hxxps://witnessai[.]sharefile[.]com/f/fob293d1-4f33-4a96-a1a4-601b93d8b46b?a=178b41b3e1bee648

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://witnessai.sharefile.com/f/fob293d1-4f33-4a96-a1a4-601b93d8b46b?a=178b41b3e1bee648
Sample261102-s8m8xaxt9m

Score

6^/10

discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 18 IoCs

phishing

Phishing

T1566

flow	ioc
7	witnessai.sharefile.com
18	witnessai.sharefile.com
93	sf-assets.sharefile.com
94	sf-assets.sharefile.com
50	witnessai.sharefile.com
75	piletfeed-cdn.sharefile.io
88	witnessai.sharefile.com
96	sf-assets.sharefile.com
24	witnessai.sharefile.com
68	piletfeed-cdn.sharefile.io
72	piletfeed-cdn.sharefile.io
74	piletfeed-cdn.sharefile.io
8	witnessai.sharefile.com
11	witnessai.sharefile.com
69	piletfeed-cdn.sharefile.io
76	piletfeed-cdn.sharefile.io
84	piletfeed-cdn.sharefile.io
95	sf-assets.sharefile.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{D4F674DA-0251-4DBE-A720-264A3F6629A0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
844	msedge.exe
844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4788	1072	msedge.exe	86
PID 1072 wrote to memory of 3992	1072	msedge.exe	88
PID 1072 wrote to memory of 4280	1072	msedge.exe	87
PID 1072 wrote to memory of 3992	1072	msedge.exe	88
PID 1072 wrote to memory of 3992	1072	msedge.exe	88
PID 1072 wrote to memory of 4156	1072	msedge.exe	89
PID 1072 wrote to memory of 4156	1072	msedge.exe	89
PID 1072 wrote to memory of 1952	1072	msedge.exe	91
PID 1072 wrote to memory of 1952	1072	msedge.exe	91
PID 1072 wrote to memory of 1952	1072	msedge.exe	91
PID 1072 wrote to memory of 1008	1072	msedge.exe	92
PID 1072 wrote to memory of 1008	1072	msedge.exe	92
PID 1072 wrote to memory of 1008	1072	msedge.exe	92
PID 1072 wrote to memory of 1660	1072	msedge.exe	93
PID 1072 wrote to memory of 1660	1072	msedge.exe	93
PID 1072 wrote to memory of 1660	1072	msedge.exe	93
PID 1072 wrote to memory of 1460	1072	msedge.exe	94
PID 1072 wrote to memory of 1460	1072	msedge.exe	94
PID 1072 wrote to memory of 1460	1072	msedge.exe	94
PID 1072 wrote to memory of 2700	1072	msedge.exe	98
PID 1072 wrote to memory of 5076	1072	msedge.exe	99
PID 1072 wrote to memory of 2700	1072	msedge.exe	98
PID 1072 wrote to memory of 5076	1072	msedge.exe	99
PID 1072 wrote to memory of 2988	1072	msedge.exe	103
PID 1072 wrote to memory of 748	1072	msedge.exe	104
PID 1072 wrote to memory of 748	1072	msedge.exe	104
PID 1072 wrote to memory of 748	1072	msedge.exe	104
PID 1072 wrote to memory of 4004	1072	msedge.exe	107
PID 1072 wrote to memory of 4004	1072	msedge.exe	107
PID 1072 wrote to memory of 4004	1072	msedge.exe	107
PID 1072 wrote to memory of 3784	1072	msedge.exe	112
PID 1072 wrote to memory of 5104	1072	msedge.exe	113
PID 1072 wrote to memory of 1048	1072	msedge.exe	114
PID 1072 wrote to memory of 2056	1072	msedge.exe	116
PID 1072 wrote to memory of 2056	1072	msedge.exe	116
PID 1072 wrote to memory of 844	1072	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://witnessai.sharefile.com/f/fob293d1-4f33-4a96-a1a4-601b93d8b46b?a=178b41b3e1bee648
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff872abc188,0x7ff872abc194,0x7ff872abc1a0
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,2981816902797113687,9309456497983705738,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,17503359373409135167,15054602018437125912,262144 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,6430501905292212438,4559513861576351829,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17114883731104171073,15039683381419593551,2097152 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,15380294631029439609,7554315430759202519,2097152 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,5976068468532411786,12947128061414101448,2097152 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,240959147406810657,9899392846460890119,2097152 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,12814137052501012909,5891100205997169882,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,15363528595605769128,16031196125396785712,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,16186852129973368092,17300197744592315681,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,16186852129973368092,17300197744592315681,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5996,i,18013279375671255107,9483043830573266526,2097152 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,1329130671969569315,15245114806044986251,2097152 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,686634551219167958,1934133275517142615,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7551159102707372109,17804476283553133041,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17662335802173520541,5048317280708252533,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,17020493636892694656,14259341985259838843,524288 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6280,i,4589134160744567085,10393175784620295087,262144 --field-trial-handle=2720,i,10745508011393358638,8073783704364559007,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

634b69ee-1458-4f82-9a73-036cc8703bf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\634b69ee-1458-4f82-9a73-036cc8703bf1.tmp
Size 26KB
SHA256 ec64675b9f05753975546c02fa4513ab273fb2e1c4e6fbf8a9d4c83e5a4c8870
MD5 e8f8fec30f6fcca5d01c7abd5e132c6b
SHA1 281b5c5b348e88cac254ffb119189176556ff7fa
SHA512 8aa6274610180e529fcf1b156d628a75e40cc3aca266e54640367bb177ee6586b88223758e4de64e480bbbc11277edbd3955699bc239971e29ed26ee0662d3c6
SSDEEP 384:XTiFzQkUSvJzsN98TUNTUlIl6UobhVoh//z8ExUXQwJ7H7vBEZXaIIlM:X+Fdpkwgm0/D8QwJ7H75EZXaLi
TLSH
T195C228F258D7983ADAAE5703A73D3E138EBCC067B5955A50BBC84A1CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69e01595-f4b1-4d63-8ec6-8b3cb4fe8e40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69e01595-f4b1-4d63-8ec6-8b3cb4fe8e40.tmp
Size 8KB
SHA256 b6ca2199c66d59d525e2a57e752ab6d3e9f24a4e4de72a26c0d71dc2645286d7
MD5 a3d89eb860c2917f9931630b65f6f48a
SHA1 aa3e74f2e1a9697f27e3e421212e2687529f241f
SHA512 1f209f143351ce915d58d2799d392f49966bc97457c49f262ac5ecf0353a7776c106232c03e48f9cda780bae2df5276d008b24064934886fd20d969a9ce02040
SSDEEP 192:IONO6JUCQmiUyhNhiYo//jjzorB6ywxW5XQKNxaqh7U6:IONO6++HYo//z8ExUXQwJ7U6
TLSH
T16A120B35B868BC6B6EE36554F44732239EA44037EB896F90DAEC2F2C02DB55C5346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

936d3199-5340-48c2-9e8a-7c0f071c7412.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\936d3199-5340-48c2-9e8a-7c0f071c7412.tmp
Size 18KB
SHA256 65f9870f0060117ef56c18f6bfbfd7fb877b0c0b6ba960ba9cb8a5f653af9aa8
MD5 1718cb0f47e4ee496f143df3a9e4c647
SHA1 7ff4aa04d9e02ad946692d58d20a058f24653fed
SHA512 d714ef5bfefedb4f1c086de2bcc1b6f45b08f7cc276eadbcb4e14e90e45b581bee718192fbdf8b7ac4c082b4648f9bdfd65430e0dff9f77b150b9609a0c50053
SSDEEP 384:aQkUSv0sNjzUobh4oh//z8ExUXQwJ7H7vBEZXaIIlM:C0j0/D8QwJ7H75EZXaLi
TLSH
T1B9827D76B868AC3B1EB3A154F14A36139EB4806BE6D91F50D9DD9B2C01CB2DC1347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

