8b20eddafee97fbb047259a665fd66839dba74a5f89825d2e0dd1297caaa7e86

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zorara-Exec-Update-v2.6-main/index.html
Size 6KB
Sample261022-267zzaaw9n
SHA256 8b20eddafee97fbb047259a665fd66839dba74a5f89825d2e0dd1297caaa7e86
MD5 a319ab1d5f4052437a74ce21f6f8d939
SHA1 fe6eb5856bc8cd56bc7f0901eaafa25b49ea40cb
SHA512 a5afd85edbe3f4f3a223281f850ca7940eafb51cfbcec7c6f49ab9aa5ba9b307bb64bc4b4c17bc2c625239bc46a33ac8af10a568932574c0ef0ae428cf17c5c6
SSDEEP 96:t6gZFw4dz6OOxsNJCiWRP5ldHt1b/7HvFswa0tVEuafZd/sFgbkrp9+NGiO:t6AFwyz6OOxsHNkP5ldLbzjJeb+QNGiO
TLSH
T154D14B50334977BB28788A457BE73E8FCB36701A1B1E8DD618B02D7E1A6CB138833459
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{CFA455D9-6ED7-46C3-A446-8779A10E7481}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4412	4644	msedge.exe	89
PID 4644 wrote to memory of 3092	4644	msedge.exe	90
PID 4644 wrote to memory of 2968	4644	msedge.exe	92
PID 4644 wrote to memory of 3092	4644	msedge.exe	90
PID 4644 wrote to memory of 3092	4644	msedge.exe	90
PID 4644 wrote to memory of 904	4644	msedge.exe	93
PID 4644 wrote to memory of 904	4644	msedge.exe	93
PID 4644 wrote to memory of 5380	4644	msedge.exe	94
PID 4644 wrote to memory of 3164	4644	msedge.exe	95
PID 4644 wrote to memory of 5380	4644	msedge.exe	94
PID 4644 wrote to memory of 5380	4644	msedge.exe	94
PID 4644 wrote to memory of 3164	4644	msedge.exe	95
PID 4644 wrote to memory of 3164	4644	msedge.exe	95
PID 4644 wrote to memory of 2144	4644	msedge.exe	97
PID 4644 wrote to memory of 3512	4644	msedge.exe	96
PID 4644 wrote to memory of 2144	4644	msedge.exe	97
PID 4644 wrote to memory of 2144	4644	msedge.exe	97
PID 4644 wrote to memory of 3512	4644	msedge.exe	96
PID 4644 wrote to memory of 3512	4644	msedge.exe	96
PID 4644 wrote to memory of 6028	4644	msedge.exe	99
PID 4644 wrote to memory of 6008	4644	msedge.exe	100
PID 4644 wrote to memory of 6028	4644	msedge.exe	99
PID 4644 wrote to memory of 6008	4644	msedge.exe	100
PID 4644 wrote to memory of 2580	4644	msedge.exe	102
PID 4644 wrote to memory of 708	4644	msedge.exe	105
PID 4644 wrote to memory of 708	4644	msedge.exe	105
PID 4644 wrote to memory of 708	4644	msedge.exe	105
PID 4644 wrote to memory of 3408	4644	msedge.exe	107
PID 4644 wrote to memory of 4532	4644	msedge.exe	108
PID 4644 wrote to memory of 4336	4644	msedge.exe	109
PID 4644 wrote to memory of 1276	4644	msedge.exe	110
PID 4644 wrote to memory of 1276	4644	msedge.exe	110
PID 4644 wrote to memory of 4196	4644	msedge.exe	112
PID 4644 wrote to memory of 4196	4644	msedge.exe	112
PID 4644 wrote to memory of 2368	4644	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Zorara-Exec-Update-v2.6-main\index.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ff9f9e3c188,0x7ff9f9e3c194,0x7ff9f9e3c1a0
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,150627172528343993,1225402937425908376,262144 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,13264249239443829865,2105578203144062709,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,18074436263535299476,3128883494323894843,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:13
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,10012559865519229917,6248292539152367750,2097152 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,11485840724797245749,508171029262376676,2097152 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,10278890166427476639,15957717564175587045,2097152 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8778839062564539449,17923559694577275609,2097152 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,1799127561152698823,1590833344383862940,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6551073662941446984,10931437661573809708,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17901705851638861690,13413060429871842025,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17901705851638861690,13413060429871842025,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6652,i,3147248407291585523,4368467631195633482,2097152 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,5985265434699962464,15403469690902633529,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,5600997785188643047,15201559497863096316,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,9368235150724308619,8888914350029856719,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16488912961179151133,17160547151132141080,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,5014776936404870431,958318904729786290,524288 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,5044950543189269953,11118416521175925089,262144 --field-trial-handle=2192,i,16400010470693403074,3316101545817901541,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8110bf5f-f81c-412b-86a7-b0764a5eed86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8110bf5f-f81c-412b-86a7-b0764a5eed86.tmp
Size 33KB
SHA256 dd769037b35a4fbbb5d44afb6bdeaa50c410f60142e27e60f9822146eb51856f
MD5 47c7fe3bc9b3da4451500657127bc150
SHA1 29a72e366baddb0a8b85833ea93b42f8713b59ba
SHA512 4eac9370e1580f874b0b4373d1b3570462e8dd4961f2c9c7a7608ad2753fb5102d4bccd09da5a8997b96bb0a9446d0709e3226597d236bb6a24d630a41762e9b
SSDEEP 768:iu3x6TybNbMm6tOeRFZD1fTos7RjlLiV6LY:iu3xe0Y1fT/RpLiV6E
TLSH
T121F2AF3AB8E4AD338DF6E284F24A3947BEB09253CAC9099445DC6E0E058BBDD1347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

