f8612008bac1214b41111f3aff6efa3ec79c1f3abf0069f37fb4fc5b2fa9b5eb

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roundcubees/roundcubees/index.html
Size 255KB
Sample261110-gxmbpagy21
SHA256 f8612008bac1214b41111f3aff6efa3ec79c1f3abf0069f37fb4fc5b2fa9b5eb
MD5 e156929e65e704fcf964ba3c773d5042
SHA1 d03ce7a054b109fe1ae3c59fab3dc5d26f6cb49f
SHA512 6caa537b6893f1fc77363378ee045feb5d12c6b878b8d7739fe481deb8ae4d41c9a96409a0bf869cf4cf2ee4ea98bfd81696df31a766f8d3b8ab9e675938f48d
SSDEEP 6144:ErvWW6dRYB7cj2nkD92SeI/l3BzRidzFmGSJ5X:Er6d2A+XJC3FcwT5X
TLSH
T1154412BCAD217EF97F67C33A6AA33F806C1C9503CC6049D6D24B648E81DAD471A31A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{5E78756E-B4F4-4A87-A577-E8738CE1DE81}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4072	2660	msedge.exe	84
PID 2660 wrote to memory of 3964	2660	msedge.exe	85
PID 2660 wrote to memory of 4892	2660	msedge.exe	86
PID 2660 wrote to memory of 4892	2660	msedge.exe	86
PID 2660 wrote to memory of 4892	2660	msedge.exe	86
PID 2660 wrote to memory of 4476	2660	msedge.exe	87
PID 2660 wrote to memory of 4476	2660	msedge.exe	87
PID 2660 wrote to memory of 2648	2660	msedge.exe	89
PID 2660 wrote to memory of 2648	2660	msedge.exe	89
PID 2660 wrote to memory of 2648	2660	msedge.exe	89
PID 2660 wrote to memory of 3784	2660	msedge.exe	90
PID 2660 wrote to memory of 3784	2660	msedge.exe	90
PID 2660 wrote to memory of 3784	2660	msedge.exe	90
PID 2660 wrote to memory of 1500	2660	msedge.exe	91
PID 2660 wrote to memory of 1272	2660	msedge.exe	92
PID 2660 wrote to memory of 1500	2660	msedge.exe	91
PID 2660 wrote to memory of 1500	2660	msedge.exe	91
PID 2660 wrote to memory of 1272	2660	msedge.exe	92
PID 2660 wrote to memory of 1272	2660	msedge.exe	92
PID 2660 wrote to memory of 3500	2660	msedge.exe	95
PID 2660 wrote to memory of 3016	2660	msedge.exe	96
PID 2660 wrote to memory of 3500	2660	msedge.exe	95
PID 2660 wrote to memory of 3016	2660	msedge.exe	96
PID 2660 wrote to memory of 4664	2660	msedge.exe	99
PID 2660 wrote to memory of 4156	2660	msedge.exe	109
PID 2660 wrote to memory of 1808	2660	msedge.exe	110
PID 2660 wrote to memory of 536	2660	msedge.exe	111
PID 2660 wrote to memory of 4048	2660	msedge.exe	113
PID 2660 wrote to memory of 4048	2660	msedge.exe	113
PID 2660 wrote to memory of 816	2660	msedge.exe	114
PID 2660 wrote to memory of 816	2660	msedge.exe	114
PID 2660 wrote to memory of 4988	2660	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\roundcubees\roundcubees\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x248,0x7ffa9cb6c188,0x7ffa9cb6c194,0x7ffa9cb6c1a0
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6297275735442729022,1669174193318982187,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,2207488344441593072,6204141204169048897,262144 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,16964259755786724212,18145880338323319135,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,27501064702449562,2934617602191355238,2097152 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,3816967149237550031,10715636842683878418,2097152 