hxxps://covwu[.]vu/excu/accounts[.]google

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://covwu.vu/excu/accounts.google
Sample261005-tx8aday13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1052	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{BBCF1BD0-D04F-484D-AB2D-FD62A49128FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5072	5096	msedge.exe	85
PID 5096 wrote to memory of 1052	5096	msedge.exe	86
PID 5096 wrote to memory of 5440	5096	msedge.exe	88
PID 5096 wrote to memory of 5440	5096	msedge.exe	88
PID 5096 wrote to memory of 5440	5096	msedge.exe	88
PID 5096 wrote to memory of 3228	5096	msedge.exe	89
PID 5096 wrote to memory of 3228	5096	msedge.exe	89
PID 5096 wrote to memory of 6064	5096	msedge.exe	90
PID 5096 wrote to memory of 6064	5096	msedge.exe	90
PID 5096 wrote to memory of 6064	5096	msedge.exe	90
PID 5096 wrote to memory of 5752	5096	msedge.exe	91
PID 5096 wrote to memory of 5752	5096	msedge.exe	91
PID 5096 wrote to memory of 5752	5096	msedge.exe	91
PID 5096 wrote to memory of 1140	5096	msedge.exe	96
PID 5096 wrote to memory of 1140	5096	msedge.exe	96
PID 5096 wrote to memory of 1140	5096	msedge.exe	96
PID 5096 wrote to memory of 3332	5096	msedge.exe	97
PID 5096 wrote to memory of 3332	5096	msedge.exe	97
PID 5096 wrote to memory of 3332	5096	msedge.exe	97
PID 5096 wrote to memory of 3948	5096	msedge.exe	99
PID 5096 wrote to memory of 3948	5096	msedge.exe	99
PID 5096 wrote to memory of 1780	5096	msedge.exe	100
PID 5096 wrote to memory of 1780	5096	msedge.exe	100
PID 5096 wrote to memory of 3984	5096	msedge.exe	104
PID 5096 wrote to memory of 2484	5096	msedge.exe	116
PID 5096 wrote to memory of 1836	5096	msedge.exe	117
PID 5096 wrote to memory of 5372	5096	msedge.exe	118
PID 5096 wrote to memory of 4560	5096	msedge.exe	120
PID 5096 wrote to memory of 4560	5096	msedge.exe	120
PID 5096 wrote to memory of 1728	5096	msedge.exe	129
PID 5096 wrote to memory of 1728	5096	msedge.exe	129
PID 5096 wrote to memory of 1196	5096	msedge.exe	130
PID 5096 wrote to memory of 1196	5096	msedge.exe	130
PID 5096 wrote to memory of 2892	5096	msedge.exe	133
PID 5096 wrote to memory of 2892	5096	msedge.exe	133
PID 5096 wrote to memory of 4568	5096	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://covwu.vu/excu/accounts.google
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe226dc188,0x7ffe226dc194,0x7ffe226dc1a0
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,17320222518530498148,6697573164908757184,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,4132592447219116546,13712786488454041357,262144 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,14643114972774727653,12901800141148997447,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,3819411610819020354,2944338050641891936,2097152 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1852320778319258094,416698787843676815,2097152 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5292,i,11098032328942289324,5764136496086103508,2097152 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3452,i,7977138277285707988,10877242347065144953,2097152 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,13653441485390043518,16858476585352026794,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,14847665764530215547,14875974431492364215,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2710453151778029932,14352600062196416899,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2710453151778029932,14352600062196416899,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,1139118491985087932,5343118765614108550,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,10736805273550743820,1433494815042094816,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13993871098892337091,880686655337894588,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,16355972909966791925,3870197879485524749,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2822744346120916433,14574701763055823067,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,9648697383196967440,4949349301178460411,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,8269597745117406588,16520281204317962369,524288 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6692,i,376402643518491991,1870136775285352873,262144 --field-trial-handle=2356,i,9108648279402548,6496212101500616800,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57237159-dcdf-429f-baa7-ff6ace9e7e18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57237159-dcdf-429f-baa7-ff6ace9e7e18.tmp
Size 26KB
SHA256 70bf24275c6b627bf75b06fa6d8cf8a1bc5a9c214769045b3844521ed4886486
MD5 fa175cd837fcbfa040bb4aca3e678336
SHA1 738f3f97ea356fed2b3b81afe1c8694461069303
SHA512 1a6f3d384e293698859445079afd26caa01413cccf4c21b67eca4b9b684d50c44fb89212e6875ce99282167ec8ac0469563731d863fe87d76c87f5a45e35206e
SSDEEP 384:ndiFiZcI/sN68TUNTUlI4E5mgurW8HK2flBCupuSAiJncVmAJNNLwgL/7IzMoR:UFQ//wgSPpBnpfDcYENxJO
TLSH
T1C2C26B72ECA4DEBBACEA8BD5B74A7603DEE44113959C9AC4D9C85D2C00D71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1c00ed94-5e94-4fbe-b70b-188ec7cdd2f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c00ed94-5e94-4fbe-b70b-188ec7cdd2f2.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79280d80-ebed-4e8f-a6d0-e2af48851e18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79280d80-ebed-4e8f-a6d0-e2af48851e18.tmp
Size 649B
SHA256 6ab8e7ec95ffb4fca851b11477c25b772e193fc79da4e4362a89eead5f155441
MD5 e5779f496ee2034e5b0e056ebf245a29
SHA1 e7eccf6f0fe0d8c5433038abe2fddcebddfe9d44
SHA512 ebf896c743140aaaa8f463257c9da3b3c20325d1c0eea1058eeab03836412e5e254a187e071a964021375d6898fd6c28cacc72213468081c922b7b1a700a8b13
TLSH
T1AAF02DB5CD25BC3B08FC1B1820A50646FB5113572780988F3F3DC11D8FB1A7B864691C
MD5 SHA1 SHA512 TLSH

Submit Download

80249128-31ba-43db-bcf4-1b95231594e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80249128-31ba-43db-bcf4-1b95231594e8.tmp
Size 12KB
SHA256 4d94fa7a47b006d0aa87620b2e0e761f12e2c41d76f8e6bb2b8c7e1f3810f7b0
MD5 32f5ee1ccbd598a3bc714170af91c604
SHA1 fa88e2b2c3df80aa38f561bbec344967b31871e7
SHA512 3326bcc72a152786d42a67962d84f913073ac9193a2a94cac7f89d2190302aa674e4fbbf077a22310c95d461985cae2d2ee4dcb85ff0aa45f6a8056267cf88eb
SSDEEP 192:sxZGRGkm/fLsiQZZyRzodpaxHW6+WN3oyIXYbIC1Yi/Ig5mBJJ:sxZGfm/fLsiOZyaeHbgXFCYmoB
TLSH
T1BD42C615AE28A97B8CD7E209BB55BF53D7F91032A0951E48AAFCCA1C14E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0c5eec2e999e2fa0cea65d344657fcfc664b9496b288d7cc511e9a75a4472f03
MD5 279acccd8531042d081b1b0acaa59925
SHA1 39336102dcbddd17c8c9123c407b369383bcafbb
SHA512 74aea57b8f0a5bfcba3f89df47571719bf730970c2267fc9e13ece51c0d0d4fae6688cc5254b1de84ca266185c30b611700931d7d7934324c801a51812045df0
TLSH
T1CFE07DE425CAC22EA32C75D713ED631C8388372FD3D0699E2724C585B4071C4BAC2BE6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0a65c6d41df98d8975e40192fac5c806e003022ebd2bd83da1fc8298ebce4d0f
MD5 3cb799661b7fcb305b7b7e605c1c90f4
SHA1 78d74e202b3a6b09539320712ecb9b5d4dc40018
SHA512 59a977fa6d86d9cd43a4bb9eadb4307cbf30447e3a0aed6fcba7fc59a2afd5252e5a9bb538c7a2f7fc5d5269b4bb17bd39d8fd85ded2dda7bbea39776a785c56
TLSH
T199E026E40ACAC23EB30E64D7026C936C8388373A93C07D9E1704CDC97806040A683BA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1db3bfd0a9b1c321ad61c24cb6d736d83c6bd871ca9ef69bb8c24e4d2ca6c85e
MD5 523064b9342cca93c2fc513fb84cdde3
SHA1 1dd96f9a5677d55d11323caf2c1a2bda6a1e82a5
SHA512 792e23e246c189633bcdcbc8795833c1c7a03cd6b4919245ee54caab241e69e9928b60969d1943f968c48ea354e6b0e300dc8024dd4530acdb1f471d9f728cd7
TLSH
T140E020D414CFC21FD11C74D70155530CC78437BE97C0695D5704C98978C64847681B68
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 6b272735405e7103ff353f1eda9326ba82f8e955b6c8d8404df153c302f9a8e1
MD5 eedc51c5522c3e647e4dc9b8a6bdc79f
SHA1 48148a3f2c8b31caf451aff0a96c525831406b3f
SHA512 9058786e4a5d289407a757254bbe0b97f8c470cfaea2b4993426bed7ca39e3b30b164a4216cdf8f4f3cd9ad2127e27a75213756de403a8159e59e6a5f7e40daf
TLSH
T1C551EC8386907AC9FFA411B785F6138735F5B482954F9F320B98C3797853B0E9198774
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7af1e58b2aedbf805274890f3befeafa16152f1daa9cb5723d39dd75b3d2c5c8
MD5 1a59eb7a45af92df0920ca184f0de64e
SHA1 5bd8f44c7bec6e684d4dfcca43ed6bc2d2f807a2
SHA512 f8707fe7db50d7541184ba75ffd1d0e0d1c1b019214c1242c68b012448a8183106d58e91828d7ee77f26bc42c4c2fd7e850f475e9e1f51521e08388f7cca06a6
TLSH
T1EC512D838A807ACDFFA411B385F5138335F0B442968F9F320BA8C3796853B0E9198770
MD5 SHA1 SHA512 TLSH

Submit Download

7ac1b2f8-7700-45d0-a33e-f6cd8c4dbe02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7ac1b2f8-7700-45d0-a33e-f6cd8c4dbe02.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6ad360cd-daa2-4aad-8ea9-7714b6be3e56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ad360cd-daa2-4aad-8ea9-7714b6be3e56.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d88cf123-67db-460d-8831-b4d7d5d4e6ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d88cf123-67db-460d-8831-b4d7d5d4e6ca.tmp
Size 3KB
SHA256 295c4b609a0b764d16baf74bbb33936aa6824467ade21658b67a90fbf0521067
MD5 c52cf7f540999d5768a996ea52a5dc85
SHA1 c805223b9ead1e36aaaebc09a67d77aad02efaba
SHA512 a176d025796a4e56b85cf24d94575b20d787e4daa16b765fc1307d1a1df5bdeb80223c2541c972f0176674f37ea31d2d41e8e09dd09d5c4f712a80ee03ca85ad
TLSH
T12761AEF3C3E8966ECD0196F0AB146E2BDE6D0A54422C3C1E89D4DF1BE7E2470D14169E
MD5 SHA1 SHA512 TLSH

Submit Download

e7422174-d673-4a87-bf35-240f6bec0eb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7422174-d673-4a87-bf35-240f6bec0eb3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0234d388548bb918cf19c0a868fa5cde6e4ba6585707747665aba1cbe2410e1c
MD5 00466d743425b4d1186f85700a01a2f4
SHA1 8f8dcd1412a5136197beb3d5811bcc537a430de9
SHA512 6471dcd4ecb38f081cab7da8983193705f0a98e8ade2a871381645e827ee9777534d27ce06c5ccc0c406e4426d84bd7189eb5846647ab1ecfd1d262fe46f02ae
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXSZDp:OtfFvpopPxrB4RhfS9p
TLSH
T1FBB2211571BA021138FE690881B58B2F064232B37158E73B7FBD15A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a165cb7e-09ce-40df-9839-78b6820b2ab0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a165cb7e-09ce-40df-9839-78b6820b2ab0.tmp
Size 11KB
SHA256 47e6879e11315363d96aa22e47be80f51e92af8ec2e2a565593ea8495e145adc
MD5 a23a040d09823f113d74741686e822d6
SHA1 067959ab35528677e19a23992bef0a66d4a11dd1
SHA512 f17c3ec9e64906a86c56a376e22c6a31bba7176576c53fd9e24d1880c3aa9a64bb807e8554a25b31a28cd5e5b44637a7657e01637c0a08de8b608807308ea0d4
SSDEEP 192:sxZGRGkm/fLsLQZZNRzodpa8HW6+WN3D4/YbId1Yi/IgjBJJ:sxZGfm/fLsLOZNazHbE/FbYmjB
TLSH
T1A242C715AD28A97B8CD7E209FB55BF53D7F91032A0951E48AAFCCA2C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8d72220-e51d-4cff-85e3-b0d49f7d7b9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8d72220-e51d-4cff-85e3-b0d49f7d7b9a.tmp
Size 12KB
SHA256 d136e744426c88b49a1080c887804f7dfa12c49206004791f067cf713e4b4b44
MD5 96a5f56f9499d1ea907ce1519ef65320
SHA1 4d894aefa142dd9437d43c082ea5b2015446a159
SHA512 0774839f195ae9ede5a5e77704a43069984c7cbc145affa91982a35f2c49cec6962ce4817c3e8eae6ea6dbc4b92fefc4bb6b99879b3a29326f469b0c9044ab3a
SSDEEP 192:sxZGRGkm/fLsjQZZyRzodpaxHW6+WN3D4/YbId1Yi/Ig5mBJJ:sxZGfm/fLsjOZyaeHbE/FbYmoB
TLSH
T14042C715AD28A97B8CD7E209FB55BF53D3F91032A0911E48AAFCCA2C14E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c054a3fc-1a7f-401e-861b-e5e9461c875a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c054a3fc-1a7f-401e-861b-e5e9461c875a.tmp
Size 26KB
SHA256 723a3a01d8298c000133ea712e4095e353ad01e5b305a3644931c4882a6770d5
MD5 bf89d5401133ac9db0e88dd85ade6928
SHA1 8cbe240b1cc38d6d1a0c2775c6128c95791767c3
SHA512 fbd9e79be92e2e986b6021aa2c30ac9873e2d559ab04efb3b65e4755482e448d4bbf11c0714ce3bb5393a33d824f6150826a69ec49aa9dd7639c1c39c366ac7b
SSDEEP 384:nviFiZcI/sN68TUNTUlI4E5mgufW8HK2flBCupuSAiJncVmAJNNLwgL/7IzMoR:6FQ//wgSDpBnpfDcYENxJO
TLSH
T105C26B72ECA4DEBBACEA8BD5B74A7603DEE44113959C9AC4D9C95D2C00D71DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0df011e-be15-4b13-a1f9-a2b2ea98d9d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0df011e-be15-4b13-a1f9-a2b2ea98d9d6.tmp
Size 25KB
SHA256 ca630852b53adbdd442170f4ea5c03973c3f13e420246f13e341fb32994e19d4
MD5 859913c3406454e72750ff947c8f0a7f
SHA1 4fd8f5f703591776d65b7efda56cd9fe1df64b39
SHA512 d0bf83234594a8526859b7d080cfc922ca27e497ca08f9b9fd476f4559c31ec6a33a4e994ae64982b55625bede43a43e8112bf02264635c9dec91cd544fcadb5
SSDEEP 384:nSiFiZcI63sNZ8TUNTUlIm25mg55nK2flBCupuSAiOrsa+VYqgL/7IzaoQ:ZFQ63owgS+JBnpf4rhgCz
TLSH
T159C25B36EC99DDBBECEA4FD9AB4A7A07DEE40163909C8AC4DAD95D1C00871DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbd9e57a-aa60-46c2-a054-3d48fb8684b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fbd9e57a-aa60-46c2-a054-3d48fb8684b2.tmp
Size 32KB
SHA256 66348720eb81db0e577d1c826c5b88bc3c84f4bb55d1c2841dfefed3fbd0bbb4
MD5 0149bea0b1cc0c2451ab35f6e31518b2
SHA1 0b585f07e37417be0d35df4371f5abdaa074f853
SHA512 70ad5d1efe49a88c127a6991d627724d6b0a8347eeaf7102995e3d643845213fb9071cfb608f8c89d1bb90442e3ee1edcd2b6ca7a60da55c167c270ee902d285
SSDEEP 384:nriFiZcItVsN68TUNTUlI4E5mgurWnHK2flBCupuSAiJLcVmAJNNLwgL/7IzMoR:GFQD/wgSQpBnpf3cYENxJO
TLSH
T15FE2B3F198D7C9B7E8AE4B97673D6E0299BCC113B5885984B7C84D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37f65730e3789dd39e2be3ecf2c3846cafdb6ab5b8d00b89f8844a460dde921f
MD5 0283313f7eb3b0407271ec1e4f92dae6
SHA1 3e074286409e6a4f91852a9eefd72a05ac719c33
SHA512 d033bb151f518ab3bd468794de139ec4ac9365da8d49ee685603576a162e6a0c43728200921462df7acbfd68de0bf998530463dda8ff700cc8764928af2088cd
TLSH
T178413D5CABEA1148B3776E5AABF6646E447ABC373E0BD49E00110E4F0A63B01C871733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3984-218-0x0000026F80000000-0x0000026F81000000-memory.dmp

Download