f8612008bac1214b41111f3aff6efa3ec79c1f3abf0069f37fb4fc5b2fa9b5eb

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
roundcubees/roundcubees/index.html
Size 255KB
Sample261110-gxmbpagy21
SHA256 f8612008bac1214b41111f3aff6efa3ec79c1f3abf0069f37fb4fc5b2fa9b5eb
MD5 e156929e65e704fcf964ba3c773d5042
SHA1 d03ce7a054b109fe1ae3c59fab3dc5d26f6cb49f
SHA512 6caa537b6893f1fc77363378ee045feb5d12c6b878b8d7739fe481deb8ae4d41c9a96409a0bf869cf4cf2ee4ea98bfd81696df31a766f8d3b8ab9e675938f48d
SSDEEP 6144:ErvWW6dRYB7cj2nkD92SeI/l3BzRidzFmGSJ5X:Er6d2A+XJC3FcwT5X
TLSH
T1154412BCAD217EF97F67C33A6AA33F806C1C9503CC6049D6D24B648E81DAD471A31A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{57C2CFF1-A54B-402A-A0BB-CDA2BF79755B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6092	msedge.exe
6092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4764	4472	msedge.exe	90
PID 4472 wrote to memory of 1684	4472	msedge.exe	91
PID 4472 wrote to memory of 1532	4472	msedge.exe	92
PID 4472 wrote to memory of 1532	4472	msedge.exe	92
PID 4472 wrote to memory of 1532	4472	msedge.exe	92
PID 4472 wrote to memory of 1332	4472	msedge.exe	94
PID 4472 wrote to memory of 1332	4472	msedge.exe	94
PID 4472 wrote to memory of 1340	4472	msedge.exe	95
PID 4472 wrote to memory of 1340	4472	msedge.exe	95
PID 4472 wrote to memory of 1340	4472	msedge.exe	95
PID 4472 wrote to memory of 360	4472	msedge.exe	96
PID 4472 wrote to memory of 360	4472	msedge.exe	96
PID 4472 wrote to memory of 360	4472	msedge.exe	96
PID 4472 wrote to memory of 2844	4472	msedge.exe	97
PID 4472 wrote to memory of 2844	4472	msedge.exe	97
PID 4472 wrote to memory of 2844	4472	msedge.exe	97
PID 4472 wrote to memory of 1768	4472	msedge.exe	98
PID 4472 wrote to memory of 1768	4472	msedge.exe	98
PID 4472 wrote to memory of 1768	4472	msedge.exe	98
PID 4472 wrote to memory of 5872	4472	msedge.exe	100
PID 4472 wrote to memory of 5872	4472	msedge.exe	100
PID 4472 wrote to memory of 4332	4472	msedge.exe	101
PID 4472 wrote to memory of 4332	4472	msedge.exe	101
PID 4472 wrote to memory of 4732	4472	msedge.exe	103
PID 4472 wrote to memory of 5144	4472	msedge.exe	107
PID 4472 wrote to memory of 4856	4472	msedge.exe	108
PID 4472 wrote to memory of 1396	4472	msedge.exe	109
PID 4472 wrote to memory of 1880	4472	msedge.exe	110
PID 4472 wrote to memory of 1880	4472	msedge.exe	110
PID 4472 wrote to memory of 6092	4472	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\roundcubees\roundcubees\index.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff87bbac188,0x7ff87bbac194,0x7ff87bbac1a0
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,362906071985990938,7660282118660020918,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,9303999399394038962,13200067958120672603,262144 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12795591175604188283,16719865090412450859,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,17392534568974814004,5876435388381622855,2097152 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,10960622341203779461,1708695499122446342,2097152 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4416,i,2972773600971076155,8754434027059768476,2097152 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4432,i,1433452917759984210,12767475949223442209,2097152 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:9
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,9805573395996552615,10272689144364191243,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,18411259929041178139,17259374871662935737,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6616559903626391120,7963990974775387472,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6616559903626391120,7963990974775387472,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13384541073134931788,15232908469701120547,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,13047338727302661114,16213756387729657062,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13535731451584371490,3160300489438761011,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8766530726484577417,3156527656319527756,524288 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,11678098387670297073,428083118329853383,262144 --field-trial-handle=2064,i,11761426174013982367,13226952120146050722,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

115f2bd2-8bb0-4279-ae6b-a5f52a130fd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\115f2bd2-8bb0-4279-ae6b-a5f52a130fd4.tmp
Size 36KB
SHA256 a926d6c79e29b36cd73608809f15f46229c52904b75bd3c27ff918e1f056ced8
MD5 6d85a4c63dfd25115019725c30b9957f
SHA1 dbcad348004d75bcdde9d09831db88f25813686e
SHA512 51dce0d3e422675ebe645afc17678309fdca43d847d5f2021e60d1e4425bdc377163c31f58b9d9c0a35a1035ccf6662888849559764af6428e1ff0cf79a97e36
SSDEEP 768:/Fnkd3Gwg5LYKnJdxDc9bsMSJz/Fn/2JoaTZc9HwLa:Nkd3E7VQbs7JTsJ9YQG
TLSH
T1A003A072DC80D9ABEDA79B80BE5E3647AFF14153C9896A84D6CD6C1C01C72DD2387C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1707cf21-dc4d-4cf0-a372-49d8781107a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1707cf21-dc4d-4cf0-a372-49d8781107a9.tmp
Size 34KB
SHA256 fdefa46cf7d111e8b5ae0acf4e2b38befc6bdeaf3abffeec67489ad7c188027d
MD5 ead198a25f2f4667673465e6d7136164
SHA1 bb48cce4e65b816d53053dabd3858a50b9be4f49
SHA512 b89c2d409a812b0229f1118f5833d47ea73e1bf49f39bb3f4db779e0bc91c68c95e18cfecdc236633e1355436e3654b0597b2d95c58af53d4192130a2fd2f290
SSDEEP 768:Ep3tLYKnJxxDc9bsMSJz/Fn/2JoaTZc9HwLa:Ep3/7VQbs7JTsJ9YQG
TLSH
T1EEF2B0B5EC906DA7DDE396807A8A3647AFF14543C9881E44D9CE6D1C06CB3AD234782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

644d556e-03c2-4796-8641-82e96b313154.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\644d556e-03c2-4796-8641-82e96b313154.tmp
Size 34KB
SHA256 fdca397917a881d050484ae493c7b92e0fdb69c1218b4059fec5e24bdaefd0d4
MD5 701d3509c36b84da36f220fb27396f33
SHA1 12804c05024ea58fe013307c1e6e21058efcdeae
SHA512 50d5cfd7e6fa53e519a6cfe6f0a1ab29e96345df0646170d8113d0dea2ec35da60ef52a885029537f06c1221525ffdd046b931242c0f06bb604c4d4d9659f1d1
SSDEEP 768:9p3SLYKnJxxDc9bsMSJz/Fn/2JoaTZc9HwLa:9p3S7VQbs7JTsJ9YQG
TLSH
T198F2B0B5EC506DA7DDA7A6807A8A3647AFF14503C98C1E44D9CD6D1C06CB39D338782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7333360b-0ff5-4865-a085-9e8cadaa9c24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7333360b-0ff5-4865-a085-9e8cadaa9c24.tmp
Size 38KB
SHA256 b78b03c01eec163abc0aa7d950fc73812ded467ba5951b667a2912924d48aa63
MD5 23b1abe27a2512854f75e9689633e0b6
SHA1 35491636dd5510db4636c6b928cb0977b249660b
SHA512 699c6947768452f4cd5592b9a87c018ca628c8f91a4eaca5cdddb4059ce567f76121db2afb5f955379f8490247575eae515395e0aa7b6c0d398f2c0c6dabb81b
SSDEEP 768:e/UxvxjgC+U3bSKnJ6xDc9bsMSJz/FnG2JSHXPyK/:TZj3+U3b8VQbs7JTTJSb/
TLSH
T16D03CF7AEC505897DDF7A6803E8AA647AFF54943D5C9299449DD2E0C07CB3AC1307427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d03e3ed-68ab-434f-8d23-3793d505d785.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d03e3ed-68ab-434f-8d23-3793d505d785.tmp
Size 37KB
SHA256 8a0787846a20263aac9d646679acd103319fd59601bbc3c16d6da25fe69e67b0
MD5 144d53a0051809ea5a30b7b4c67efbb6
SHA1 00fdffc4ef8ab56a2dc0cf9816eb55e59f82b122
SHA512 b6ce2d8389e58f6c8870f0483d440429f8cf60f8a0b86947ba0968f11b802595ef2ab36d37df94d5d22343339828295a9004fd1a4f2cdcfa17f10532bbf4c3d0
SSDEEP 768:z/UxvxjgC+U3n9KnJAxDc9bsMSJz/FnnESHXPyK/:GZj3+U3U2VQbs7JTOSb/
TLSH
T11D03D03AEC5058A7CCF767803A8AA647AFF94953D5C52A9849DD6E0D07CB3AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d79f033-9349-41f2-ae7f-8dcafa1991e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d79f033-9349-41f2-ae7f-8dcafa1991e7.tmp
Size 39KB
SHA256 c51cef3846d679e6ad803926356faa55762b2f5a97ee7673c9afedfc76b69e7a
MD5 589b9ce96b0232ce6e996c165caeb5e6
SHA1 f7b12f38b1d2a5812925704d34f2276c06e20103
SHA512 fac89336c0083d09dcaacaaa2a40a3a22b513a7e199a51f8ebe513449b64621d7ec69f794601cbd0132591556aea0e3990cfa1f474554c476be2a6e2226c93e1
SSDEEP 768:T/UxvxjgC+d39/YKnJxxDc9bsMSJz/Fn/2J1OH:mZj3+d3X7VQbs7JTsJkH
TLSH
T17503D075AC506CA7ECE7A6803A8A6747AFF44553D4C92E5849DD2E0C06C73AD234782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

0409bf52-4fa9-48ae-94ea-29ae45c63a9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0409bf52-4fa9-48ae-94ea-29ae45c63a9d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

145174bb-ae36-4504-bf74-f1b7108154d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\145174bb-ae36-4504-bf74-f1b7108154d1.tmp
Size 23KB
SHA256 452cfe48bf174d0db7d9f824df1c2f45461258041e78949d15f9a111b1f2c38d
MD5 0070d75f470e66211dd4bafca98942dd
SHA1 7ea68fd3354b21b3233d2c2ddcd48defaec8b3c2
SHA512 800829598cba0c88a3f68ffeca8ee31b44c249f2d106428994d83ce16912759284a8d12e8d2a17e6f557a30f1e635abe1e43afd7355ce515abbe15d41ff7f4f1
SSDEEP 384:dFIGx9efCtgmkFfk6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV6W9G+RhGromLa:dmGx9sWgmMfk68F1+UoAYDCx9Tuqh0Vo
TLSH
T1F4B2DA3B640CCB7E9FC00A9DAD196F9B6D9802C79A548D4047FE984C03C77EB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f899f31-7f9b-4b36-be7e-c9e59071fa21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f899f31-7f9b-4b36-be7e-c9e59071fa21.tmp
Size 10KB
SHA256 9eb6e81f6264cc6e8bd860db0e35c103cd78fd65395ef49f8991e23ec297b1b9
MD5 e9f2c8c732845db9358d4e606d91ee91
SHA1 6be09d89c185f72ec60265263fdec7561fc4dd2d
SHA512 0d785c24faf55412e01c868ebc254bf4ff7ca539b47e9c9edb950a81dda4ad14a1f004f74663244dd46afb799174f8cd1a1e4572d1ff0d27bf3df431c8d4a136
SSDEEP 192:sxRERebz/f5symzoA8p4g/g6+WNIYt7LsUGHIgIJ:sxREmz/f5sybx/5Ihs
TLSH
T1E8329615AD28B97B9CC7E21DFB55BF53E6F92032A0911E48B6FC8A1C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

665ddf90-6f6f-4695-9563-ec2aa7d6dc21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\665ddf90-6f6f-4695-9563-ec2aa7d6dc21.tmp
Size 11KB
SHA256 ad24c975f02ca857f12b423714748b20895f857fd527246161f2051344537a4a
MD5 81ce6bdb41438548915d38fc204788f6
SHA1 4f2255f828dd181c394a78c7dadd18d1e2f5dc53
SHA512 7b3f02805981db1372c5d1016899dff3f5166b6ef351310eb4f0321b3de744762a863038ad8cf698b972ad445d8b8f77f0e3b5133d265f27278b0c9cec508565
SSDEEP 192:sxRPRebz/f5shmzoA8p4g/g6+WNIYt7LsMGHIgDIJ:sxRPmz/f5shbx/5ItA
TLSH
T162329615AD28B97B9CC7E21DFB55BF53E2F92032A0911E48B6FC8A1C14E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5fa1756b05e40c24b1f3e1f23b91fba869cf3fd804ead503f90c30ba2d1a1853
MD5 0c17ee42c55b8fbd9be3d1ee4d44f1e7
SHA1 46d52b16b0714d754b36561afd111fb7a528e2b0
SHA512 1e878e92660db62c2140fc6915d8fa5f364df9344bbfca689bff07f2d4662e4c5dd9fd81f13f3852dabdd09c0c85467e4b593be4eda755e334eabedf26be53de
TLSH
T103513D425D64C399FB9CC97484F93CBB3635AC931783EEBC806AD564F5C23267200D2A
MD5 SHA1 SHA512 TLSH

Submit Download

7d287285-5d80-4350-a791-aa89e0c05a2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7d287285-5d80-4350-a791-aa89e0c05a2b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

21995535-8772-4223-a066-d1d7e2c124bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\21995535-8772-4223-a066-d1d7e2c124bd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b1449e33-3534-40ad-b76c-af2fe92fb0c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1449e33-3534-40ad-b76c-af2fe92fb0c0.tmp
Size 1KB
SHA256 b7858238db15fcfb1ceb1688aa189bfee7270e74536cf8982d2592e6ccdaedba
MD5 f2e54f14caf91db880e043be4f5d0c15
SHA1 3b8b1b9a47e620cc6ce65127fae26401aa9c42c3
SHA512 fcf0453541d248f02a6f4dc2e1b7273999cdda9255ce510d43c42b37c770b8ab327965c5343f568ddef1b57a374e391b9e6575b42dd52f6a0819b33a37994ba2
TLSH
T1FE31A2F783F4957E9A0196F0AA14AE2FCE1D0511431C7C59C5E4AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

e171be6a-db12-41c9-b99e-9783a410130f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e171be6a-db12-41c9-b99e-9783a410130f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 719a0e3a8a06e0e7df4a1c4a97ef7244f9c97e2c9aa68d8558a5943528aade9a
MD5 1b408fc0517ead51cf6a293857d5ab3c
SHA1 7e8565f102fd6029d5035787d66305ff1cc7bddc
SHA512 5295553e9703e662c9eb5f466a627457e5726fd149680bd971d2208855581bdddd8787d1230df542f319f184840996cc4b7d2ee61d8ac759dd48cd522d29a8c2
SSDEEP 48:KMds5tXr34TjerIaV4KVd9/4RVoou/tVyDzOvTt11+TlglIaz+KVL9Z+R7uoYpZO:KEKAKnKuyggKNOWiIKjqCf3iZ9I
TLSH
T12E91412471AB431039BE394950F49A9B438136B77029E53B3FA940D78E2BE149EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

adbfe93b-c3b7-42e2-8f90-33d132cdc823.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\adbfe93b-c3b7-42e2-8f90-33d132cdc823.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cbd7b5aa-c26c-4331-88a4-64bf84ef3b12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbd7b5aa-c26c-4331-88a4-64bf84ef3b12.tmp
Size 11KB
SHA256 e2e5b74a7e6a9bc2eee0b3c3e10abdbba6c61323d71718d0906620acbdf7e7d3
MD5 2e7c694349bc6e1abebef60cf833d8dd
SHA1 014cd98d632865627d2f459e9f2c9f1859d21f8a
SHA512 e3a3c3de031297c5bf998b4750005e928bb97f3c8e1cebcdb8dc912145f406ee6f31f1ef72efdc4e24bfb9a885f647e5ecfdcc446620c46532ee29d6086bc7c1
SSDEEP 192:sxRPRebz/f5srmzoA8p4g/g6+WNIYtLL2MGHIgDaJ:sxRPmz/f5srbx/5IhK
TLSH
T1B032A615AD28B97B9CC7E20DBF55BF53E2F96032A0911E48B6FC8A1C14E76DD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d5e67b1e-d98e-49d3-b5e2-a9c14d68f414.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d5e67b1e-d98e-49d3-b5e2-a9c14d68f414.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbef1311-c8af-482c-8e22-5cc6a3906f15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bbef1311-c8af-482c-8e22-5cc6a3906f15.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download