe	99
PID 2468 wrote to memory of 3672	2468	msedge.exe	100
PID 2468 wrote to memory of 1792	2468	msedge.exe	102
PID 2468 wrote to memory of 6096	2468	msedge.exe	106
PID 2468 wrote to memory of 2852	2468	msedge.exe	107
PID 2468 wrote to memory of 2092	2468	msedge.exe	108
PID 2468 wrote to memory of 2388	2468	msedge.exe	109
PID 2468 wrote to memory of 2388	2468	msedge.exe	109
PID 2468 wrote to memory of 3416	2468	msedge.exe	111
PID 2468 wrote to memory of 3416	2468	msedge.exe	111
PID 2468 wrote to memory of 1148	2468	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wordpress\readme.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd5f03c188,0x7ffd5f03c194,0x7ffd5f03c1a0
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,13764880822796269969,9216662554842261246,262144 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,3756622737789508529,11082972819421458719,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,2109603088269647948,10898622500162734340,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3672,i,13367587240990345953,4517464695949026545,2097152 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,6365095848606375475,10848229585981033969,2097152 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,2359900431561833034,1846702803231070655,2097152 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,2439564953351207257,2331463633627151732,2097152 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,16791290308226675190,9605735879163804893,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,1085676895962968618,1849717644722995585,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,9381021077397793531,17990337076338885642,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,9381021077397793531,17990337076338885642,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,4204112958813396901,9886718243361079034,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,9719852206048513033,3934732032748633514,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,4303868946489274304,10641746414613885952,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12408454843308623855,18218631091695992076,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,9364389103445255620,9579905352461074517,524288 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,1040949883882739497,1345315392217178265,262144 --field-trial-handle=2476,i,1452021111171291602,17264712204489448549,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3dd79c3d-173f-49de-a18f-7d98ac1522dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3dd79c3d-173f-49de-a18f-7d98ac1522dd.tmp
Size 36KB
SHA256 226722238a2c9ddd5ad5bc254a7d8f35946a1fabbbfe0718f1fb5d8e396a0f10
MD5 9cfbf1d1153697a6c8f0c1f333a211a4
SHA1 bd4b62a2b6008f96e7355b320068d8681173b324
SHA512 59f40b135f8e0803a8ede77eea820010925122acba873848fa3d640f2a539f9aa34ce6700722981570be1b99aa7b1139ae2b9ff62619916caeaea4e17dcb926f
SSDEEP 768:tFde3jwg8AOSO5EEBrtJvMIYNa8S5oYklnA+kE75EjOL0:Ze36tFBJTWRdA/k+OI
TLSH
T18F03AE3699D4DABB9CA697C4F20E3352AEF15263C4889BE4DADC1A5D02C71EE1307861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4091c2b6-639e-44d4-90e7-65b71f7de179.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4091c2b6-639e-44d4-90e7-65b71f7de179.tmp
Size 34KB
SHA256 26709a120f891a3e75d8abf8c8ada85c4573325b0fbbd2da8a694e18954fe309
MD5 600bd53cfc0b943e08d690de04b7d70d
SHA1 bc216fb955f3fc7bc05b955ec55257eff9586cc8
SHA512 50b7e40da3d73b954ada211cb3fbef4530b8d0eb1a2e34ac923de6af44bfee5458d36ca3d4275b01af845b0938b21b04cdcf1a5d5642ff0d19ec642b204e7025
SSDEEP 768:9t34AOSO5EEBrtgvMIYNa8S5oYklnA+kE75EjOL0:9t34tFIJTWRdA/k+OI
TLSH
T128F2BF35A9E4ADB78CA6A3C4F20A7792BEE05253D0C80BD4D9DC1A5D02C76EF1307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49dd524f-cddc-4ce8-a682-fd3dfd109761.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49dd524f-cddc-4ce8-a682-fd3dfd109761.tmp
Size 34KB
SHA256 fba8cb54ed3a0b07370a9788190aa3374ac3ad0e326951f75d0268bb0238b327
MD5 9cd39643e3d6c3f6c904bac266609097
SHA1 54f035ab5259cbb125f63bf4d5943a12962dbd9b
SHA512 91aa808da18deb8b109db03b8c2e5c35d6843aad5ea2ca47b2f02670a6216beb52a8e12976f3d24f27a93229460231c9f485c1be81899e94356245665c96b82c
SSDEEP 768:56t33BOSO5EEBrtbMIYNa8S5oYklnA+kE75EjOL0:wt33wFtTWRdA/k+OI
TLSH
T1EBF2AE35E9E4ADB79CA6A3C4F20A7792AEE15213D1C81BD4D9DC1A5D02C72EF1307426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81c5fbeb-76ac-4f07-bfe6-6c36e6a41df2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81c5fbeb-76ac-4f07-bfe6-6c36e6a41df2.tmp
Size 38KB
SHA256 3eb4684e4a06c8d527cb700333c7ca685152bb323401170c66c3ab44e211a79a
MD5 ad512bd48cf07c0d789aff4bd40e2489
SHA1 6f582a6cb38503b987c15c85b225128045e7f002
SHA512 af84d207d9272705ec56acce0f808c8295c65f235b3549ef7a5026e93f714f04667f3f7cdab6dddb9429eb6a918484b976b736534b5203977a2aa6e993eac74c
SSDEEP 768:dy/UxvxjgC+238kSO5EEBrtRxMIYNa8S5oYklnALkSH8L4:lZj3+23/F5PTWRdAwS04
TLSH
T19A03C03A99A49C739CF663C4760EA347AEF55263D0C55AF849EC1F0D07C76AE5303851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

2ca687d4-4ff9-4f39-9ddd-0d0c6af0b26a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ca687d4-4ff9-4f39-9ddd-0d0c6af0b26a.tmp
Size 11KB
SHA256 180ed368b6994b316abbb022c3a4e78e5516accad2990dd35981d4e70e11c153
MD5 20c503410c76788280a7b1056cc033c7
SHA1 f403e15f42e752f306288b5822fd736b15cfea02
SHA512 e314f0e13c033e1b5be3c32525f3139b8258fee8ebb0892dc402dc7f8ec3e51486db747b8673a6c9272e4736f7d2e2acc92481920347b49baca0814776e018fd
SSDEEP 192:sxRLRlbP/fQsRNPzoA8p4Q/g6+WNIYuvrixGSIgDuJ:sxRLDP/fQsvmJ/5Ism
TLSH
T11732A515AA68A93B9CCBD24DFB59BF53E6F91032A0911F48B6FC9A1C04E76DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d2b3cf6-2541-452f-a78b-1b66b294376a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d2b3cf6-2541-452f-a78b-1b66b294376a.tmp
Size 23KB
SHA256 428593ae1f7a7c894084ffe8c63c431e1be1c684074fc2bd08ed40923cce7012
MD5 6945a94732fa6ecad5ad1a8f8ed913fc
SHA1 dd0ff4cd05e661a34aafe0e9c21a6b70a055c3c0
SHA512 40639457857c723b8bff548bce8075ef1d4af5ca4ae42db5e610090a3f58ca57e7c9e0b55f7394b84f351d0410d4739c18b348d90e6c956acf74a6c74956c24b
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6mrocbZ:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VW
TLSH
T196B2DA2B644CCB7E9FC00AADEC196F976D9C02C796988D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b8dd268-adb5-41e2-8b28-8531a722b126.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b8dd268-adb5-41e2-8b28-8531a722b126.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67518919-2e81-4312-aa16-5c20aa870a90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67518919-2e81-4312-aa16-5c20aa870a90.tmp
Size 10KB
SHA256 eb784f514061961d4155ab48eeec99614bdbf73e473682727f107e7fd5cf16be
MD5 9d05a59a53e641109284d8701c0cfb9c
SHA1 f8c736664eda7460fd729993b24f5a10f7d8bd04
SHA512 31bdd4029fcbf344c0e4673dc18956098c913037554b89b305288d3b7f6ab0335b9c9a465483d2d6968cb24987358fc2b2a53d2819dfc6ad605badd400ae7642
SSDEEP 192:sxR8RlbP/fQsqNPzoA8p4Q/g6+WNIYuePixGSIgIJ:sxR8DP/fQsqmJ/5I1s
TLSH
T15932A415AA28A93B8CCBD24DFB59BF53D6F91032A0901F48B6FC9A1C04E76DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 220b9ba548b0433205c68b495f687304e2fe4681500d1770cc9d0d19d4c96b8e
MD5 e8856c492b3d2e9fa50ef92d6f2e3ead
SHA1 89d8038dc2a7ce8730deb3a126f88273f1c6958c
SHA512 35840d5957804df62f6a8a49732d69f83a7e9ccfd3ad1ec7d1daa7f76e513e837b51b8e47e8362692f9c3a93d45912d68d0df8d0b51609ebb88c128393af92f3
TLSH
T178E0D8C60AC8C32DA288B44711F8970CD2C236AE93C1B91A1B04C48D70464417799660
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4e8ef3671ecf198fdb42b3243baaa9270062551e38ecea8d3d9a94ec5d57d184
MD5 f9a6d77928d9fcde2b023bab1d6ce8fc
SHA1 abdcb2522bf093df6825b8fa0f0fc29986c7d998
SHA512 396d9626610a3c264dbaa0e159df6bc769794a5b78669e06c4e8125cb8042c414f5885ab925b005018c9eafce8fbb8cc280292e6ca0e6a9428cde34b1e420d26
TLSH
T13451908091A08C87FBD800B0C8C12C8336B9BFC206831F2506A6D5FCD4E2BFA194CDCA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a7d97db5c87a865876197fd6425a4d7f2682dec35f7f0df08c489b615a72dd6b
MD5 acc259857847d0f1696c2868cfef26d6
SHA1 91b798c2ccad4c409cc73b6c0a8196bc623b77c0
SHA512 575b4b24267b919ca9fed841c04c110a065a68a5a20c7d216014bba4304c2b95c4e999479966f356af706997cef4c3d7bf5ecc893db570b632bc34dc3ae602fa
TLSH
T14751808095909883FBD810B0C8C02C8736B9BFC206831F2506AAD5FCD4D2BFA1848DCA
MD5 SHA1 SHA512 TLSH

Submit Download

84016d13-0698-47c8-8119-8d01023ade62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\84016d13-0698-47c8-8119-8d01023ade62.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

00fe4643-b8f4-4bd6-873f-f8e1ace7ef47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00fe4643-b8f4-4bd6-873f-f8e1ace7ef47.tmp
Size 1KB
SHA256 5cdce92307e69578b778a0e73a39b774628f9b676907bb54e9a15656ea1c8cd9
MD5 a17009ee928348f8bbbe8989420527ea
SHA1 787411e9c78b16184da89fc1dfe1bf14ccfbcbd9
SHA512 af4ba180720a26aaf05bf6dfa1e3ed46b72465036bcb8d995fa71fd48ff2d530c731d792bd9ed502f8a8084eddc28a093c262f120b0008f006c3beaea7624aa8
TLSH
T1E731C2F787B4857E9A0186F0AA14AE1FCE2D0515436C7CA985E0AE2793F3472E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

76b5151b-01b6-4e5e-98f2-1722b235aec0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\76b5151b-01b6-4e5e-98f2-1722b235aec0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b06fc2d6-df6d-46b1-a70e-287caf256704.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b06fc2d6-df6d-46b1-a70e-287caf256704.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

daed500f-786f-43a0-8ed9-eb3f9f5e89e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\daed500f-786f-43a0-8ed9-eb3f9f5e89e5.tmp
Size 10KB
SHA256 7cdac36f5bcf1434eb5156e1f65aea213badf96943c8910076c72f8672fbbfea
MD5 af4fab2d4289d83dbb1b10f24dce3b3d
SHA1 e388f19aca85b50d4d8cf3a3376fdf2abd29b953
SHA512 ccba1d3ac8a2774858fd158ed5ca553a8fe7ca27fde176dfc37f5b3a805200bf48c18ca18e006aea20badebf56a089b98cedf61dd14fdb28281a74fdc4f08a97
SSDEEP 192:sxRLRlbP/fQskNPzoA8p4Q/g6+WNIYuePixGSIgDMJ:sxRLDP/fQssmJ/5I18
TLSH
T1AD32A415AA68A93B9CCBD24DFB59BF53D6F91032A1901F48B6FC9A1C04E76DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25dbac74-f8d0-45a0-9c76-10ac3a3566dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\25dbac74-f8d0-45a0-9c76-10ac3a3566dc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5d6bb2b-f3a2-48b6-91aa-4095306e2485.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e5d6bb2b-f3a2-48b6-91aa-4095306e2485.tmp
Size 38KB
SHA256 c31e4577694fa1ec708d8ac95051d44842000c7f729580a4d51e36ee059c6b0e
MD5 76f8831d94ab3ebec55df6450ac02c20
SHA1 b4cdf70b37aacac670a515874d9ae75e09770bb0
SHA512 a755b51b8915c9d90479fb81145813cf8fe2fae0a27098936d609e4e5e8d0760e4e634b1b00cbe6c667cbf1b1c6fe1ab4dee0e3e0278e2878121f31c7f5396df
SSDEEP 768:do/UxvxjgC+23Kf3SO5EEvJMIYNa8S5oYklnAaiSH8L4:nZj3+238PFvHTWRdARS04
TLSH
T14203C03A99A4A8738CF663C4770AA357AEF54263D0C16AF88AEC1F0E13C72AD5303451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9f10aef-0096-4fd9-be47-ea32ffd226fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c9f10aef-0096-4fd9-be47-ea32ffd226fa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download