5035ef2e8580c3572cabfefbab0c6d561dbe89e716efd52adc46806989f2c6b2

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
site_autoescola_referencia_final/index.html
Size 19KB
Sample261006-phpghayygy
SHA256 5035ef2e8580c3572cabfefbab0c6d561dbe89e716efd52adc46806989f2c6b2
MD5 475ae5c7129ba34e03282a388b8019cb
SHA1 dffcd04f35e3f3a3da93f84f7a1827a9734a2f52
SHA512 0191b4f7ce5485563e4235382d4d402b8b1ea2d4a563d9f1c80880ca033136bd07439f324ad1aa3fadfbd8449696691c359d37dabca8b5c7ef9cad4f21340296
SSDEEP 192:RvhPopKheOcjyyfzGH5bnOhyikWsmQp9Ls55gyFy3DwbiCqXDUwJDNng7j:RvhPTedjFzGHtSQp9g55g6u4GXISngf
TLSH
T13A92233544EA1673663306C5B7B1874E34D6E20BED564582F3FD8BA84FEDC80F90A926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{A85E15DB-955B-451F-9D18-9D5F125445E0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	msedge.exe
456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 5792	4792	msedge.exe	84
PID 4792 wrote to memory of 1988	4792	msedge.exe	85
PID 4792 wrote to memory of 2924	4792	msedge.exe	86
PID 4792 wrote to memory of 2924	4792	msedge.exe	86
PID 4792 wrote to memory of 2924	4792	msedge.exe	86
PID 4792 wrote to memory of 1248	4792	msedge.exe	87
PID 4792 wrote to memory of 1248	4792	msedge.exe	87
PID 4792 wrote to memory of 5260	4792	msedge.exe	88
PID 4792 wrote to memory of 5260	4792	msedge.exe	88
PID 4792 wrote to memory of 5260	4792	msedge.exe	88
PID 4792 wrote to memory of 724	4792	msedge.exe	89
PID 4792 wrote to memory of 724	4792	msedge.exe	89
PID 4792 wrote to memory of 724	4792	msedge.exe	89
PID 4792 wrote to memory of 1104	4792	msedge.exe	97
PID 4792 wrote to memory of 1104	4792	msedge.exe	97
PID 4792 wrote to memory of 960	4792	msedge.exe	98
PID 4792 wrote to memory of 960	4792	msedge.exe	98
PID 4792 wrote to memory of 5236	4792	msedge.exe	100
PID 4792 wrote to memory of 2876	4792	msedge.exe	112
PID 4792 wrote to memory of 5480	4792	msedge.exe	113
PID 4792 wrote to memory of 5736	4792	msedge.exe	114
PID 4792 wrote to memory of 2960	4792	msedge.exe	123
PID 4792 wrote to memory of 2960	4792	msedge.exe	123
PID 4792 wrote to memory of 1652	4792	msedge.exe	126
PID 4792 wrote to memory of 1652	4792	msedge.exe	126
PID 4792 wrote to memory of 456	4792	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\site_autoescola_referencia_final\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff8e7a0c188,0x7ff8e7a0c194,0x7ff8e7a0c1a0
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12449640078889543920,6707897790483153914,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12482504738647326292,5996203460674255673,262144 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,7979058458690027797,17292493351304133224,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4030844622364848175,110252508700236553,2097152 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5921831165565843860,12593992149839181781,2097152 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,4050209011210962343,15770945070571877028,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,430328558282212932,2359811701411080983,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,8576421578972638871,17404360174843217713,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,8576421578972638871,17404360174843217713,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,803231185565461222,3857102054316978786,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,3392460515500007393,565881555526965156,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,18372566608770486232,14278919138975242513,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,11386289327709037008,10926666463853212866,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1216,i,18352840759280594266,7906492182410365872,524288 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6016,i,13834869974169035260,14159556992273203156,262144 --field-trial-handle=2056,i,9936023342673523993,10542934517216030646,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

71ae67f9-bfac-4014-b37e-7d5125ccf7ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71ae67f9-bfac-4014-b37e-7d5125ccf7ec.tmp
Size 25KB
SHA256 ceb35006e0b8b94a9fbd8b013b97b83bf43279c9fe6ee881004256efc1452b36
MD5 39c771d03e69a737b6cec381ca6dfc90
SHA1 6c69099564de25f0a291febe425f35bd8a68f0bd
SHA512 e5eab9376984b83ba628f3476196f30281570a06e5f19c258f2249d9b196e004b4f8ee90673c32023946068f13e9e95836776caf90dba7bcd4b70eeed061513a
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg5XnK2flBVTPUVDR37O6R2FeoCWgL/7Izgow:qFQ63AwgSQJBVTPyh7TR/N3
TLSH
T172C23B32EC68C9BBEDFB4F9AA70A7A07DEF00163959C8AC0D5C85D1D009759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b62eb16-ff3c-4af9-a961-0c9753d2d51a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b62eb16-ff3c-4af9-a961-0c9753d2d51a.tmp
Size 27KB
SHA256 0eb71be7f0356b284281e5dcde8fcac14336af5754d17eb5aa4dcea3a097e2a6
MD5 746477d55a3fdcf819cf0d41860bf998
SHA1 a0b2894ef778f9ecbef078e6b9237cf964a06cba
SHA512 2ae464b67f8f03ad0ab4d88e5fed689d1450774bb4419d7303d021e9c3f64d2e160260b930515d61173a6f90ff188ac3331484ce61e6edea0353c9543965693b
SSDEEP 384:nSiFiZcIcl3sN98TUNTUlI4O5mgEdxLdK2flBVTPUVYpRcVZh6DKhH2pgL/7IzRC:ZFQI30wgAFXBVTPl6fYGH2/C
TLSH
T1E3C25C32E8A8D9BBECEA5FD5AB0A7603DEF0525392CC9AC4D5C95D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