0600b173-552c-42c7-a255-2c9a33a1c1c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0600b173-552c-42c7-a255-2c9a33a1c1c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cd14fbb-eb8a-4eb0-98c0-4247cef2c999.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cd14fbb-eb8a-4eb0-98c0-4247cef2c999.tmp
Size 11KB
SHA256 e47c1a5ab50d56ad2e6acabe274fa7db962219d5c254727d6ddc73f2cf85d1d5
MD5 bcc574f383293bbcd566d90016243d1c
SHA1 5049083bbd74da8a60980793b7cc00466fd45ff2
SHA512 4cc9fbe34a585a13d857d939fb555488f294c28d9d507a39b909d5be79b72e6657fe52b0c529492530b45dc538dd2de5929f752896d34ee2101edcaae4751ed4
SSDEEP 192:sxRxRlb1/f5sQK7xRtzoA8p46M/g6+WNIYDoJWJGjIgDvOJ:sxRx71/f5sQ6QW/5Il+
TLSH
T1E732B816AD68A93B8CCBD61DFB55BF53D2F91032A1951E48B6FC861C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b6b532f-713d-49bf-aaf5-b6edd58cf7cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b6b532f-713d-49bf-aaf5-b6edd58cf7cf.tmp
Size 11KB
SHA256 1c1cd48be8c4b56bdb678490074eb17c1fbb8b284097ce441d184b0d563c374a
MD5 e20ec20bb8c9895d3a48c6a8f0dd6aab
SHA1 247470cc434b3bd671f0b58b4f8526d685e9f37b
SHA512 c35d0462db857e5af809baf370d42afa30538602e14447fad10c1bd84e5e16b1615cc77cd23be2628924da1c656ef2c814cec665471a79c66f554bf8bef28ea7
SSDEEP 192:sxRmRlb1/f5sgK7xRtzoA8p46M/g6+WNIYDoJWJGjIgIJ:sxRm71/f5sg6QW/5Ils
TLSH
T18232B916AD68693B8CCBD61DFB55BF53D2F91032A0951E48B6FC861C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cbbce40-b679-42bf-823f-c97bdfba629f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4cbbce40-b679-42bf-823f-c97bdfba629f.tmp
Size 11KB
SHA256 82f1af58649f4f9db8973ef8d2b472438f8dc63827bc2d28306fd45ab5485b49
MD5 2726ce2b4ee067a369498b461ef4988d
SHA1 8f889b97b4b86ad5f519d9cc2b2992a260224dd5
SHA512 dc88aec145703d67dc36987af7c19e450020a354f19122c2f73466f6d7b85929a474f4183ce8c3bd2caec4b1650e155c4f4999818f2cb9c18ed8960ebda569ea
SSDEEP 192:sxRxRlb1/f5sqK7xRtzoA8p46M/g6+WNIYDtJmJGjIgDvUJ:sxRx71/f5sq6QW/5IK8
TLSH
T11432C916AD68693B8CCBE61DFB55BF53D2F95032A0951E48B6FC861C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

