hxxps://cyberpeace[.]mx

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cyberpeace.mx
Sample261003-wsllxswtay

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{12DE3DFD-5B9F-4892-B135-89FE1CFCDB9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3536	5096	msedge.exe	86
PID 5096 wrote to memory of 548	5096	msedge.exe	87
PID 5096 wrote to memory of 756	5096	msedge.exe	88
PID 5096 wrote to memory of 756	5096	msedge.exe	88
PID 5096 wrote to memory of 756	5096	msedge.exe	88
PID 5096 wrote to memory of 1288	5096	msedge.exe	89
PID 5096 wrote to memory of 1288	5096	msedge.exe	89
PID 5096 wrote to memory of 1272	5096	msedge.exe	91
PID 5096 wrote to memory of 1272	5096	msedge.exe	91
PID 5096 wrote to memory of 1272	5096	msedge.exe	91
PID 5096 wrote to memory of 4424	5096	msedge.exe	92
PID 5096 wrote to memory of 4424	5096	msedge.exe	92
PID 5096 wrote to memory of 4424	5096	msedge.exe	92
PID 5096 wrote to memory of 212	5096	msedge.exe	93
PID 5096 wrote to memory of 212	5096	msedge.exe	93
PID 5096 wrote to memory of 212	5096	msedge.exe	93
PID 5096 wrote to memory of 180	5096	msedge.exe	94
PID 5096 wrote to memory of 180	5096	msedge.exe	94
PID 5096 wrote to memory of 180	5096	msedge.exe	94
PID 5096 wrote to memory of 436	5096	msedge.exe	98
PID 5096 wrote to memory of 436	5096	msedge.exe	98
PID 5096 wrote to memory of 436	5096	msedge.exe	98
PID 5096 wrote to memory of 1948	5096	msedge.exe	101
PID 5096 wrote to memory of 3044	5096	msedge.exe	102
PID 5096 wrote to memory of 3044	5096	msedge.exe	102
PID 5096 wrote to memory of 1948	5096	msedge.exe	101
PID 5096 wrote to memory of 4324	5096	msedge.exe	104
PID 5096 wrote to memory of 740	5096	msedge.exe	113
PID 5096 wrote to memory of 2828	5096	msedge.exe	114
PID 5096 wrote to memory of 3104	5096	msedge.exe	115
PID 5096 wrote to memory of 4012	5096	msedge.exe	124
PID 5096 wrote to memory of 4012	5096	msedge.exe	124
PID 5096 wrote to memory of 468	5096	msedge.exe	125
PID 5096 wrote to memory of 468	5096	msedge.exe	125
PID 5096 wrote to memory of 4360	5096	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cyberpeace.mx
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff865b5c188,0x7ff865b5c194,0x7ff865b5c1a0
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,17253817600115556817,17674942639508935546,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,12185117242271685972,5271425122844590489,262144 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,14587464310491506725,9413208152741245285,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,7863546716949781681,7401255983757059251,2097152 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,8557946587678190222,18166367095954709465,2097152 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,18344944354208577098,4739430999574002950,2097152 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,6018491684885852926,6969729091188598957,2097152 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,6172816246777488740,16645928586594820271,2097152 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,7425604678173581541,16478897727867914956,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,9686778988561822298,3304987230633317079,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15689952022859566219,2032273257737195905,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15689952022859566219,2032273257737195905,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,15094986586858049793,17348617983898872819,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3004868800363716674,8060825177987887067,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,3744999174814345365,3779431671606637822,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,3777011719109173070,4768027806587641210,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,11838959766332347382,4711223832553958899,524288 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,18372351626894137697,17038733268744833264,262144 --field-trial-handle=2996,i,17748328545570688843,13143434905933113626,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ec0a390-b61f-4ace-8dca-9a7d43f05303.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ec0a390-b61f-4ace-8dca-9a7d43f05303.tmp
Size 18KB
SHA256 41937eca70778eab7bf30ee34b210c3fb05e6d1e5b924a11e8445c8a51575907
MD5 84791e909c8b78c87110ba8c82f0f6e7
SHA1 51de9bf5f0e7b22381d796ed89fe70fd6009c007
SHA512 e44600b826048e106b4fd0d5fff1902bd7cf42eb986409fb1216e31da1ff7d0d722ec2121aa030d5636c8b4e45e40c42373ff008df1b519170d8e5fe5e03b57e
SSDEEP 384:jZcIhsN+t9bYLGPRh//GJ2JtgOIwZOyCoZ:7h7//PJXsbC
TLSH
T1D0827B326C78ACBB6DE7D141F58776034FB88027D7C99F8485ED6B1D05DA1A8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a170f16-5e2f-4ce6-b9c5-533f32bd96e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a170f16-5e2f-4ce6-b9c5-533f32bd96e3.tmp
Size 8KB
SHA256 fe9f163bc27e0349c1742a5f48235ac4e62997a776c8c6c5f2c95a0f9382fbbd
MD5 b3f305d864efc5173d87e562ba740e4d
SHA1 db01dacf82e71c9e4e9c21c62218b7bf76fb5859
SHA512 81bf4acdbbd7414598e75e3f017bfe34b847327da83a7493a8936a60b1b0e20f5c310e56e05cda20e7df5795588f1de310b88480d1f9afdaecaff53c1bfc07ee
SSDEEP 192:BON36JUZQmiUy8wnjo//GBm8fNxeqBTU6:BON36+3Twjo//GJDJU6
TLSH
T1B7120935B878ACAB5EE39581F08736138EA44127DB896FD4D6DD2E1C05DB1AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71c89342-d6af-4484-97e2-4c8568c230ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71c89342-d6af-4484-97e2-4c8568c230ed.tmp
Size 18KB
SHA256 b3df5f146ced4164f5b391f765953fa8290aa9431ef4bda27269f3ad873c82b9
MD5 8355d202de9ee2028ec0c27327b3d5b8
SHA1 978c340537c41be34528f51e91dafd5076550e5f
SHA512 7becb5c1b0a13dbb155bd9a922069c00cd59567e0888e636613cb13792911c62d831cd189e5444bef08cd41eb1fa546604b189dd79b9ac3fab5da904801fc214
SSDEEP 384:7ZcIhsN+49bYLGPRh//GJ2JtgOIwZOyCoZ:jhk//PJXsbC
TLSH
T1DD827B326878ACBB6DEBE141F58776034EB88027D7C99F8485EDAB1D05DB1A8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8228aad4-5bad-4bd6-acce-24a8283e8984.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8228aad4-5bad-4bd6-acce-24a8283e8984.tmp
Size 8KB
SHA256 1d74501b82bba01bd120d568964d36d9d81ba570c13ec72cece42b2dce8c8bc0
MD5 3ce9f1ebc7a9385753b7d81489092f60
SHA1 5928f738a3016a27b731cb886a548552be151f43
SHA512 86f3e7ff71a8d7c114caa1cb8da6e058c14e5483aca817f425f619d513f097a3a9fecb109b0ff634d2709b771c65370a981fdeb361d90fff5492c3cc55c365dd
SSDEEP 96:KqONk5QsjpfbUmjH5ih/cIPURHl8h4otop5gaDRBKP4v+Y1xf//ojdhxZBmqBCZi:BONd6JUm0QmiUyZnso//GBmqBCNkU6
TLSH
T1D902D838BC7878BB9EF39E45B0877B139FA41067A6952F84DAD91E2D01D719C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

1811f387-db66-4d21-8f1b-a1a6c823a164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1811f387-db66-4d21-8f1b-a1a6c823a164.tmp
Size 9KB
SHA256 b6c9d8d9dc9d9a614baa651a29e8d0204938e7fe1c098f14431bf07e5065b0da
MD5 3b1b4fdc727dcf386f0143593bde760d
SHA1 ce74a90d3fa22516bf5ab4fa3bc5a0fff80b2538
SHA512 3fe50ed3971a5c36700283596315c38d7befe303339ed3c13fbe70e9f763b2cd3f72fcaa458f38e42344abb3968d3cd7d0cb117be2aa2789ab6a1c46e6715cfb
SSDEEP 192:sxZCRbWj/fwsxSIdpL8HW6+WNGY36ngrGEIgrJ:sxZCAj/fwsxboHbGXe9
TLSH
T16F22B9516E38A97B4CC7D20DBA25BF53E6F9503291D11E58A6FCC51C09E76DE120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

229a17b9-0490-492d-a3d8-acdd652ba1e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\229a17b9-0490-492d-a3d8-acdd652ba1e9.tmp
Size 10KB
SHA256 3ac2115617b9f3cb4303bc1cb1b1337641f31f8be4894aec35827694170b2c84
MD5 0511f0f633e9941eebd0ffe0d29b0574
SHA1 08de5b0707df8b6e2934ee6e1b15f0360e03f158
SHA512 e98de3be483b059dce666b92ac7f91eb914dcffc6fc1cbe8da205a43b48f85e04678e81f062759327ba8537e056cb1efc1fe5c8b22c8c2aa5aed874b90c316b1
SSDEEP 192:sxZCRbWj/fwsqSIdpL8HW6+WNGY36ngrGEIg5JJ:sxZCAj/fwsqboHbGXe9
TLSH
T15D22C9516E38A9BB4CCBD21DBB15BF53E6F9503291D11E48A6FC851C09E76CE220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c0b71b3-a51d-4508-b178-822a82b87b85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c0b71b3-a51d-4508-b178-822a82b87b85.tmp
Size 10KB
SHA256 ba345dd6cfae0d6f81b151221f7161ac681b27d2c44d066b1b357abb6ccd300f
MD5 dad120f67a2d78f87be4a1c64918e3a9
SHA1 4663da14626c22da9cf24434bb360157a5e3c83f
SHA512 99dd143779735b5acffa689a845a1767712ffa3853683810a4e3d24763eb266ed91e75c9e91f99af20b33e9b29efbccba8d9fdde6af8263b175630c6092e354f
SSDEEP 192:sxZCRbWj/fwsdSIdpl8HW6+WNGY361grGEIg5zJ:sxZCAj/fwsdb2HbGXUz
TLSH
T17522B8516E3869BB8CC7D21DBA65BF53E6F9503291D11E48A6FCC61C05E7ACE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a510e1b-e25c-482b-a131-7fb0d8b6a405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a510e1b-e25c-482b-a131-7fb0d8b6a405.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8c110848-9f89-4871-a8d6-f228e852cfea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c110848-9f89-4871-a8d6-f228e852cfea.tmp
Size 27KB
SHA256 d63d07f0850e7fd49cda70c6a50a300cea7da3f4c1f72d80ec3b78d7dfdfab16
MD5 d681027fb37853b6ee8e2b271478501e
SHA1 6a36265189012aa7db09e009bc607dde52918464
SHA512 b770cfd3d7ae116d8c05315b069068641be68d9964f9e8e11798cd9686693ee8f99c643efd8432ca3f6eadbbd1aa2f543a80ee62aacec9ea12f8f38c2236c304
SSDEEP 768:HzKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/wroxU:HzKlm7QWvUYe0u1ja8/L/E/bxU
TLSH
T1C6C20A3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 33544d8d407adac77b589d18f1c3155e6a844d4814fa8bf3f62648cbfb08238d
MD5 b83b52171d4ae178098cd9fda7985800
SHA1 6e227716ae9d87835b18513582aba9a79f9449fe
SHA512 660742440397f507f9312f1ae68ec6ef5b14bb5f620e9ef03c1336ec885f28a933292c379b5f5fd8163d670f6bc922dda09aef7edee1e5b1c8bb6883c4e62230
TLSH
T1DAE026E426C8CB6EB289A44B01BCAB0C83D536DE96C06D1F2700C5897446280F3E27F0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 7e338b7c9736b89bf16297cdb2bd867cc0ed75f645d2c2c5b4fec0da42643a09
MD5 ae713d39dde13505a28a6d3eacb58a78
SHA1 1f0285d8c256653714f235f0540248c38df6eec0
SHA512 aecc848515ce26c17004d96941225b6e1b3b65c82856a6d7751ff079f879492dcb4eeeae7d4a818eeb002c8c21a1527d20049da3083e8c35fa5d0844a73c9248
TLSH
T1D651E8E09FB1A198F7E883B4F1D1167332B4A090E5831F1F5462E9BD48077F8489436A
MD5 SHA1 SHA512 TLSH

Submit Download

37925a1a-a2b0-4b62-a599-2e2e473d37d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\37925a1a-a2b0-4b62-a599-2e2e473d37d2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

09ce25ea-6083-4074-a7a7-f31110da34da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\09ce25ea-6083-4074-a7a7-f31110da34da.tmp
Size 733B
SHA256 626878c7966c2dcb2cab05f61ef2a1e1aab60246ddc24274766481e0af15d30b
MD5 32d876ce133ed15b3f4dfdc1341eef24
SHA1 65a9746f7ef83bd48abcb1c241a4625d1d2a1d54
SHA512 87d883c724d3b27c257340d3e68464548fd377a6e872b24f047f576015350c33b2982c51d0152e0aeca887451f3d17ab76a3457b98cebb0af2cf29d93983d633
TLSH
T143019CB3C3E499AE8A1152F06A18AF2BCE2D0506431C7C1AC5D4EE2B93F3475E00189B
MD5 SHA1 SHA512 TLSH

Submit Download

1bb5325f-d793-40eb-bd9e-b290653eefb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1bb5325f-d793-40eb-bd9e-b290653eefb8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fd3e6e24-6b04-4146-9a6b-976a2feaf25c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd3e6e24-6b04-4146-9a6b-976a2feaf25c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f562f6e6d8cf2964edef3fb935d05e1167a7b4163efd6f43e5355b6b5bbaa640
MD5 65e96bb513c1be6ba41dc8c06f99df04
SHA1 de41e394d3d3b665521a4bd51d0a20d0582f3b2b
SHA512 497022706406ab26746be330ffc8bff42a8d9d1003afb335c863a6881039a3de093a65315ab113bd246fafd0c6d2c31e4298a009a3da6597d69300a3d576a578
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyLQ/26gK+/b2NWISS/K9u10/xIvY1maY:Kg1SK+Maun2KIQjVmKG4K5
TLSH
T1BE918A10B16F161438BE294940A4863B469231B73118FF3F7BBC51A24E2FE446DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d47f50a4-9c76-4757-ba33-0b5c7624de82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d47f50a4-9c76-4757-ba33-0b5c7624de82.tmp
Size 10KB
SHA256 3604f4cd7d874f785671d7ff4821db0ae9da66d3366d37e5efd8e493624a70e3
MD5 afa855f20b517c04d14deb3cbf700177
SHA1 e273a464d79dd793149dfdcbdf71c7227fbd939c
SHA512 c272038d10539f3910b22f18b1b90667957a40b36743b06a059cc85fda00f0c8b68974e3d7f0d0cf3c55298802d122e0ca07ead8608840a4788ae6fa29bd5503
SSDEEP 192:sxZCRbWj/fwsdSIdpL8HW6+WNGY36tgrGEIg5zJ:sxZCAj/fwsdboHbGX8z
TLSH
T17122B8516E3869BB8CC7D20DBA55BF53E6F9503291D11E48A6FCC61C05E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3d4765-606d-46cc-b8dd-6dbdf79f4114.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb3d4765-606d-46cc-b8dd-6dbdf79f4114.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

abc5c89c-f10f-4bb4-bb4e-88b5bdcd65c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\abc5c89c-f10f-4bb4-bb4e-88b5bdcd65c9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a650d6a3-b48c-4eda-85d7-b9667a3c6a23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a650d6a3-b48c-4eda-85d7-b9667a3c6a23.tmp
Size 21KB
SHA256 11dfc434f71d834d17e40264df7e183b2635e4976707d6075acd3ed2e98ee6bd
MD5 d849d4082f96879157216242b824d80b
SHA1 7e6061309543a76b6c79b6120c0fe002136fc8c0
SHA512 77fddc8a6628ce8287e4502017e821232c90531a8acf85800834e7d8ed665186450d5a252db62c0d085006e41d9298068e60697f41dd9851638e5ce264b3cc89
SSDEEP 384:HiFiZcI4zsNO8TUNTUlIl49bYLGPRh//GJ8JtgOIwZOyCoZ:CFQEvwg0///JXsbC
TLSH
T1C4A26D335CA898BFADFB9A45F58672038EB48067C7C5EE94D6DD6A1D01D70E8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f1dfd93-3270-4dfb-a08e-bd1b8909d8da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f1dfd93-3270-4dfb-a08e-bd1b8909d8da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a8b30625f46943be6a91108701d8eb2cea58bae3a5e5e748087f84a2e42c7d85
MD5 42ef8057ab319423955d8914208fc9c2
SHA1 fdda4aaf817db766f4c335b27a3db3f33c0dbceb
SHA512 dfe66a8bfbaf140e4f0e483daf377986064352c5be5a1b3600d318c08eca32dd7c0b726195f2de8caea04bc58a13126b173f8e7e2c3a6386f35d579c08778d97
TLSH
T11041265CA6E91108B3B76F5AAFF6B86E487BBD732E06905D00100E4E0A66B41D8B1733
MD5 SHA1 SHA512 TLSH

Submit Download