07a3c556-f4fe-46c5-85b0-d126d1c26986.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07a3c556-f4fe-46c5-85b0-d126d1c26986.tmp
Size 11KB
SHA256 b90fa73a039110026ec57adb4f95c92de08f595735864de370b19f2715bff35e
MD5 8a5ef8b61c26d4d82d84da3c98b32886
SHA1 d2ff4608c00edcd93acea68d3776479b386de7c9
SHA512 ba8f29095f19f0f49ad4fa7ff389b8694ea6fbceff6479416676c230f7515954e60de7a25f25456ce77441489b88dd7e12b3b166d417f4fcd7516b4c874f2829
SSDEEP 192:sxZBRdka/fcs+QZZu6dzodpHdHW6+WNGYbIa7Y1UUIg5xKaJ:sxZBYa/fcs+OZu629HbGFcY1Z7L
TLSH
T17642D8156E28AA7B9CC7E21DFA55BF53D7F9603260941E48A6FC8A2C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

158a0ab2-cc24-438b-b244-bbbb79d5eeea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\158a0ab2-cc24-438b-b244-bbbb79d5eeea.tmp
Size 11KB
SHA256 5c75fe1e3ef32c041869d054264e924e0c48db643005c9a5a84305d3db95d5ca
MD5 9899702d4b854ae74c2005eb05a6606f
SHA1 b105da013e736c9128f80fad70f3c451330be3a0
SHA512 8424e0905235fe5e70aa7821f85cf4ace028d9c05cc171d093039273de8b81b6e3a20ad312b16f02838daf7a86d923bafc36ebc0fdf1fdf7e5e25da33caedeaa
SSDEEP 192:sxZBRdka/fcsNQZZu6dzodpHdHW6+WNGYbI47Y1UUIg5xKaJ:sxZBYa/fcsNOZu629HbGF+Y1Z7L
TLSH
T18642C7156E28AA7B9CC7E21DFA55BF53D7F9603260941E48A6FC8A2C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e5b67a3-3ff9-4f64-a2e1-334e4b431901.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e5b67a3-3ff9-4f64-a2e1-334e4b431901.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

52e544e8-4be2-4233-acf1-57a0ca59d680.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52e544e8-4be2-4233-acf1-57a0ca59d680.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cda49ab-209c-42b2-906c-60bc1b8f4322.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cda49ab-209c-42b2-906c-60bc1b8f4322.tmp
Size 11KB
SHA256 2c86782b50d433b9bba0539e5848c710e99e7122fba54fe4ffb5f6871c9736e0
MD5 09c7110a23c0c7bcd6bad1c5804b9ed7
SHA1 3c3dc7bbb40d46a8df76753bfaa91532f8270343
SHA512 014c51033e085b011e9655a1451c35dfbc0da8af5504871326ca15e9cd2c6c3fccc8a6630531fd1f53936f73d507605f8b74f39db7c8574ae8d2691cdbc6d0f2
SSDEEP 192:sxZBRdka/fcs+QZZu6dzodpHdHW6+WNGYbIa7Y1UUIgjKaJ:sxZBYa/fcs+OZu629HbGFcY1ZjL
TLSH
T1A942C8156E28AA7B9CC7E21DFA55BF53D7F95032A0941E48A6FC8A2C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 221d2b264190d01bf0c66c8853fe7e2683d0d9cb223b1b832e2d515c0e5361e2
MD5 451e02af975370c3ebb4199324a5a2d9
SHA1 2d2e261f2eacbc08397ed23d649974f92609f4d0
SHA512 d396d80f3fd4c914875b64dace268c1b3ff607303d20c9673e1c3028f308dcb5bbcb142c33e1b8b37cb002b6a2530ac29865d4e7203c1157d59fd42f17308018
TLSH
T16EE078DE48D5C31D53046747117CD70CC7903A5BD2C0AF4D1744D5C9790714476D1570
MD5 SHA1 SHA512 TLSH

Submit Download

d8ffe05b-59ab-4795-b808-84509c340a05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d8ffe05b-59ab-4795-b808-84509c340a05.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6de86b05-fb65-4a3b-aff4-515206dd1ce7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6de86b05-fb65-4a3b-aff4-515206dd1ce7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a748dcdf-5668-4703-8284-64583d622790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a748dcdf-5668-4703-8284-64583d622790.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c05a8293-d1e1-40f4-8e27-82034e5cc0a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c05a8293-d1e1-40f4-8e27-82034e5cc0a0.tmp
Size 1KB
SHA256 c014ee698db48e974e3c6ed9ce6e2f95569d6020f5ff06dc728fe54e680e558b
MD5 a80be2318597bdbd332f75f1bf5fc166
SHA1 dd824ba32652c6e82f4370c5c3019c3541429af7
SHA512 9bd2cd5b3f8bce4760f8289b9a6535ec83e69efa72345dce37e02ba76697c6bbe13fc65d5cb749bb3b14d9273a188288edf4bec2f3d119501b2a9d1390282d82
TLSH
T1CB31BFF7C3E8866E890196F0A718AE2BDE1D0954432C3D5AC4E4AF1B93E2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7af594ef57c60996f6f51f4f1a9f935b3d8b50874b7ddeabc1a56fd88aa87851
MD5 97ceae225642839fdcf5ef6c3cc812dc
SHA1 42ab4a68a9911a0a8b68d7e16af31b8232ff2622
SHA512 88479c762626b55db1992721f845ea346c4905eb36d33295deff5daa747b9704c7181336ae107d53857db95367e2cffe1524ea38b439a49a34832f2d82036cb4
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47fk:OtfFvpopPxrB4Rhf4Tk
TLSH
T1C4B2341571BA121038FE790C81B5972E064232B33259E63B7FBD54A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a5755ebc-836c-4985-ac9c-097de364b1d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5755ebc-836c-4985-ac9c-097de364b1d3.tmp
Size 649B
SHA256 9996ac9f81e404d25f7f108dac8402107749efdaa6209b27f3425adca411b3c3
MD5 7d8046e8a6d4129ee018a3ff7499b5bd
SHA1 44c4da81372b8ce17d932f02921395291a616677
SHA512 2f9fdd722dab4fe91d5d1fbca9e57875c82f00089dc4307f231d3c33cc4eaab64e8b09c149539b139f444b4611461f19c3616f724f76dbd04fb08483f065d468
TLSH
T131F0F9B5C826AC3B18FC5B1C50A54746E75123572A80898B7B3D811D8FB5B3B854682C
MD5 SHA1 SHA512 TLSH

Submit Download

a00ce8c7-415a-429e-a83a-2eeea5c1078c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a00ce8c7-415a-429e-a83a-2eeea5c1078c.tmp
Size 26KB
SHA256 fabc333c90b89e10c027c2d3c3d98bcf72c4d63a0dc838dca2d951d6cd2c9970
MD5 b0a9539ca1558893d023b41472e126d1
SHA1 21d230d94f154e7481ceebeb634895bb6b8db088
SHA512 79254c341b9ad5344b5f3824d2a4d5d549e0b5edb8be7a4cab37050f28f4a3d468d160adcb030b9839f03ee7e9d85021167a1fd33bfe907862ce7a15a0cf90b0
SSDEEP 384:naiFiZcIr3sN98TUNTUlI4O5mgEdxLdK2flBVTPUVYDRcVZh6DKhH2pgL/7IzRop:RFQr30wgAFXBVTPv6fYGH2/C
TLSH
T15EC24B32E8A8D9BBACEA5FD5AB0A7603DEF04253D28C9AC4D5C95D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab8adec6-68af-49ad-8f37-31d63a43ed2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab8adec6-68af-49ad-8f37-31d63a43ed2f.tmp
Size 26KB
SHA256 c8f30ddd679868a57ba1286ad60a5e76df7c68c05a6001dea8f6e13160440be9
MD5 a2ebcdf83e5f69879fbd6ea7eb583dde
SHA1 edce7c2d51c45095950a39d160fff214715bff4e
SHA512 b3d1a76014e1da963d42b6fe00c08d62a0acf212a34d37c2b3f5803556100bc3e90061513e2e21a397d61c81c5ac748dc87ac184c9ce88f6f9543848aade00d5
SSDEEP 384:n0iFiZcIr3sN98TUNTUlI4O5mgEKxLdK2flBVTPUVYDRcVZh6DKhH2pgL/7IzRop:PFQr30wgAuXBVTPv6fYGH2/C
TLSH
T19DC24B32E8A8D9BBECEA5FD6AB0A7603DEF44253D28C9AC4D5C95D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ba85835038a6fc5c4994312a6e3b3970fffa389e47070aabe35422ed19ada7f5
MD5 d75b96523f2fcd3f5cd95a3f7c4abe2d
SHA1 d93a12202a82409960ea651f163ba2d908a197bc
SHA512 20526527661be7852d8498c770ed3b5819961feb88a8c626288d6668b4b053704daa59bf77a8e53870e9a59ccd10ddfceea97f5045556817eda11aa5c9850fa7
TLSH
T1C1415C9CAAF91149F7B76F569BF6A96D447BB8732E06D05E00020E4F0663A00C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download