hxxps://www[.]larziy[.]com/

Analysis

user interaction
yes
max time kernel
14s
max time network
14s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.larziy.com/
Sample260930-we5gwaed54

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{88A1A22D-0BB3-45E6-9328-6417EB918A89}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4076	2064	msedge.exe	80
PID 2064 wrote to memory of 5880	2064	msedge.exe	81
PID 2064 wrote to memory of 5872	2064	msedge.exe	82
PID 2064 wrote to memory of 5880	2064	msedge.exe	81
PID 2064 wrote to memory of 5880	2064	msedge.exe	81
PID 2064 wrote to memory of 920	2064	msedge.exe	84
PID 2064 wrote to memory of 920	2064	msedge.exe	84
PID 2064 wrote to memory of 5048	2064	msedge.exe	86
PID 2064 wrote to memory of 5048	2064	msedge.exe	86
PID 2064 wrote to memory of 5048	2064	msedge.exe	86
PID 2064 wrote to memory of 4972	2064	msedge.exe	85
PID 2064 wrote to memory of 4972	2064	msedge.exe	85
PID 2064 wrote to memory of 4972	2064	msedge.exe	85
PID 2064 wrote to memory of 3300	2064	msedge.exe	88
PID 2064 wrote to memory of 3300	2064	msedge.exe	88
PID 2064 wrote to memory of 3300	2064	msedge.exe	88
PID 2064 wrote to memory of 3140	2064	msedge.exe	89
PID 2064 wrote to memory of 3240	2064	msedge.exe	90
PID 2064 wrote to memory of 3140	2064	msedge.exe	89
PID 2064 wrote to memory of 3240	2064	msedge.exe	90
PID 2064 wrote to memory of 5612	2064	msedge.exe	92
PID 2064 wrote to memory of 2512	2064	msedge.exe	93
PID 2512 wrote to memory of 2148	2512	msedge.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.larziy.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffef83ac188,0x7ffef83ac194,0x7ffef83ac1a0
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3049054623577053334,8160938891741456555,262144 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1648,i,16622797357612070302,17407963639199289248,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,15171650840253225480,8005122623927411793,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,235285355924617689,8139223239540616954,2097152 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,7793200404935871864,8187229722972528412,2097152 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4812,i,4617277084803199680,14577945277865432336,2097152 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,8114305462533401544,15396391203080725768,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17950789121877812378,14668029810998166078,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,17390199899475297649,18216685776350250375,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,17390199899475297649,18216685776350250375,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,343056960771653587,15384409122382603882,524288 --field-trial-handle=2124,i,1364781371277403375,5895206954962427913,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83eeb6fb69147b86d59db93f6bef3b9700e1a01b1e16b7737138a14705b925ec
MD5 1261625a6979743cb430cc1e4a6c87ca
SHA1 3447cdabba89527c05d21de5b837debaa8dddd5d
SHA512 81eea7d5abc59ff723b0b7dcf56140c4ca4b98afc852eb03d6c02eb17e7ee2a4ed4c221a99cd4babf2c7e6721d787537a34f58357037ab616e168d5434558f41
TLSH
T13DD02B80ACD56104C0031437006161103F9894440906E012D0C0027E09C5AD30755062
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bc8c90c9f0786c014d78c1926c152ddc644c31ae36698ea9444330accde49800
MD5 1bdfac185ee710f7610f2317b5ce568b
SHA1 3442a425dc0a2dd7c0e6ca4ced1b761b7cf1ce26
SHA512 fccf6460154f95889ddaae4240f36d2123d3dff5bfe9b2e658add7adf5a42ca4cb40e8381c5fd37acbee2fcc85dffca5e4f0e912e4cafc93edb4e1e3ba0a92ad
TLSH
T14BF028A9D921EC2728FD0B1920654B0BF75413673781955F3B3D420C8FB463B4796C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 1.2MB
SHA256 b1457b9f463e175f51910daa8b5a51b8b81e65cba0d329a32fb515a6a25f5d34
MD5 19923c01509da7c8e8a176edd0b3508b
SHA1 e644537860f93a3d38578aad2745bcb2c8fa799a
SHA512 02267d23a79ff32265f5b30971ba168ba1026874d23e5dea3410ae74c851831cbd4047627fa7a98567ec079ef7890ff11da97342538e317cdac744e5a9eae71a
SSDEEP 24576:3tlzeRAfeglRHahYNNqBs+ZqBs6tV8wgP5nclZVgUVV5QObEupdquHUlgeD6z:dYy9NqBnkK6YLeVjVz9EQy9D6z
TLSH
T11C5533EB9570B44EE94ADEB581C0A82C2C918441B7797E00AF4D34B7ED9CF49598C3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 95697309af383c01490f85efa158160a9e5dfadc82d19d11d415337eaa356300
MD5 1f51005da04732da6e5aa8574139857e
SHA1 309adbcb53799dea586f4cf88398923573226f4e
SHA512 e01ffc1b01ac617a0b762f53efc9bf42b17e32f34c1006fbbfe8191e88af321ee23c9596504dbec97f8e0ea269646c21354e96ce2ac615c6ca04afb4d3618e00
SSDEEP 192:sxZtRWF8/fJs6Q705WsfizodpWB/W6+WNdwZ/Y0Rkvd4IgjwJ:sxZtG8/fJs6359m/bi/5qCjU
TLSH
T11D42E955AD38A97B9CD7D219FA55BF53D3FA103290C11E48A6FC8A1C01EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 f8c6613100e2e03836efce332c8c5b99b84085e0b6f868f5c5c9c1389626922f
MD5 95a52ada67c41eceec136ae85247798c
SHA1 7c9c88f0c0d48deba1e6e3a9fb378893d7886aa6
SHA512 2d9a23ba1dee928150d2ba9496c043c54d8589f336a29864b3e21bdb589a6ef429d58c758da0b943356dab48499438267c2ec14074ecad740916c178072435b1
SSDEEP 768:WJ6E28xO215WRmp3QX/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fsLl/LN0Y3Zroyw:WJ6E28xO215WRmp3QX/u1jaKfsLpLKYG
TLSH
T114D20B2B740CCB7E4FC05AADDC666F976E9802C7A6688D4047FE894C02C77EA511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1892eb267f7489d7ae4cb90346b05e5823f160678bed57ffffcb8dce1c6ca129
MD5 84ba3856e988bac23c6c91838137346c
SHA1 08f0668a4f57153f349567a26109aa331fa894ee
SHA512 f669a1e63dd03a385f490bfd6590619bd309a756826d748586978a171f5c5cef9137afd48012a8fed4af2d12867f757c1a026a06128151c3b19c497625f10a05
SSDEEP 192:80Z/jH0TnaJxzh/Mrzcp3wHboDWfSxBBL3DCpBqzRvcrfF5lej:88/T0DaLz5M3cZw7oKfSxBBL3DCpBqz3
TLSH
T1D2B2221171BA12153CFE290D91B49B2F564232B37119EA3B7FBD00A68E6BE441DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 356b88b0af1d91d8025e479e96dbbcf26410893616b8dfe036578aee22a38a1f
MD5 f3461e1003d8d74b44faa2362076d229
SHA1 c7cd0223341270dca605d1c0cb65114f37adbe07
SHA512 b0b9e5264cf85973ca93050b8d6c335663f59f4ee529410f9c280466010aea8a16e74ee16cd58a640bf207dcf8cd5936cfbeb61c2768bbeab7568ee3556958f8
SSDEEP 384:nSiFiZcIP38N18TUNTUlIRlQnhxJDoutzTfoBYY6nu9E5LmGh4wDNQztgOIwZOyd:ZFQP3+wguhz7UBsFVh4wDNQzXsk/
TLSH
T11AC24B32E8A9CEB7FCEA4E95A78A7643EEE01063D49C8AD8D5D84C5D00975DE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3e3cd772578271c8564a9e52f3a339b3f5392c9f561cf12b0fb353a2fbea2695
MD5 8df08d43ea990be4414fd1f96e2ecadb
SHA1 87fe576df9d188340492419dc49c6843f2c05b80
SHA512 3b9f448ad9eaddf5cb819b6c48dff878407795cef8dcc633976d7f553949de2eb83d3375534ae063a8bb69df871e1f2a2804355e29e68ab88060dc922ad734d7
SSDEEP 384:zyiFiZcI638N78TUNTUlIxBQnhxqohitzTfoBYY6nu9E5LmGhVQlsa+VYKqgL/7Y:VFQ63gwg2hzh8UBsFVhVQlhgpw
TLSH
T1F5C24A32EC98CABBECEA4FD5AB8AB602DDF04163D59C9AD4D5D81C1D00DB59D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads