hxxps://fc-calendar[.]webstaff-8c3[.]workers[.]dev/encounter-night/microsoft?utm_source=FC+%7C+Active&utm_campaign=31349f887d-EMAIL_CAMPAIGN_2026_11_09_06_54_COPY_01&utm_medium=email&utm_term=0_-577387b06f-452786846&mc_cid=31349f887d&mc_eid=UNIQID

Analysis

user interaction
yes
max time kernel
149s
max time network
122s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/11/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fc-calendar.webstaff-8c3.workers.dev/encounter-night/microsoft?utm_source=FC+%7C+Active&utm_campaign=31349f887d-EMAIL_CAMPAIGN_2026_11_09_06_54_COPY_01&utm_medium=email&utm_term=0_-577387b06f-452786846&mc_cid=31349f887d&mc_eid=UNIQID
Sample261110-e2bpmsyyhw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3400	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{2A432D72-12F1-4E52-A534-0703D744C7BA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3300	692	msedge.exe	80
PID 692 wrote to memory of 3400	692	msedge.exe	81
PID 692 wrote to memory of 3772	692	msedge.exe	83
PID 692 wrote to memory of 3772	692	msedge.exe	83
PID 692 wrote to memory of 3152	692	msedge.exe	82
PID 692 wrote to memory of 3152	692	msedge.exe	82
PID 692 wrote to memory of 3152	692	msedge.exe	82
PID 692 wrote to memory of 1272	692	msedge.exe	85
PID 692 wrote to memory of 1272	692	msedge.exe	85
PID 692 wrote to memory of 1272	692	msedge.exe	85
PID 692 wrote to memory of 1860	692	msedge.exe	84
PID 692 wrote to memory of 1860	692	msedge.exe	84
PID 692 wrote to memory of 1860	692	msedge.exe	84
PID 692 wrote to memory of 4796	692	msedge.exe	88
PID 692 wrote to memory of 5720	692	msedge.exe	89
PID 692 wrote to memory of 4796	692	msedge.exe	88
PID 692 wrote to memory of 5720	692	msedge.exe	89
PID 692 wrote to memory of 1916	692	msedge.exe	90
PID 692 wrote to memory of 2476	692	msedge.exe	92
PID 1916 wrote to memory of 4028	1916	msedge.exe	93
PID 692 wrote to memory of 2540	692	msedge.exe	96
PID 692 wrote to memory of 1804	692	msedge.exe	97
PID 692 wrote to memory of 4704	692	msedge.exe	98
PID 692 wrote to memory of 844	692	msedge.exe	99
PID 692 wrote to memory of 844	692	msedge.exe	99
PID 692 wrote to memory of 2180	692	msedge.exe	100
PID 692 wrote to memory of 2180	692	msedge.exe	100
PID 692 wrote to memory of 3136	692	msedge.exe	102
PID 692 wrote to memory of 3136	692	msedge.exe	102
PID 692 wrote to memory of 1764	692	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fc-calendar.webstaff-8c3.workers.dev/encounter-night/microsoft?utm_source=FC+%7C+Active&utm_campaign=31349f887d-EMAIL_CAMPAIGN_2026_11_09_06_54_COPY_01&utm_medium=email&utm_term=0_-577387b06f-452786846&mc_cid=31349f887d&mc_eid=UNIQID
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb92b2c188,0x7ffb92b2c194,0x7ffb92b2c1a0
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,54850296517262722,2620652379471851743,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,10186900466961861238,17349394896923914679,262144 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,12898361077574068953,11868022167039422287,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,6401764533361563734,11061441531006078991,2097152 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,9730128239000376032,15650338534837390302,2097152 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7830295368346049922,1067878447206096787,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,12378411955503221877,5477113787216385138,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,8537878110427271183,6097703449705220706,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2391128418639253733,17888500603971407084,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2391128418639253733,17888500603971407084,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10043707295776863192,3671198562100935587,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15984273515090264508,8258266407323433114,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,700683759823975054,6986985988664816559,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,1233326743998298782,9515404388388654794,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,535513436098901921,14848448275306181173,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,4303389626388873063,3865954174082221533,524288 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,3909701738052817709,9968749275265168541,262144 --field-trial-handle=2068,i,4196185302512087666,3390757086773896239,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24cbc4f8-549b-4c15-8b34-f8febd4efe3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24cbc4f8-549b-4c15-8b34-f8febd4efe3f.tmp
Size 25KB
SHA256 5e4ced351fae83eec94a85d3066a542d880a7e77171fcfa254e3d3ee2abca398
MD5 5d36d97764483dac58cf753fedcb2061
SHA1 80e572663d80813f3d0b1e394ebb2ac0896addab
SHA512 b0c2dd7cbeebc14924cc8531400cffdae7d8f4870d6b9e1e926bee4e3351b50960b16d917a96e8628c0c487bc6ea748bbd404483bedba4cda9d0d5df7b0ec0b6
SSDEEP 384:nLiFiZcIS38N58TUNTUlIR6wqIKNbzWfg9Anf119Eiqf78zak6megL/7IzQoG:mFQS3awgdApx9WiixzakVV
TLSH
T13DC24A32DCA4C9B7ECEA8E95AB4A7607DEF04153989C9AD4E4D85D1D10E71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f944c41-58ce-49cc-9765-31b7d12853ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f944c41-58ce-49cc-9765-31b7d12853ee.tmp
Size 26KB
SHA256 5eed9160c10c48f37769ccd334b33e18a67d809bf971e48e3070932728a2c36a
MD5 4cfe1ad66fed43d4db2d1400e2aecab1
SHA1 32c8afeef19fd30b050153f608e5e5d2f620b90d
SHA512 b065819900525d0d7e391331863b8d341c2141597c3a61013330f61c8a70f215fd628c41659cc659e8a5247d87b11b4cd2412a4d29b105125904ebababb3f588
SSDEEP 384:n1iFiZcI638NF8TUNTUlIxBwqQFebzWfg9Anf119Eiqf78Ia7O6R2FeorgL/7Izx:8FQ63qwgwfex9WiixIa7TRmJ
TLSH
T1D8C25C36ECA4C9A7FCEA8ED69B4E7607DEF04153849C9AD4E8D86D1D00DB59D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7795a4eb-c65f-49c2-bd1d-e8e2fee15ee8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7795a4eb-c65f-49c2-bd1d-e8e2fee15ee8.tmp
Size 32KB
SHA256 a7e70c02332aa6a98abf7b5ca204702d863b08f19c1e1ffaf027701199552c95
MD5 ab75470087733a8f007f456c30b04942
SHA1 903fd75f7c5f80dffc6c92cd756bb0b2b3590971
SHA512 c12ba7afd30cb5105f93d46102e4b58453124b1e815a045549bbfbeb98a9d03752616ea0f08bab1a303dbcdb61830fafe06129357c78a1d9af8c088de05c7541
SSDEEP 384:n3iFzQkUSvk38N58TUNTUlIR6wquaNbzWfg9Anf119Eiqf78lavaTZcubtugL/73:yFdk3awgdGpx9WiixlavaTZccbLZ
TLSH
T162E2B1F598D78977E8AE4B93973D2E0299FCC113B8884694B7C85C1CCC961BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

42012ac3-ddbf-45db-92f6-3a3ee4f342c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42012ac3-ddbf-45db-92f6-3a3ee4f342c8.tmp
Size 12KB
SHA256 6abdfcd8f35c351693f9e5365301fb0844d2f58f0c0d2ca39ce2fc9f5d3afaac
MD5 c57058b2c7b5f38ed1893280691a2e26
SHA1 f6d9a0d2d9da2d2dcea1209356a13ca5aa39df59
SHA512 0317f7dd1793e835a61bed506fdb72b80f34ab831dede83b75c02262a67bf2adbbc0e102e0e7e8641d477c7cedbf74b50bf1a41b3b5492d284e1d53fd9bd8335
SSDEEP 192:sxZCR2F+/fDsQMqxzodp/F/W6+WNJ4JXY0Y7evQSIg5HkgJ:sxZCa+/fDsQML9/bOX5Ga6E
TLSH
T14842D9556D68B93B9CD7E209FE19BF53E2F95032A0911E48A6FC8E1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6326f107-74e1-44ae-a0aa-3a10707a79ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6326f107-74e1-44ae-a0aa-3a10707a79ae.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7719cb10-9976-47fd-aab2-ad898dc2ca1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7719cb10-9976-47fd-aab2-ad898dc2ca1d.tmp
Size 11KB
SHA256 f143d96a56d3369637cebdd5407108b13b1c74670549b31507b5e723eff59466
MD5 89c0652ecbabbce3c60e0fb650a0af2e
SHA1 ad8523d5980df4033eff383b37bc28e80860686d
SHA512 d93fc94e48545c585ffd6a51a3b4a13e2341819f75b974d87f7948580a5e4dbff3959883839a6fd554de0c12af262420a9d8d11f9fe8e1c40626981dd1512856
SSDEEP 192:sxZCR2F+/fDs6Mqxzodp/F/W6+WNJJrNj/Y0YPuevQSIgjgJ:sxZCa+/fDs6ML9/bbRj/5yuajE
TLSH
T16C42C8556D28B93B8CD7E219FE19BF53E2F95032A0911E48A6FC8E1C15E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 62524398b4e41c81d37f1b4a73e24ba63013292af4e210799b19e5741bfbdeb2
MD5 356a45d9d00d455313508f13309fb338
SHA1 a90f72e87a6f0c414464fbe6c12b4341f9d578ae
SHA512 6d152c028f7b991cd1f366b2de85ee7743d7b9adb3ce33faa856f7067fd1abd9b3698988018246e809f11e13741af283c5fa6d4aa34fd6269f18fd4c68c97a1a
TLSH
T150E026F426C8D22EE31875870BB8538C9A80375AD7C069DE2748CCD87645C40F7E2E90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 20c89edf250809c7976dada3ad1a61fb07dc7e13e590be44e3aaa3ba66ec3f97
MD5 4631e59ee15da4a6b9a7e8cffe022711
SHA1 a6365e9f67db8e8062a7920a8790dd7493cdf906
SHA512 8c384a4f87396684c7ce5452953aa0086e3f4f3af107246f179f4cb4f79cb2619fdff97c71dd3d71a3341340d55a7617e24c53740d430b5523d4b45e20801d22
TLSH
T136E020E414C4C73DD344654702B8570C81802A5A93C06DDD2B84C8CC7495194E2D3D90
MD5 SHA1 SHA512 TLSH

Submit Download

e865a6e7-8b0b-4d3e-a6fc-68486b3754fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e865a6e7-8b0b-4d3e-a6fc-68486b3754fa.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

19315405-e0e1-41cc-93cc-e49cb840d014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\19315405-e0e1-41cc-93cc-e49cb840d014.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4420cd0d-00ef-4560-b38d-10a720ff5f98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4420cd0d-00ef-4560-b38d-10a720ff5f98.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

67802600-9f85-4c29-8e9a-0ff46e5da948.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67802600-9f85-4c29-8e9a-0ff46e5da948.tmp
Size 1KB
SHA256 7ae5b7a7527f84ec92a3d2104fb1a7fd311826df9af4c0f302b57669046b0c8d
MD5 08d5a8e2b0e765d75f3f7efa0b619368
SHA1 a1f36c800e6db9394a655506c14a345723fa1277
SHA512 19c07418da46af0239b71bb19674a794a7a2cc3150316f6ac6e4564551a8337fa93a69e064cbb57f8441f45be3ff7e301e55985abfb09a7469cdf716f9c8ee6b
TLSH
T1F441E0F7C6F4862E89115AF0AB14BE2FCF2E0515431C3D9985E4AF2B83E2071E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 212228b5f3fa86e7b8a88cd542cd0beb02d3ac4c2585408f16ef8f26b4293192
MD5 0e4983e36500012c14ae08b189855678
SHA1 7aebbf4fae9d6953f6963c0b0741345617b65c7a
SHA512 b60365e4585e70fc537f120d0b24fa7c4fce521a023c12047df79db6077956f1075ba4ca39eaf1c7b5c0a8bc657ec259ba90e32e8bce438d246a55420951a143
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21WY:ir/+SvIrlfrljh9DdgslV9rnWVFp
TLSH
T1A2B2641571BA12453CBE291881B5972F128235B33119EA2F7FFD44A68E6BE085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a4105087-9922-4374-8572-04a3e16aab09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4105087-9922-4374-8572-04a3e16aab09.tmp
Size 414B
SHA256 613bfa2cc56b602da70ba1ee40eb19917490cf81d11db81d2576a97227912249
MD5 ff7c446fc64778c56044b74defef77ba
SHA1 073ce0965d07eb73b692fc2c807daa558c82dee4
SHA512 d174ad58e626c467d2218c3a4607ca003015da0922a11063c2946541d2e4722c2ecba1faf9d966d979591087a89c52303201effdf8b6bf490a7f8fdbd9cf133e
TLSH
T1F5E02BBAC921FC271EFC1B19A1541785E75123AB2A50451F3A3C810E8FB1727029EC5C
MD5 SHA1 SHA512 TLSH

Submit Download

baeb0a90-5970-4157-8c93-2a57bbdc8b94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\baeb0a90-5970-4157-8c93-2a57bbdc8b94.tmp
Size 12KB
SHA256 f1c13d3a02298d2cfa86cfdadb93ed3854a96b36e56375b487f10b3199f120ed
MD5 f2db9c4217bb9fd5026059d045e6ce22
SHA1 ce27d2284055eeb30fc77262bca819b1cf19bc63
SHA512 a97f3972f273a6d77635b17c2bfbbb3b76689a4bbe7193d8ae6df2ba62b366022507cfeae94ad68b41e970c12e8576290972276ae2899211e912806c904d17fb
SSDEEP 192:sxZCR2F+/fDsQuqxzodp/F/W6+WNJ4JXY0Y7BvQSIg5HkgJ:sxZCa+/fDsQuL9/bOX5Gj6E
TLSH
T1D942C9556D68793B9CD7E209FE19BF93E2F95032A0811E48A6FC8E1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd1cf49c-6647-4167-a034-01099be9619e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd1cf49c-6647-4167-a034-01099be9619e.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b756ad50bd33c33e3c0b9381a30edf8b13f0577fa2d1b70b0be475ae396ef877
MD5 e4c6e6749bd8afb21aa6537ae12b654e
SHA1 6d542aac6bdcfb3aa68df263b8920cecb7b29263
SHA512 34150ab2d3c448f6d2f477cdbdf4a2a64e5099b8844770f5838c888d7145fa73d13b845af79fff423744ca83866a5b2db74fb88abf71da4b3eb33a00eda599e0
SSDEEP 384:nUiFiZcI638NC8TUNTUlIxBwqB5PgbzWfg9Anf119EoY7O6R2FeorgL/7IzPoS:vFQ63dwgwKPEx9WioY7TRmJ
TLSH
T15EC24B36ECA4C9BBECFA8EDAA74E7A07DEE00153849C8AD4D9D85D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b525ad38-cb0a-4ccf-b41a-13ee2462ed12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b525ad38-cb0a-4ccf-b41a-13ee2462ed12.tmp
Size 27KB
SHA256 0c498e46ae62c2aea05fe581a880a7711004dd023e1ce8f557af276ef1cb313f
MD5 e36172e0ef5ea3c02f903549a2686572
SHA1 a3ee96841c34b9487833c0237fe738e7886d0d88
SHA512 48e3dd0873132a4ef9d224a0f76b320fa23c0aa26063f4627debceb90f8ddefaaef26f17c60af432c47146bb3bfcdb48f5400a4f70450a3b6d3aeabe37bba262
SSDEEP 384:nLiFzQkUSvF38N58TUNTUlIR6wquKNbzWfg9Anf119Eiqf78pavaTZcubtugL/73:mFdF3awgdmpx9WiixpavaTZccbLZ
TLSH
T177C25B36ECA4CDA7EDEA4ED5A74E3607DEE04153C89C4AD8E9D89C6C00DB19D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6cfaebc-4d1b-44a1-8be8-b7baffb02ebb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6cfaebc-4d1b-44a1-8be8-b7baffb02ebb.tmp
Size 27KB
SHA256 1a9faaca01f8178db295e8909ddce963879a70bb7d7c861ece6fb8ec20512101
MD5 bd36a8344f252952fc02fec90956c21c
SHA1 10aafbbf66a6b1e5b9f97dc34badcbf525b86723
SHA512 64267d964b8efdd7a7ddabc8edc12fd020c5fd1b01e0a0ee53d3578d49469fb136f27d44c28887f36ad0e51e0f1e41c9d0ac15bcfd795eef73f938b177534090
SSDEEP 384:n2iFzQkUSvF38N58TUNTUlIR6wquKNbzWfg9Anf119Eiqf78pavaTZcubtugL/73:dFdF3awgdmpx9WiixpavaTZccbLZ
TLSH
T1F7C25B36ECA4CDA7EDEA4ED5A74E3607DEE04153C89C4AD8E9D8AC6C00DB19D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-196-0x0000026467680000-0x0000026468680000-memory.dmp

Download