da3f40b66cc657ea33dbf547eb05d8d4fb5fb5cf753689d0222039a3292c937a

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gas.exe
Size 18KB
Sample260809-ayff7sfm41
SHA256 da3f40b66cc657ea33dbf547eb05d8d4fb5fb5cf753689d0222039a3292c937a
MD5 e7af185503236e623705368a443a17d9
SHA1 863084d6e7f3ed1ba6cc43f0746445b9ad218474
SHA512 8db51d9029dfb0a1a112899ca1f1dacfd37ae9dec4d07594900c5725bc0f60212ab69395f560b30b20f6e1dffba84d585ef5ae2b43f77c3d5373fe481a8b8fc3
SSDEEP 192:KtRj6/XFyk9YPdXTH08W8c3LXLtYmEBI9qHVDEV:WV6fFy2Ylz0TiBIw1Dc
TLSH
T19282D527F3989B52E09849744CE723209B73BE328F969F1B7111379CBCF26824E67611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gas.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4692	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2276	4792	msedge.exe	91
PID 2276 wrote to memory of 3260	2276	msedge.exe	92
PID 2276 wrote to memory of 4692	2276	msedge.exe	93
PID 2276 wrote to memory of 4580	2276	msedge.exe	94
PID 2276 wrote to memory of 4580	2276	msedge.exe	94
PID 2276 wrote to memory of 4580	2276	msedge.exe	94
PID 2276 wrote to memory of 2688	2276	msedge.exe	95
PID 2276 wrote to memory of 2688	2276	msedge.exe	95
PID 2276 wrote to memory of 4380	2276	msedge.exe	96
PID 2276 wrote to memory of 4380	2276	msedge.exe	96
PID 2276 wrote to memory of 4380	2276	msedge.exe	96
PID 2276 wrote to memory of 3084	2276	msedge.exe	97
PID 2276 wrote to memory of 3084	2276	msedge.exe	97
PID 2276 wrote to memory of 3084	2276	msedge.exe	97
PID 2276 wrote to memory of 4364	2276	msedge.exe	100
PID 2276 wrote to memory of 4732	2276	msedge.exe	99
PID 2276 wrote to memory of 4364	2276	msedge.exe	100
PID 2276 wrote to memory of 4364	2276	msedge.exe	100
PID 2276 wrote to memory of 4732	2276	msedge.exe	99
PID 2276 wrote to memory of 4732	2276	msedge.exe	99
PID 2276 wrote to memory of 3828	2276	msedge.exe	103
PID 2276 wrote to memory of 3828	2276	msedge.exe	103
PID 2276 wrote to memory of 4116	2276	msedge.exe	104
PID 2276 wrote to memory of 4116	2276	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\Gas.exe
"C:\Users\Admin\AppData\Local\Temp\Gas.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://appdata/
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://appdata/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffb2595c188,0x7ffb2595c194,0x7ffb2595c1a0
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,8550758195939614221,3711019561416959766,524288 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3075416038729093279,10771788064891157721,262144 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,8156881017558708780,17258173108459504659,524288 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1036219402307358720,12862699361342344559,2097152 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,11036249383554318595,14936602742905669031,2097152 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,13388676129170484841,5869641932172363294,2097152 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,14778140705449255392,5661164852138412385,2097152 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3868099307726720267,14563717232797176907,524288 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,1680323788888589035,14506345122921304068,524288 --field-trial-handle=2320,i,6963996840187749326,2162748473499763838,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2736

C:\Users\Admin\AppData\Local\Temp\Gas.exe
"C:\Users\Admin\AppData\Local\Temp\Gas.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 276d870a70feaeadeff3bc749ac0c6771611c4a1a499936f4ac3dca3455aa995
MD5 5003b1c1457e9ac394ab08adb1a2a069
SHA1 5595be273158db026a0ecae1fb305b9951e4b9f5
SHA512 07a2e4a5d4a99276c928956b184e66856005cba56a04f2e8ac3b2c50dff519f0247501b7b7230cdf36973555b012393078ea2e797ef109bf02e9eb49609b9640
TLSH
T143D08C227B2AB1C1D26421BAC5304B24522E499776939246B1148C4EEDB514AA2D2997
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7652d0ff06f8a83e32088506a88e86962e696a0763dd46cbb88da0ec7874f460
MD5 56a9fbb4bcf15aa698be7b7879672b72
SHA1 cd3985689164bb73aa9b218c794c7651d3f54d1c
SHA512 509d10ccfc1b038e2be9127a7abddaa82e297a8f0f21719848e23f4ef1c1947dbeacdbfa3f1823b608cdac96a269ce6f3b9f3b64bd47fc90660d91eafb51bb71
TLSH
T15171F6E9011E08E2D732C1F367D2012AB8F285F6C4279FB2F1509B74FE213A9811C27A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1024B
SHA256 bfae4d4e668ac6def0360c3482faff4743e386aaf3d8ec391fee54e79e7520c1
MD5 aabdd1263eae3db92d7a994f091bef4b
SHA1 6de7eac3d6005d0dd14c203907d2252befb83b65
SHA512 ae116c7defbd3caedc024fdf2de101e08c2300851fdcf3a9a449714b9460be8e00ae693e6fc93e05be9e6d5f6508cb3ab534dfe1119834096270d06f84cb543a
TLSH
T1BD11ABFBC3E4857D8A0187F4A614AE1BCE2D0915431C7C1AC9E8AE2B97E34B1E10055F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6eeb762b976c6ef5f36b766e2e8d7dfc56b9e9f82aff901c70ec9272bc9aebd0
MD5 87531050e72ac127bc3609382a137cfb
SHA1 1e4e939c2e93245a97078230b5c095d70928692e
SHA512 f7aa4357fbf0aaa04f6080855f5a4c02fe1a9eb3a98b8563a1be15732593dc551bddf91b0c9ddee79358b823fc5b7fec08fd7473f995e981fca5420143442e89
SSDEEP 192:sxZXRUyM/jK1Ml83jK/fcsfWpVn1lAGqEdpMHW6+WNGYnxqdKIgEJ:sxZXmWK/fcsfWvnTAGNMHbG50I
TLSH
T1E942D815AA38997BCCCBD20DFA557F53D6F90463A2900E549AFCDA1C01E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 86e3c7f7055a0ec15d30f3bc7c9e99bb1f5341eacda71f4d627fb56d87e62672
MD5 decd06bd78586966d2448ac2b51391c8
SHA1 266b1867b88d25b46d2b613400d3b2592468453c
SHA512 5da80e9b5651736b667df7ccae07195e717b85d37cd59edffbc1c14df37ede02ab9994f4b542ea1cbc9669185cc0b6caff327fb3250c569fc949c313f88aed00
SSDEEP 768:BIQRMuUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBsh2ro/RxDG:BIQRMuUWv0sTgu1jakTLROhN/Rxa
TLSH
T1DFE20B3B284CCB7E4F841E6CEC2AAF976DD801CB67984D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3db423084d74fdc84b99bd063eff8eeef4865ed65ba1ce2800d01b30612c9646
MD5 b1edd57a29ae4c8931b9307e439cbb43
SHA1 6ccd7ad1a1af1dfd0e9a3154eac4e04aaa80e0df
SHA512 a7ebe0bccf20d783f78c6baa1e5f90743d712ed63b6c940a656093824dd2f9f0c63e230c764eccec6bb147f15124838083fef4184819402e497924393ded2bd2
SSDEEP 192:CON7B6G+bgQmiUyw3DE54aP1Q5OxbXF68OyIBU6:CON96HgbDE54atQ5OdVhkU6
TLSH
T1F502E935A8386C779FF3AE86B5872B135F98112BE9D16F44DAEC2B1C01DB25C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30c396617fc6c6f94a9a906e13933a4761d421da0059fc6de4a7c3ee75bdf9b7
MD5 26ccb4fdfe9780b45cd90b779e0cfc76
SHA1 bc0df63a0bf9372f77ff2b1e803076e235d6132a
SHA512 27c94623b597cf05cf8f5ee37504463a7241347ae625bbcd29105b4a34dc6646738d4acd2d9c81800c4ad244469a947e8d6a3444da953457850684251affc9c5
SSDEEP 192:s9JONJ6G+bWGQmiUyx3sXE54aP1Q5OxbXFYnf+2b8ShbqZnU6:sXONJ6HWiQsXE54atQ5OdVYnf+25WU6
TLSH
T1B1122B32A874AC775EE3A585F48736135E98412BEAC9BF90D6EC2B1C05DF25C130B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 e265b6da696c734368d6b8b28a3279d8b14da7668275ee61c6ea0a509f99a3fe
MD5 d8d48625dfc1d6d7e15fa50b9dceb48e
SHA1 a3e3b295250438d19cc2b51d7b3fe59a03f26a14
SHA512 808d34c7321c060c52062bfff51be69d1a3d2da9971e9e2dc7733c46ea5999b87bde440df5f2b414075dcbdffd78dd7d92edd06fc3aaaba39912049658420c80
SSDEEP 384:zgFsNIX1e0DUsYX54atQ5OdVYnf+2qLZl/7dqKWI48PAGv3y:UFR3gsKxi5OonflqD/7UKWI4kAGv3y
TLSH
T16382073DDC756C3E08AEBB48AA0E29235CA8513BD5F89A58D7DC1B0DC2BB54CF306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5524099-07ca-484b-9b5b-733b82565e89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c5524099-07ca-484b-9b5b-733b82565e89.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads