hxxps://phamanhung2009-coder[.]github[.]io/fwclan/

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://phamanhung2009-coder.github.io/fwclan/
Sample261102-1ccrasfv8p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{6588DAEA-0C6A-4C0A-B4A2-4331A9BE039F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 4584	1056	msedge.exe	84
PID 1056 wrote to memory of 1572	1056	msedge.exe	85
PID 1056 wrote to memory of 4476	1056	msedge.exe	86
PID 1056 wrote to memory of 2900	1056	msedge.exe	87
PID 1056 wrote to memory of 1572	1056	msedge.exe	85
PID 1056 wrote to memory of 1572	1056	msedge.exe	85
PID 1056 wrote to memory of 2900	1056	msedge.exe	87
PID 1056 wrote to memory of 3412	1056	msedge.exe	88
PID 1056 wrote to memory of 3412	1056	msedge.exe	88
PID 1056 wrote to memory of 3412	1056	msedge.exe	88
PID 1056 wrote to memory of 3440	1056	msedge.exe	89
PID 1056 wrote to memory of 3440	1056	msedge.exe	89
PID 1056 wrote to memory of 3440	1056	msedge.exe	89
PID 1056 wrote to memory of 3140	1056	msedge.exe	91
PID 1056 wrote to memory of 3140	1056	msedge.exe	91
PID 1056 wrote to memory of 3140	1056	msedge.exe	91
PID 1056 wrote to memory of 404	1056	msedge.exe	92
PID 1056 wrote to memory of 404	1056	msedge.exe	92
PID 1056 wrote to memory of 404	1056	msedge.exe	92
PID 1056 wrote to memory of 4752	1056	msedge.exe	96
PID 1056 wrote to memory of 4752	1056	msedge.exe	96
PID 1056 wrote to memory of 3804	1056	msedge.exe	97
PID 1056 wrote to memory of 3804	1056	msedge.exe	97
PID 1056 wrote to memory of 3940	1056	msedge.exe	101
PID 1056 wrote to memory of 2880	1056	msedge.exe	108
PID 1056 wrote to memory of 1836	1056	msedge.exe	109
PID 1056 wrote to memory of 3908	1056	msedge.exe	110
PID 1056 wrote to memory of 3916	1056	msedge.exe	112
PID 1056 wrote to memory of 3916	1056	msedge.exe	112
PID 1056 wrote to memory of 4644	1056	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://phamanhung2009-coder.github.io/fwclan/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa7730c188,0x7ffa7730c194,0x7ffa7730c1a0
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12363596953447073108,7117739708092633463,262144 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10968860123225593928,1011329433245520199,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,1204760274046963017,8881189603344895772,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,4589320440008601980,10852449231050588805,2097152 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9216935149078388516,16103876554102997404,2097152 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,8370921610511264894,10948671947223544432,2097152 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,10649054174528879122,1110593468312239858,2097152 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,4792918757707432110,1041716340566579562,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,361673145275848954,2526354398526055513,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14929790182948604506,5414055664662586748,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14929790182948604506,5414055664662586748,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,11224298098919276214,15837810960858589254,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,1372432746210649335,5281636861443229452,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17493684982467325550,11758020907034190877,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,17396505303759209177,355916673297005574,524288 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5664,i,641628796818366978,14337205374968068661,262144 --field-trial-handle=2996,i,3526198525685999727,10797869947480120624,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6235c4fa-7ddb-479f-b260-bf16d7d6aa68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6235c4fa-7ddb-479f-b260-bf16d7d6aa68.tmp
Size 18KB
SHA256 52ccc28162e299a737d7b466c4fe725daaab7bf9925aa021cc68dc186d513207
MD5 2f43cdbe7ce0878ce081e217a8aadad8
SHA1 bd8f47431715d76ce5cd49012e6e56dc4f37291f
SHA512 00bf251d15d4cd8726e8b19d91d00bc83a0358f6be9e8dd9e071fb20d60937728de9344e3c138a336b2855eac687b7e95dee8eba822377b9e22ddc0ae322384f
SSDEEP 384:CQkUSvHsNdBkRonj+Gp5u8i0+atgH7vBE+/IIln:6H3RoaUkCtgH75E+/Lx
TLSH
T10F827D36A8686D6B9DB39660F10A3613EE74816BD7C85F84DCDE672C01DE5DC230BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8603772f-3330-4e33-a3ce-acdc7618933c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8603772f-3330-4e33-a3ce-acdc7618933c.tmp
Size 26KB
SHA256 c6767c66c5cad4b818031b6362e9c1d952ad52e134fa4ce5493ce8cef58377eb
MD5 356e01678c2ad6c46262bc0daa1335a6
SHA1 5bb7be4c921110895551595a6f9a08e8a888aaca
SHA512 a2614274305f38d4ce6d2b89586a28da1f95780b99fe5ac642806b905430bb40121771a54d1e42df26d1810e815aa9edbe1b7ab32f93832176092084d2c87e07
SSDEEP 384:FiFzQkUSvw4sNn8TUNTUlIlwkRonjcGp5u8i0+aUgH7vBE+/IIln:MFd/iwglRooUkCUgH75E+/Lx
TLSH
T196C217F258D7993AD9AE4B53A33D3E039D7CC157F6849A90BB89561CCC8A0BFD306901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef7ecfb1-d88a-4c8f-a997-40b6f8cbeaf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ef7ecfb1-d88a-4c8f-a997-40b6f8cbeaf7.tmp
Size 105KB
SHA256 73d0e97f18eabd66ced5f78af8d0ee3a36d197f120279f6fe22862877514d939
MD5 48ffe64f366166704c21161efe0b504f
SHA1 a6403dde2edbd6b341ad301811396e7d3aea1af5
SHA512 ad78beb367abbdbb0a58e28566138180a03a9826f30f2dc412a05e0ca179742f6e123202adf44a50da1f4b71145ff6cb0cde66f326d4e9b116ce56b2281ea253
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

16dca707-dbee-494c-8004-5fbaac87ebfc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16dca707-dbee-494c-8004-5fbaac87ebfc.tmp
Size 10KB
SHA256 9e37b42742110b25a40682802d943e88b6b233207c9ba37e6b9c749e7912f6b6
MD5 571518f0a35def243af6c70cb93047ed
SHA1 831f001a9027a2cd1c7d333925e9afd914d9fe18
SHA512 e92582a764567393d788e7a15c44c3126c4a2d8e79f809155e57fd6f901b2178f2590efad7901dfd43c8cbac21db568e749c3f95b313c9f85570396d1d297e5f
SSDEEP 192:sxZbiRpWi/fFspH88PIdp6l3HW6+WN9QHXYaptZOIg5Qc8J:sxZbiyi/fFspH88gYHbyX0hg
TLSH
T16432C855AE28A97B9CC7D30DBB55BF43E6F9503291D01E48AAFD861C08E7ACD124740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dd0b568-cb29-4412-98d3-2ac077e53f32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1dd0b568-cb29-4412-98d3-2ac077e53f32.tmp
Size 27KB
SHA256 0a283fda5f54f424d59c40ab11a30df93836d152313e299279cd89f00a47b670
MD5 7d0fafa359d5f1f1bb529ec48a029157
SHA1 b05ba5c079d5480eee698e91d18196d382b586e0
SHA512 25e4aef9a360f50c660382c48031d69b3b528619f3166cd28230db73ca553d5670c6cd8ac7c8f10a7e5d692649e389c02883a2735ac0f7532af3394640952e94
SSDEEP 768:DoyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH38ro5ZoX:DoyQRbrWvvlpZu1jaXKLf33n5ZoX
TLSH
T18CC2FA2B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21ad804f-8b41-4da0-8d06-33f5319f5557.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21ad804f-8b41-4da0-8d06-33f5319f5557.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

402d0ba0-b186-4de9-be74-4fb4b72e523e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\402d0ba0-b186-4de9-be74-4fb4b72e523e.tmp
Size 10KB
SHA256 b9d9392bdae73e31fcd271a625c37a47efa66ab5e80ba2650bc056c5987c91ec
MD5 354cbe0de73fd822aaf26d00f24595f0
SHA1 14d1504b89e70d08222e0db87a510386988469e1
SHA512 37d244a06db8e45dd1c6b23d572d1888395fdd0f48edc6208980e69dc4984a691b0a62969a580c8d49eac2cd53a6b6d26294827e6f13f797a453efdefc7b4628
SSDEEP 192:sxZbiRpWi/fFspH88PIdpol3HW6+WN9QHXYaFqZOIg5Qc8J:sxZbiyi/fFspH88guHbyXJhg
TLSH
T18732E856AD38A97B9CC7D30DBB15BF53E6F9503291901E48AAFD861C08E7BCE124740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57ef3170-afcf-427e-bec7-35e2cd8e1c86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\57ef3170-afcf-427e-bec7-35e2cd8e1c86.tmp
Size 10KB
SHA256 c36fae549686b0765d95c7f07d1005e80902df8c1f0228501c3a48ae904266db
MD5 ee6d5f5088a897de3d29b3e9da03e5c0
SHA1 56b9768b5a1c819e10233b9e789a5fd1850ed0ec
SHA512 03c6c9a322e4b1aedb60d46462ad95f9ebc3e0bbb5f0a610a0e4dcff75d593ee597392b54d900d7325aaeb9fd2437c46fa824d6473ea5caff7a10231c4038cd5
SSDEEP 192:sxZbiRpWi/fFsxHG8PIdp6l3HW6+WN9s7/YadnZOIg/c8J:sxZbiyi/fFsxHG8gYHb2/akg
TLSH
T15622C8566E28A97B8CC7D30DBB55BF53E6F9503291D01E48EAFD861C08E7ACD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c28f4d3b8aaadab104c85c19391359da4607c82e826f7aa0ab4051683a60fdcd
MD5 fd39c3e8248a10683321dd4ed873a41b
SHA1 835b2d4e79cee197405aa695b42204ad2e89f8d3
SHA512 c014e9c2d938b546ccb6477c0bcced7b97cdb341e4891b5b34d34315774cd38a710530fb9a23fc2c2e18fba74a6dfa81c5b8c244f69df06ad86dbc64ca25fb14
TLSH
T171616178B8FCC4D5F7D8447CDBD52A8736BCEA829C979EF201A0DB786D8AF101154056
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2911cb9c36c6fee95de70392c1c0e6c85925579044c025d9b6bd504ab66768de
MD5 52b60eb6381d978db60c93405d17206d
SHA1 368dab6c106d7c0590bda8747de8e1a66e89608a
SHA512 cfa21a0a3a630269d85dd8a3432dcf894c1ba45d03d65230376df7388e376eae0f15e9d270048ace3dc592f8ff44b37908f497be07d332824dcc08cc55e660d9
TLSH
T1E4617078B8FCC4D0F7D8443CCBD52A8A36BCEA829C979EF201A0DB78AD8AF101054046
MD5 SHA1 SHA512 TLSH

Submit Download

0c79646f-5451-406f-aeab-e17acbd25253.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0c79646f-5451-406f-aeab-e17acbd25253.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4cbed9cc-8902-4ac9-97d9-ff5123e7f31e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4cbed9cc-8902-4ac9-97d9-ff5123e7f31e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

65a5ee3b-6e27-40c9-bd7e-8e57b1dbd277.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65a5ee3b-6e27-40c9-bd7e-8e57b1dbd277.tmp
Size 2KB
SHA256 88c7e4b74d43331dc345049cf758f74482f55b45e30537206c147abdfdfd4f46
MD5 4d434db7127c9af1619c18b42ccd2479
SHA1 f62abe6faeffa5cf27a651db52fed4226d2d2a90
SHA512 39cc74ceab394b84113595f46e5924baca335a4b70b421c629ca391966f3543ea793ed68877fe8705752dceb6f74536ca75436a7b394bdfb86c8779742e56357
TLSH
T1E151BFF2C2D4452E9B1246F0AA18BD27CF590919935C3DAE85E8EF57B3E2431D24198E
MD5 SHA1 SHA512 TLSH

Submit Download

6ae3c018-3af7-494e-a38f-7cfce0484f9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ae3c018-3af7-494e-a38f-7cfce0484f9a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 522d3b9cc39053c2cc7a0b26d105688299cf05dec9042f10ebc34fb3f4e33f11
MD5 2d187d1a80910cae1c4045cf1d65b5d4
SHA1 b094948bdf7953aa3c5cbc9760023141c34e1f4d
SHA512 3ae41cf7d0e6011056cea2b0a6ed1f2829c314b317b680a65cb4e3e22f5f2d945bd59037e3d993a89866a80fb9ff567f28b6d86399204e90ee83784d98e58083
SSDEEP 48:K0hwdR7/DcbvaHISpcK9J1jcxBMY6LBByLtMBdvbfAbzGTISVAK9V13AxFQYWX3Q:K8S4K7S6aaoKnK47WKUIml
TLSH
T15B91210171BB061039BD294C9575876B528235F33428EA3FBBBCA4B28F6AE140DFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8ac01f8-4f99-4a22-bd15-58b596b2bf8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8ac01f8-4f99-4a22-bd15-58b596b2bf8b.tmp
Size 10KB
SHA256 5f6de4dbb4a313fcc6e9d71fab66df1e0d1e04b16daaf2b49d18d03da41479c9
MD5 93ca8884dcd6f52d833a8c70f5576ff7
SHA1 d9551833914e3bd46f9e19dfc75ebb8fb38269cd
SHA512 eda7bd89ced0ec33ae53ac0b264d83c21c5c87fb0be033bc13ca2f096f1650f36f75a0637617c089b4849fdb6388c272a07cf4be6e17f1fe9066fe2b86435b7d
SSDEEP 192:sxZbiRpWi/fFspHG8PIdp6l3HW6+WN9QHXYaxnZOIg5Oc8J:sxZbiyi/fFspHG8gYHbyXWrg
TLSH
T1CC22B755AE28A57B8CC7D309BB55BF53D6F9503291D01E48AAFD861C08E7ACD124740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e91e8572-6fc1-4134-b2b9-c6d30d2fc136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e91e8572-6fc1-4134-b2b9-c6d30d2fc136.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

42df549e-a22b-49e0-a6aa-ccf6f69e5a4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\42df549e-a22b-49e0-a6aa-ccf6f69e5a4f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac29d6ea28aeb02f9ec32450933f291253c56d661a7c28a85adc30fb9b4a3f30
MD5 e1652041ffba12cf68573e090f0ccc6d
SHA1 9dc1c94cd152ef6b8568e2b778569a065b49d751
SHA512 1a6ebadebcfd3f8f3247613c8ed91dc7429b443e5dfe22d021cb7cf84b253a3dcd74f21bcf1c4792c079c8aee95f9eee8c6ccb9ef9ca613a8062123516d36e90
SSDEEP 384:2QkUSvHsNdwkRonj+Gp5u8i0+atgH7vBE+/IIln:WH8RoaUkCtgH75E+/Lx
TLSH
T1C5827C32B8686D6B9DB39660F10A3613EE74816BD7C85F84DCDE672D01DE5DC230BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2467df3-a752-446a-b99e-942539c832e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d2467df3-a752-446a-b99e-942539c832e3.tmp
Size 8KB
SHA256 e6e80a7968823ab18a2cafd1801448cc7ade5f722728e69cce4282c592d6ac7d
MD5 833a76d83f4faf164b3ea2b4eb9e55f6
SHA1 c508386f01bdde86d4e4db7ba086b87b91561c99
SHA512 a17d820788c7f2c2efc7116cd1acf9ca4cd6e3ceafff4db6d21dd682d2caf4bda2acdcf686ed3d52bc5db4f3237d3a1f134bdbb76045f24a7bd03c7e3a296744
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop5amDUoBfPGxvw45RxmJm78lFIxCYbm:SONo6iDCQmiUytUcHq5u88PAgSqJaqU6
TLSH
T16002F939AC787CBB9EB3AE15B54737179EA4116BE6945B84DAE8162D00D768C1303823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d61eed81-7b37-42ce-928d-5dcdc326267b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d61eed81-7b37-42ce-928d-5dcdc326267b.tmp
Size 8KB
SHA256 ab853c69d4b1240434a67f4070a4d57346b6bff2d2ef28ef1774f3f156213d31
MD5 c6b492bf0b1f1e44654895c625dfe0c2
SHA1 7bb4b272d8adfdfc33d4902d8a5ee5d0ef68f31f
SHA512 df029888d42f5027bee34ee2a8ecafbe8415f6cd09a82aab370be1cfcf7d8d030cd33d4347b41e938f8dcbf9b0bc8dbcb13777965ba75188d14829cad5a52c97
SSDEEP 192:NONA6iDCQmiUyRUcSq5u88PA9+aAuZ0qiU6:NONA6LGSq5u8i0+a3gU6
TLSH
T17D123B36B8787C6BADA39961F44736239EA4026BD7886F84D9DC271C05EF59C1307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d669020-fd0e-4a94-9add-7b4027096e8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d669020-fd0e-4a94-9add-7b4027096e8b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d68d61e622fde7c9f5fba07f997567cf9927f30280e2487a12648851729565ea
MD5 5ec1abb5492d0ae5615ee868b273fdeb
SHA1 f33b9aa4a14e90da79de6386036114011052c6ab
SHA512 431dbbb3eda3614075512ef19c06ce46e8976e92604713f8b7ba0fb5bea1218e45e496a8391a258850f14202181fac9a2b52f784d844a205e9da9f548dd03fe8
TLSH
T12941195CA6E91108B3B7AF569BF7686D087EB9772F16D45D10100E4F0A22B40DC62B33
MD5 SHA1 SHA512 TLSH

Submit Download