0b90223e-ad83-4ff2-a9a8-e2efd042b63f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b90223e-ad83-4ff2-a9a8-e2efd042b63f.tmp
Size 27KB
SHA256 ab962c60ad4a4127dbe62986ddf927c64153680060d8a0a7bf2050efff06daa8
MD5 7baf4bc04df92c605ce7627515b3eb3d
SHA1 475f594f8344bf5ea2542edc8830f2f24c6ca2d2
SHA512 8215a979e06b1dd7f95d6b8b0b90352354e2fd9726b56224f3f9ef90efbdbbb65f6064a9bc605b2b477bd0aa34ca25d4c345efa5c7a8d210245e9cb5393b023f
SSDEEP 768:l5Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/croqZ:l5Klm7QWvUYe0u1ja8/L/E/HqZ
TLSH
T195C20B3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b060e1a-f5a7-4a21-89a8-b986d7a5efbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b060e1a-f5a7-4a21-89a8-b986d7a5efbc.tmp
Size 10KB
SHA256 630fb0921188af5f08aaab9b2ae18b9b382003e044e7c46a0c6748b3ce00b2cf
MD5 f0713eb881076bd95ffb979334f4f6c8
SHA1 23fede6727f0c4f0f7bb615d08505327228fc64b
SHA512 e645439453adb1472fa97169b074e37a8db6ae03e187cd4f9ad40f50ae118a88a0dacf495075713a98346da094c8f4714ca61887e64a7723340498025da497da
SSDEEP 192:sxZQRgWq/f/s0S5Idp5YkfOKlTHW6+WN+0tY8K/Y36DGC8Ig59J:sxZQVq/f/s0SShHbY/XQh
TLSH
T1DA32C7926E38697B8CC7D219BE15BB17E2F9503290D10E44EBFD861C09E6BDD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cefd8a2-3a3d-437a-8163-3926ccd61d51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cefd8a2-3a3d-437a-8163-3926ccd61d51.tmp
Size 10KB
SHA256 b4774f56080ee7bf682d897f7db3705ca3545c028675322e0a26ff44be7f0b46
MD5 f21f713bacfa178cd7d3e0eaac0f9dde
SHA1 cbc92dd27219c0db49ab4051fc56677ef32419d5
SHA512 0c3d16aa8cf3c27fe38b3ef1b39733ad63f151119956f0252a1d0ea8e79d643ec84c7e863679da17d796180f9b9e0601e9e15ff7c2de295f0b0557380ef1919e
SSDEEP 192:sxZQRgWq/f/sAS5Idp5YkfOKlTHW6+WN+0tY8K/Y36UUC8Ig5fJ:sxZQVq/f/sASShHbY/Xbf
TLSH
T11832C6926E38797B8CC7D319BE15BB17E2F9503291D10E44EAFD861C09E6BDD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8367da6b-5223-417f-9102-3febfa055f40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8367da6b-5223-417f-9102-3febfa055f40.tmp
Size 11KB
SHA256 392bb56f07a4c2de12ee4723b8e57d5c190e1321bcb6bf06fa240ce444238b01
MD5 23a67a13ff1cc44814b9ab52c217184b
SHA1 ece1ccb3cea8a8852db7d5a468472c99182592b8
SHA512 39d210d86f95ce343f1be66ab626f87d6919bc29d396aa09c774e79f64b45d42d3bc551c456dace2addddfcd9f051d7567a6c83bf97e4411fefebeeaa015f924
SSDEEP 192:sxZQRgWq/f/s0S5IdpnYkfOKlTHW6+WN+0tY8K/Y36O5C8Ig59J:sxZQVq/f/s0SSnHbY/Xmh
TLSH
T14432C7936E38697B8CC7D219BE15BB17E2F9503291D10E44EBFD861C09E6BDD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 36KB
SHA256 87a8c06a966031596415b7d116bcdad5fc51e32b613b386491094a87a0e36714
MD5 167e1cf5fed6b58439cac0f8cbc8b112
SHA1 6257b8db5be9b64ac8df883bd15f93549bc5fd3a
SHA512 28e992a22b4a41647cf94719e23dc9be36b30875f59e3b6a0a35650edea5730c3991c14f14b46c150f95b21709b72952ac5e95dcc8fb65d29aea80d0a163bbd0
SSDEEP 768:zLsYNN1rtkD1cWVGbIdulBn74BsQ4zAc/U66K96Nb:UorM1DkI8974GQ4Fub
TLSH
T130F20196ACD768266C16CAFE6F70832B0AFF02507D611E1524137FB966D9430E0F1B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 2b57952773c9aa2ade28bce2b3a5f8d5ade026768af8dddba67749fb2c39b3da
MD5 19fd6cc3635585cfb2f7ff7926b73295
SHA1 7289080acd0ea89c24daf4c0a71fa1501abb23b0
SHA512 80864c14cea318ef349dd9ae1960a20a91609780104d532f6b677917e8ac232c49e9ae4ad252df4e411881caa465a8c7378b71f4e8f1a87f114e3dc10c8720fb
SSDEEP 96:yOsk1OvrBPn9+7LxNBOp1t2lcL5RJNOFI:TONPn9WXBOp1AclRiI
TLSH
T18EA16454FFD07864FBB83EB8FB9B9C83B6F353C086A7AD029154D8F4EA066A01460340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c8784d5795dc2847031c3ae0ff44091da5bc1d60d6bdf28a2864f4bf315c2137
MD5 a5c906455ce60badf9d9c013cdb7a449
SHA1 e6ec606fab1af813029db52adff5745ac69aa5c9
SHA512 f2566fd4a73cfd83e894040c607ecc5d7912a202e367fac4494a3a440e34f2ce30b88d42fe4a1107faad874084114c1c5d95b92f243a304602e6fd1caf10df9a
TLSH
T1A4618F50BFD078A1FBA87FB9DFE7048336B3A7C01AA7ED51A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

8620836d-d1da-48ef-a6b0-e22e590d7dd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8620836d-d1da-48ef-a6b0-e22e590d7dd8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4300633f-31b2-41d7-9918-d3d1cd142a90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4300633f-31b2-41d7-9918-d3d1cd142a90.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c036a509-649d-46ec-b7d6-06cf784fdea3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c036a509-649d-46ec-b7d6-06cf784fdea3.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f85a42be-1ed8-4b49-921b-37c8bbea6446.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f85a42be-1ed8-4b49-921b-37c8bbea6446.tmp
Size 4KB
SHA256 1bd95d045fc9d5eb99a19ff4084028be5ba210c05f3784f67af3f3b955370c0b
MD5 4b3ef28e9fecd4c2e2a10adc1770b932
SHA1 c4dac22ace18c79b18f32dcc4dfcf4b3b17cc919
SHA512 86e1d2d29b8ae9faca60a7cad35c60b3612d1e203baf08562d1fe73ccf95558b6c9b95519136621577ce4346ee2ad66946c88cceac564db687b72944908c2344
SSDEEP 96:DhOJpJ1dJ0hzBJSGJkJQJGqJlJVJnXGJmJMJGuJwJ5uxsuvBqwQ:DUHdw1AG6ecqLzRXGMmcu+3RwqT
TLSH
T11191CBF383E8956DDE1216F86A056D1BCF5C051A832C3D2689D0FE1B93E3832E11966F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c97ef7b6-2b58-423f-a5c7-dfda90106354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c97ef7b6-2b58-423f-a5c7-dfda90106354.tmp
Size 10KB
SHA256 89e7ea2b2ec3824994e4d55af3f2e4c34bcbee8b8f3887f7f1475ba7847c3892
MD5 bc79e1a2aca87d64262cba8ccf91227b
SHA1 98ce76be463cb1ef086669c1cbdfe31fc71b30a9
SHA512 cb5b6f2c3d39a4c34c105b30391cced299b24617ab1ba639848ce05861352acd235a7ddf4d51022cc182af23b62e139808b32f76be11b9b08083f99ea7d16fff
SSDEEP 192:sxZQRgWq/f/szS5Idp5YkfOKlTHW6+WN+0tY8K/Y36UUC8IgrJ:sxZQVq/f/szSShHbY/Xb9
TLSH
T1A922D6926E38697B8CC7D319BE15BB17E2F9503290D10E44EAFD861C09E6BDD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e419e2cf-0b2e-4aa0-a03e-973e3f11df0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e419e2cf-0b2e-4aa0-a03e-973e3f11df0e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87768124-d42b-4440-aacc-5785c7fdadfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\87768124-d42b-4440-aacc-5785c7fdadfa.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

cd85277b-25de-489a-afdf-00688b26fcc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd85277b-25de-489a-afdf-00688b26fcc6.tmp
Size 8KB
SHA256 57e53bca7006f4ef7d63c3af46dabe5c801a49fbcddff87a540bb7b38585a227
MD5 756ffd1b76a8e64573158194dc262946
SHA1 b130ed0cf9fac06ec69331b6bafc16f7c4f482c6
SHA512 4fdd7eeff5fd8b2ff3e31e724b44963f404a8108bd5027b8196f14545750e002efbf6be6e9eee01565fe2eb8d36d8b3f7221d76397cb079fe2d59bfab1bb0b20
SSDEEP 192:BONN6JUm0QmiUyhthiso//jjzorB6ywxWjBCtaU6:BONN6+mE/so//z8ExH0U6
TLSH
T12702D839BC687CBB9EF3AE45B44737139FA4107BA6951F80DAE81E2D01D725C1302D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4e58cd0-7647-43d4-9d64-fe0489cafaae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c4e58cd0-7647-43d4-9d64-fe0489cafaae.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff25d7d6-585d-4665-acad-8d23ba080a83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff25d7d6-585d-4665-acad-8d23ba080a83.tmp
Size 18KB
SHA256 fbdebfd439b5cb0081dcabf5c837b8a20fb88f6ae2f4025395d73c02a631448c
MD5 3d686d409eeb6ea8dd18f16c5ebd3482
SHA1 848203292534079fec25cb3ea7f2fdc1b3bbced7
SHA512 b9db0b84f9eac02d6154b95110eb56189c4f37da7334c9d844fb82f8cefd32e3d44afeff7de3328c46654f25669879a34b9e1485cae9ec9bfa04d2b189ceacf6
SSDEEP 384:f7QkUSv0sNj6Uobh4oh//z8ExUXQwJ7H7vBEZXaIIlM:f10u0/D8QwJ7H75EZXaLi
TLSH
T198827C76B868AC3B1EB3A154F14A3613DEB4806BE6D91F50D9DD9B2C01CB2DC2347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fea5f59a6fee24f0240f410437ec9989f042c8e3c40e7a4fe98576ec759e15d1
MD5 59fc4031f3080aee95ae65d4e0a898da
SHA1 c13a68ea4c2f8fe862cd8046a7c128ddbe141d63
SHA512 27297fca5ef2ef3d62bcd9c9c8445dad2d5ebcd769c67b958c98d556cf3988d887509c3ba8690dfac70589ba420bf8aba69fd8e46ed100afd817cc7b764d7fe5
TLSH
T18C410958B6ED1148B3777E569BF6A86E447B79772F0A905E10010D4F0A23A00C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download