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,12040249313250530877,1465907374954012506,2097152 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=1800,i,10800600769820717144,2072184911636667441,2097152 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,15154798356871832458,13776353753562054827,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12602680688093817123,9652770742441123856,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16980790812136406766,16242839280791816103,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16980790812136406766,16242839280791816103,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,11874241147635884294,11869449193335936911,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13209091353557634811,6565552291588500195,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,4495755594173349344,16785312300724455008,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,2842149154504381735,10672496512719039093,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9058915716935438783,898129914651386025,524288 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5204,i,7577944053801687257,7182795044435871316,262144 --field-trial-handle=2160,i,15756982529807663588,13165506874047487247,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

279723ff-3832-46f1-b7e4-86134d87fb28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\279723ff-3832-46f1-b7e4-86134d87fb28.tmp
Size 8KB
SHA256 9850f3df98be5a5d7c4ac01c4ddfb6f4681ef5be5602b3ea3d59daf8f37b5364
MD5 ae875ed6351a8213d5325c06194dbead
SHA1 7d764aad643f3875bd24e169cb66e8bb7e7fa7bc
SHA512 07f8707653e92c8d4f988c553550a0dca32b2e6ffd3d6a491f875f32e8581ffd9eedf8bf88ab83673e6976d880890eb946f07e8eb6a37b34401004ad6d62c7e5
SSDEEP 96:PqONkOQsjpfwDISp5ih/cIPURHl8h4otop5QsmDQbBfPGxvw45RxmJm78lFfxQpY:SONu6iDCQmiUyi4Hq5u88P4ASqyw1zU6
TLSH
T16102E839BC783C6BAEE3AD05B44777175F95116FE6942B84C9E8162D01D729C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29438b51-4a0f-45b6-a589-1af393eb306d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29438b51-4a0f-45b6-a589-1af393eb306d.tmp
Size 8KB
SHA256 17c75ee5a7b34b914507e3406088faf20426a7655364fa8f357c5a9224757818
MD5 9b55ef7b7e6963266b0a8f46ff2e6999
SHA1 205d9739f190111189c2a029bc34155d9a23c469
SHA512 3952b811ee9cbc29374538551276cda224720847012e4a1e50e6ed91f845ea095d8ceb74014c658203ff6c5c34992e86c5a08da4140c03fb3af84918e9560724
SSDEEP 192:NONv6iDRQmiUyL4Hq5u88P4tmethEuZyOqj8U6:NONv6SfHq5u8i4t1yv8U6
TLSH
T117120B3678687C7B7DA3A854B48736179EA54227E7887F84D5DC161C01EF2AC230B513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d577bd2-fe61-4705-abe3-28ee38e6c335.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8d577bd2-fe61-4705-abe3-28ee38e6c335.tmp
Size 105KB
SHA256 f177a9ca2ff22dbc463fdac60c9dddb266a340db1e1d3fae8f0d915baa7c0b70
MD5 3e0bcbe3e53357294b3c897458db4b90
SHA1 0d306ace9c82f16f6fa4f75eb52ad1c738a013ce
SHA512 488de48186b8b77ac8d4750db93a2b93bf0dfeea523717d10c7e0eef9902eb9ee2db3f0bd5edde32a4e252219ee3d7290532c43a320be0f9bd6d4bb0aca81964
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T17CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

392d9da4-2922-418a-bda6-891133e2d43e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\392d9da4-2922-418a-bda6-891133e2d43e.tmp
Size 27KB
SHA256 bd38240e76a087d104cee72b2bf39883ddeae362568e9d52f73c4e5a2e5dc4ba
MD5 966ca67808829a1c707b18cfa00c25a5
SHA1 f1f04a4d7ca117159f0da0dc4944c32d9e6adc00
SHA512 c87be69206a545ff5f2c1c24df47c2ac40063bfb9588282d4fba85228efbb9837d6d3a1cb9fdad0c1244c9a3ec64f0e6670a0e7e6592e36a2c2a117f5a8e3352
SSDEEP 768:JiyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3urozZ+2N:JiyQRbrWvvlpZu1jaXKLf33lzZ+2N
TLSH
T162C2FA2F640CCB7E4FC01E9DDC666F976EA802C766588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a1dae5f-9bba-4aa4-a254-8d107ffea741.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a1dae5f-9bba-4aa4-a254-8d107ffea741.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b993c81-f6e3-4635-b8a6-0d5600e27679.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b993c81-f6e3-4635-b8a6-0d5600e27679.tmp
Size 10KB
SHA256 0fba53773e57af4dd062bfc5543e61f34a29f9b626dd3deeb65489c9924d5418
MD5 e5ad7bad2b39079998201595effd1d7f
SHA1 2d9e42a8a9634ddaf0f1e841064f06fe46eb1afe
SHA512 a8f6e313b1bfce9a93ed16e40a94af860ad5d6d18975123468a52200eb95e99454abd1f765848cf42118d8b78a439001af746cb60466ce84d324930b240a48cd
SSDEEP 192:sxZMRkWI/flswamVIdpHeHW6+WNGYaE7aRIg5lJ:sxZMZI/flswamm+HbGDt
TLSH
T1B022D7526E28797BDCC7E21DBF15BF13E6FA503251901E48AAFC861C05E7ACD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6398b81e-b776-4dcc-86c8-f95b379b7c47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6398b81e-b776-4dcc-86c8-f95b379b7c47.tmp
Size 10KB
SHA256 ea36c0df1cef5fb1dc9d43b79536c740711a4a2e1c3b9cacbff49118dd043a52
MD5 8057d148e02b9bfed3529d2b981cbedc
SHA1 641f292ab72374d7648fed49fc3f084c8927e312
SHA512 97848b1000a8d6e3fff00c2c8e3b0e81db0773c9c0c52a5c8cabaa4874ce4b49983665074eebb0aa4b1dacd18aefe782132aa14a9f0b1a4800f61f1894be9b1f
SSDEEP 192:sxZMRkWI/flswamVIdpdeHW6+WNGYaUcaRIg5lJ:sxZMZI/flswammUHbGCt
TLSH
T1C222D7516E28797B9CCBE21DBF15BF13E6FA503251911E48AAFC861C04E7ACD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c1724cd6e92f344819bcc3550457777c0c6bfbebd5094c37890358526d68b9cb
MD5 b44a04c1c5393a18d1b34f07331b4444
SHA1 3c84a77464b59fd9eefa7fb92a77724fedbc6ced
SHA512 0f08c729d603ecd2ac83c3d8d6e2cd90b7c658cff973aa1a8b47f1aee0d3ba9a38611d215321ca8b7c3557197f3a6e02178c4423d749f2f9cb94136a56ebb025
TLSH
T107E026E524CFC22EE74866C702B8438CC7A02A9ED3D4AA2F1780D4CC7403648FBA2790
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 95bdbf810ce9fe8bbe7e92c7d6add2b77a656671bd42af84682b11855d60e008
MD5 df929beb94efff36b189ffaea6201b2f
SHA1 6ce6494dbce61a0450ca81e3a8f235c75b6e8603
SHA512 be7affb50f3cfa1c38bee73848296bb9d3a39b675931b2c52131d86fd9219e4221141e3194101ad0009562484de719e2009d683bd47b4a4de60e696383172eec
TLSH
T1A261F586ED90E4E3FB999130A9FF258AFA6545B0988F2D3200AEF5FDEF15B9C4004074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2de0b4283033565c5d3d8beb2d61b83c5c78adbfa56996c0349207bd63b6a87c
MD5 f150e8d5458d163fb63a95c835e62c56
SHA1 98377bc4c629c30ca8e7b5f63eea9632833e7d18
SHA512 04293d20e90a0e60ddefabe11f0cb8ce8b157a7bf077f44d53bd23ed789e7ff2efdc95fe13bb08e879f007283fc170ec36bbc91d7a5ca08eedaeae816b3454a3
TLSH
T1F761F686FD50E4E3FB989130A9FF258AEA6549B0988F2D3200AEF5FDEF15B9C5004074
MD5 SHA1 SHA512 TLSH

Submit Download

b1fcbf98-8a5b-4612-a60f-506a8a79c9b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b1fcbf98-8a5b-4612-a60f-506a8a79c9b2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

a333945a-d275-494a-8c26-3ec3c42de6d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a333945a-d275-494a-8c26-3ec3c42de6d7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cc31a142-b313-4f58-b454-f3ffba2de99b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cc31a142-b313-4f58-b454-f3ffba2de99b.tmp
Size 949B
SHA256 1dbd3a2e1f6ecdbc1bf486c7374773131070b4a94eba0de47d92d17b4395190d
MD5 079efc1448bf4b039496e62cca4bf35b
SHA1 c06b9e6a136e9b8925e08fd8f8e2a795867dc1fd
SHA512 795627e15fcf98eb008b6e513dcd0ce4c8619ea9f3a9dcdc7c10a99a960f9eb3e8d9cce64183c9a1b35a73acd54a322806fe8f126e38402c7597b8c4df6c453c
TLSH
T14711BAB3C3D5866E8A0116F05A24AE2BCE2D0616422C3C19C9D4EF2B93E3079E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

ecd069f7-5942-48bb-86a5-831fa6d9ff52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ecd069f7-5942-48bb-86a5-831fa6d9ff52.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7dbb95370f46db5417a6f5b3d2fdb8db8f40776dcd3bea875f3ebd43f85a45d4
MD5 22ccd803f01bf989475353c3e2c70d09
SHA1 313e43a50f9038e5ba381ab5fce9ee6f3855bcc9
SHA512 d9132bcecb565dc882590acd9f6467a83af52494c4dc55488f905d07955680ec82a49cb8804713f01371853e82e39e9056e09952db437ec9fdc6d2bf3b205b51
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL+5UY28slbQ3YISwlK9U1mlxe1YPQM3:KYduKGwC2JSK605EAKxWiqz
TLSH
T16D91CE10356B020039FE395950B4DA5A528135B7302AF57FBFBC90A64E6FE189DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0660ca4-3e25-4782-b5fa-0e17d503b213.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0660ca4-3e25-4782-b5fa-0e17d503b213.tmp
Size 9KB
SHA256 5963d58ecd22cc496d59b64637c5a074a6fc4d0eaa5831dfbeac25535489c04b
MD5 c0969376ae69318bda46986a219c4bc4
SHA1 4f8df56fcd84983989598e2c46297da8f2f9ed77
SHA512 0743905e5fd5e79fda2252a7df1bd9d921e2825852351bcef5996c5de3207ec042bdca3dd62ab5e878f2ad4fe8550c7ac878dd871b6d0507046051e6b076e13d
SSDEEP 192:sxZMRkWI/flswqmVIdpdeHW6+WNGYaJUaRIg5XJ:sxZMZI/flswqmmUHbGJr
TLSH
T16322B7516E28B97B9CCBE21DBE15BF53D6FA503251911E48A6FC861C04E7ACD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a952b9e5-d88b-4d13-89f8-ca9b7043e700.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a952b9e5-d88b-4d13-89f8-ca9b7043e700.tmp
Size 9KB
SHA256 aa62b7fb786574f2f058ebd8e92b9b9fc2cdc6f7f507a2d32d5e91908952ad16
MD5 83c1a9f270819e2b2165112143acd32e
SHA1 bc172bdc1bc9c40471d05882f08e119c4956b621
SHA512 bfbd773c76191e8e7a42e92c0c58040d6a79ef4cda4a251e2fb90130884f603eb94e2e8456a39bc462f6916c02726b6a6296f5d51f96c3c74ac3e4cd557380c5