634b8611-f213-41ca-9a34-8865fb0bb828.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\634b8611-f213-41ca-9a34-8865fb0bb828.tmp
Size 23KB
SHA256 b21e777e10eece8add1df10032d0819699b75a430f400a3eee5b7985dd03e9e2
MD5 bd2d398e8a84464d86ad0ff812858ac0
SHA1 beafee76a8e62ffc8d41c1327fc253dea24b2a28
SHA512 00ee6bb6e7f1a9a3dba277668c222c1c62e69a8b5503721397ed1de83d87cf8b0850be277e33790c6e0d836c9bd63a1d41f05eb0455e5b0e9a82e7ad988cb730
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9NroTyG:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vt
TLSH
T1D5B2D92B640CC77E4F804AADEC1A6F977E5802C796988D4047FE995C03C77EBA11A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d9c3b6464d808707d4d16116043e9d5dd151b65d7c9c17581738cfab173db843
MD5 6da00861935bf2a380ce0cde6e46e6e8
SHA1 28c80f090aae8c31cad1145aab181acef9255575
SHA512 c19c0596d76e03825f083be2d70773d1d2a7c0d6684ee95c27b88a7635560ad286712ecc4672d59b7c449197864af769a49b6527c02a315a315466bb5b59871a
TLSH
T18DE0269568E8C22FA248A487067CD70CC390665B92C0AD0E6708C58D7045044ABD2B94
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 4d4d7abf21407be298e93031408693990342e0418d2704df7982d92942defa88
MD5 a50ff3d4eaa2bf9f2ab165d437442ce0
SHA1 7078356f4e543944ecfa4df27e3a2fdd5c41632e
SHA512 54a9c8d943378020820d5cf41093ab7b53011985cf0aa266aea2c8cf4a4a8489e05998eb0ca8ead5412dc60a05d969df8f30a4a2f8336c3462adb256add1b6e0
TLSH
T14B5140806A91709EC758613D80D7148BFAFB44B065C31E433894F9FBEF4D3E6596E0A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3819fa842e0b636df0513807336a88dbc966cfb4704159100ba49e9a04f8285f
MD5 8a68a447346a8090ae060d12f9e2d1ba
SHA1 bc9afa494f422ff538df8ac59ffa12c9011fa33f
SHA512 8b8f51172ee4f6f8f487ae05a24f79fadd3c00cc4862347bbcef3feeb615d1c8c37279e984f42edac397bc7f1372956513e5984ee464f0ee598db9f02b30602c
TLSH
T1305162806991709EC758613D80D7148BFAFB44B065C31E433894E9FBEF4D3E6596E0A4
MD5 SHA1 SHA512 TLSH

Submit Download

9cafa3e3-f353-44d6-b7cb-bf88273e9ebd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9cafa3e3-f353-44d6-b7cb-bf88273e9ebd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

03bc2035-5aa1-448f-ba23-661596d11340.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\03bc2035-5aa1-448f-ba23-661596d11340.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b3e2bb46-67e7-46c6-91f9-c33e9ef8a156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3e2bb46-67e7-46c6-91f9-c33e9ef8a156.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f09b3345-f4f4-4bfc-bf5f-4fdb0efb848f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f09b3345-f4f4-4bfc-bf5f-4fdb0efb848f.tmp
Size 1KB
SHA256 ea500b7ca0fb868338f87bd474eb252126474bd2f8cebcdb4556e23d1e84fb2a
MD5 802c86809097c214401a687d39c02c6e
SHA1 6ac152486d50c8a212a42c0b111e597c581f6b71
SHA512 6f60a5247864ad346a179245dfafc8c68280ababb57d5dd0863e3f92443434691ee32efab5da5fcb6725f21b1c6c1cd2b1d63366b63be782e7a0a113c60ea4c2
TLSH
T13641C1F787F4857E9A1196F0AA04AF1FCE2C0515432C786989E4AE27D3F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

203888a6-b0bc-46a4-9f58-09092a6ca4e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\203888a6-b0bc-46a4-9f58-09092a6ca4e7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b333a24f-aefd-49ef-8bec-874e760e347a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b333a24f-aefd-49ef-8bec-874e760e347a.tmp
Size 38KB
SHA256 82f70c4cb0d0de77f8e17d9456c71dc21dfc362591e5dfea9b91d2fdbf4d651b
MD5 e710283667ee6197e0f1a719111b7279
SHA1 80cc9f960322ad6d3ff982b1b79ea7cd97d3c151
SHA512 408cee714724ccac4cccb01a2a329cee13318047c365bf7f7fecfd9b0e42a3fe992b9e56a15b59272295d70490541ad69d26e893afe8bc4ed258c1b70d497682
SSDEEP 768:O/UxvxjgC+k3indybNbMm6DOeRFZD1fTos7RCl/+Pu:DZj3+k3ideY1fT/RKKu
TLSH
T18303B03AB8E45D338CF2E244B24A764BFFF455A3C6C919D409DD2E0E158BB9D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b74cda0f-95ff-4aaa-abe6-decbc6b0c2a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b74cda0f-95ff-4aaa-abe6-decbc6b0c2a3.tmp
Size 36KB
SHA256 343393faa21c8b3f16a72a226f153219dd59d9c96a8fe959ba8cc30ca43abf2e
MD5 f1dc778e58050208896044a6a9ccb5db
SHA1 249169f06bdc33e629d638e48d4be6d68b7f8072
SHA512 3da55f46b99c6f0b5ab817e4b0cb3bd6cf00cf93bdcfbeb59c309ba4f43c78959e960b8142c5685966dd38595d3988e0fefda7d41be7bd2a2ee4762f106a626b
SSDEEP 768:HFd137wg96TybNbMm6BOeRFZD1fTos7RjlLiV6LY:X13beAY1fT/RpLiV6E
TLSH
T106F29D37B8D49E379DF6DB84F20A3643EEB082A3C9C9599496CC5E0E018B6DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbd975ea-9b0e-43e5-9076-218f14bc7e09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbd975ea-9b0e-43e5-9076-218f14bc7e09.tmp
Size 37KB
SHA256 47e155bb801f7f5bc5f3090aa1566d70f3efbf8710ffd063b47aa8f9da42cd31
MD5 36137e70f61d3c187330aa9ec0dbbfc0
SHA1 a22a73565ca5bd5581b71a0247c5926933a00b12
SHA512 c5d5c62be4ce4ba658dbefcc3d4cbf0d78ff2adaaf81d2ef85c066c118534afd444abeb77ecd943b986c94144fde75c9bdd843f033ea516842d9bbf95f8a40f1
SSDEEP 768:z/UxvxjgC+k3N4UybNbMmsOeRFZD1fTos7RzH/+Pu:GZj3+k3NXQY1fT/RbKu
TLSH
T1E703BF3AB8D85D378CF6E244B24A774BBFF455B385C91A9809DC2F0E158B79D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de79904f-1250-4758-bf17-e50908bff98f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de79904f-1250-4758-bf17-e50908bff98f.tmp
Size 33KB
SHA256 15dcf4c3da7d38d667a3dcc3e14c060798035f8209eab246ef4a4eae48f50d05
MD5 8c24f9da7e9f9d9547d01907ceb87e4c
SHA1 6ecdd6e41c569021989a795ec47b114e1a867027
SHA512 c202e58afe48ad7aedb0ee1c2efa012acdc1c9538b40effdcbf919c241dea6a3ed879d00cca598537151295d97eb96391818533cf0c97a440082bbd5cbea1cb2
SSDEEP 768:su3A0TybNbMm61OeRFZD1fTos7RjlLiV6LY:su3AQ8Y1fT/RpLiV6E
TLSH
T19BF2AF3AF8E49D334DF6D284F24A3947BFB49253CAC9099445DC6E0E058BBED1347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f0c80a4-2a7f-414b-9227-25aab8634a55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f0c80a4-2a7f-414b-9227-25aab8634a55.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download