SSDEEP 192:sxZMRkWI/fls7qmVIdpdeHW6+WNGYaJUaRIgrJ:sxZMZI/fls7qmmUHbGJ9
TLSH
T16122B7516E28B57B9CC7E21DBE15BF53D6FA5032A1911E48EAFC861C04E7ACD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec4b3688-50a0-4db0-9ee1-3018d723ff4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec4b3688-50a0-4db0-9ee1-3018d723ff4b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7b4f3f04-2e42-4993-87aa-bf2ccad8e93e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7b4f3f04-2e42-4993-87aa-bf2ccad8e93e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

aee5f064-8b2e-4f5c-9e5a-5de0b8b0a636.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aee5f064-8b2e-4f5c-9e5a-5de0b8b0a636.tmp
Size 18KB
SHA256 d6dcd053698747cf069c0b7bb19d64c14965cc0c909d430d9d93e6ab5da3333e
MD5 8008b116d7e964d49ae55cde6538e15f
SHA1 fab06996c377f4237312cf1ecc872a6b077563a3
SHA512 d34fd29b3241ba5e2c1795bf4beac4112053a30bbda1fd59de57b47a6c343233936eb12f4442ad6d4d5af7ec9a10e2fccefde698ede94b1d51990b63fafcc0ac
SSDEEP 384:bQkUSv0sNu1qmj11p5u8i4tVyv8vaTZcZu+UIIlZ:V051hkUyUvaTZcZsLf
TLSH
T161827D3668A87C3B6EA3A560F94B3607DEB08167D7C42F94D5DD572C00DA298330B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e306dba1-dc33-4c24-8ccf-c80b2822ee09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e306dba1-dc33-4c24-8ccf-c80b2822ee09.tmp
Size 18KB
SHA256 218bf8d29d166c620c8d79876395f64e3a7346efde742e9f10ea25df46bcee1c
MD5 ed880e575fdee8d578382c0ec223fae2
SHA1 fb20fc8f2ea265e19bec4e197622e6ed37e6fa5c
SHA512 3a826e29867c4c48b7be97441e79e3117e5b7f43b11a5335004f00b7ea12a92bb917497ed3101414fccc5ea69670affda1fbae2af5860b17730f9981d8985821
SSDEEP 384:0QkUSv0sNuGqmj11p5u8i4tVyv8vaTZcZu+UIIlZ:k0U1hkUyUvaTZcZsLf
TLSH
T1BD827D3668B87C3B6EA3A560F94B3A07DEB08267D7C42B94D5DD572C00DA298330B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed2679b4-dcc3-4576-bd41-2ae2a5adaf40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed2679b4-dcc3-4576-bd41-2ae2a5adaf40.tmp
Size 21KB
SHA256 170dffad83a6f9959c0344eb548ea6c9bdc7684615424660026f5946197d6a56
MD5 b614a2d9da2e6b8c2085e9e9b14ff3ee
SHA1 5269c1c4799288b5c015a9be5ff04d8d9ff56845
SHA512 f869a25a7bde5c890d6635c71b88ed4edde5a33908d802c3b427f315dc867d15f78dea7df9a2512e06d9f34250545c8d6f324dbebe5be0ddd2b414925072bb23
SSDEEP 384:8iFzQkUSvPzsN+8TUNTUlIl1qmj11p5u8i4twyv8vaTZcZu+UIIlZ:nFdrXwgh1hk3yUvaTZcZsLf
TLSH
T1F0A25D735898A83FBEA79E50F94B3607DEB18167C6D4AB94E7CD592C00DB1DC230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76291c2f-2a6d-4342-983a-ca00037671f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76291c2f-2a6d-4342-983a-ca00037671f6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d84b5018d6911666d2fda7c3b283f7d91cd375e91b277733e3df574ffef5ab5d
MD5 3a898d38604079b670de3a5c365e4f60
SHA1 626603d37f59b7d909ce1152b6c804abc908e6c5
SHA512 627f990a60a115e133702b481e96622ed70e2f1b1c4edac85c76493a553d281295483eff59c5d3c94562a28f4840a4e88b729ef380d576aa034ba6d926466d43
TLSH
T12641D858A6EA0148B3B76E169FF7A86D487B7D772F4AD45D10010D4F4A22B40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download