hxxp://wemqmewkqewq[.]work[.]gd/ow[.]sh

Analysis

user interaction
yes
max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/10/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wemqmewkqewq.work.gd/ow.sh
Sample261014-lez72sa17m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1096	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{632E4255-D3C2-4AB5-ADD6-C3FBFDC7C09B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 5168	3108	msedge.exe	81
PID 3108 wrote to memory of 1096	3108	msedge.exe	82
PID 3108 wrote to memory of 5228	3108	msedge.exe	83
PID 3108 wrote to memory of 5228	3108	msedge.exe	83
PID 3108 wrote to memory of 5228	3108	msedge.exe	83
PID 3108 wrote to memory of 6108	3108	msedge.exe	84
PID 3108 wrote to memory of 6108	3108	msedge.exe	84
PID 3108 wrote to memory of 3228	3108	msedge.exe	86
PID 3108 wrote to memory of 3228	3108	msedge.exe	86
PID 3108 wrote to memory of 3228	3108	msedge.exe	86
PID 3108 wrote to memory of 5052	3108	msedge.exe	87
PID 3108 wrote to memory of 5052	3108	msedge.exe	87
PID 3108 wrote to memory of 5052	3108	msedge.exe	87
PID 3108 wrote to memory of 5940	3108	msedge.exe	90
PID 3108 wrote to memory of 5940	3108	msedge.exe	90
PID 3108 wrote to memory of 1328	3108	msedge.exe	91
PID 3108 wrote to memory of 1328	3108	msedge.exe	91
PID 3108 wrote to memory of 428	3108	msedge.exe	92
PID 3108 wrote to memory of 4740	3108	msedge.exe	94
PID 428 wrote to memory of 2412	428	msedge.exe	95
PID 3108 wrote to memory of 5552	3108	msedge.exe	98
PID 3108 wrote to memory of 5552	3108	msedge.exe	98
PID 3108 wrote to memory of 5552	3108	msedge.exe	98
PID 3108 wrote to memory of 5852	3108	msedge.exe	99
PID 3108 wrote to memory of 5852	3108	msedge.exe	99
PID 3108 wrote to memory of 5852	3108	msedge.exe	99
PID 3108 wrote to memory of 3336	3108	msedge.exe	100
PID 3108 wrote to memory of 3336	3108	msedge.exe	100
PID 3108 wrote to memory of 3336	3108	msedge.exe	100
PID 3108 wrote to memory of 2280	3108	msedge.exe	101
PID 3108 wrote to memory of 4456	3108	msedge.exe	102
PID 3108 wrote to memory of 1508	3108	msedge.exe	103
PID 3108 wrote to memory of 5504	3108	msedge.exe	104
PID 3108 wrote to memory of 5504	3108	msedge.exe	104
PID 3108 wrote to memory of 4392	3108	msedge.exe	106
PID 3108 wrote to memory of 4392	3108	msedge.exe	106
PID 3108 wrote to memory of 4392	3108	msedge.exe	106
PID 3108 wrote to memory of 4196	3108	msedge.exe	107
PID 3108 wrote to memory of 4700	3108	msedge.exe	108
PID 3108 wrote to memory of 4700	3108	msedge.exe	108
PID 3108 wrote to memory of 4700	3108	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wemqmewkqewq.work.gd/ow.sh
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffeb148c188,0x7ffeb148c194,0x7ffeb148c1a0
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,11383275862739845776,9609038908955453200,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,5710028326934890096,3284137619989370337,262144 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,102387941567245056,7163634258890930542,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,17361668389165643737,13155142418960229628,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,13766317316062662760,12186773651021367329,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,16926748604836742495,6938761748757071423,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,6901990886696133058,10097754559544174766,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,1396821083164115968,10788113959992567316,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14090757212750583015,13203432931569054565,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14090757212750583015,13203432931569054565,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6152,i,4212324605138635520,2080460922199087785,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3740,i,8431410934980300726,9130509899444300319,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5864,i,15551683502765477370,9954371050375846969,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4521367315414079274,17896543291529592646,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,1142708123311923705,11175637264039568105,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17269874293948175189,6537985783170335492,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,13775331056854892520,10044968658767107894,524288 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5288,i,6827271944609100214,341551099790203770,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,16034656297215454829,11636230547175167649,262144 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5016,i,1812805442187943175,3173731655599950769,2097152 --field-trial-handle=2132,i,203149366075972858,7156668755941645822,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

115cede0-6c0c-41bc-b700-927c464cf76c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\115cede0-6c0c-41bc-b700-927c464cf76c.tmp
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6abf5070-b66d-4173-aa17-e5764159e1d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6abf5070-b66d-4173-aa17-e5764159e1d7.tmp
Size 12KB
SHA256 9f95a6bffd74fd6018634511298298414f0fddc59f352d787ff69d91b285f96c
MD5 fb219943a576a588847d34cd707a8c4b
SHA1 d7687baea83bfe75bc9d369cce9bca878222ec02
SHA512 5cb802233cf890c5f3111f8c7974a61b256c7ff08e358c32ca3f696164492c541ed46ed87beaa4797a9d651af50a9d5dc8f2ce737e74294709b6724f90cdec35
SSDEEP 192:sxZpRBFo/fFs1I1ZqMq2zodp5b/EE6+WNOOM/Y0g1wpVuRv+BIg53cJ:sxZp9o/fFsq7q9p/+I/5Q64vQRA
TLSH
T11B42D815AD28AA3F8CC7D61ABB55BF53D2F95132A4851F48A6FC8A1C04F76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81ec6c27-f21b-4e49-b776-d23782defff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81ec6c27-f21b-4e49-b776-d23782defff9.tmp
Size 414B
SHA256 8b11658496e01ce3c9861cc56fb1eefa0065e9a50f5d4378f745dbbbb1154fd2
MD5 1039a306679a3cc1611e5d90d4692b36
SHA1 196d1c0e4ce28c0336de7b150969dc1f56f1904f
SHA512 06a3fb9309b7901aebf4a7cf5556007a5ca472a9f27f65a53cbed1483f35222b61fafe510ad976c063c892f7b40f1df3c838f774b60e0b9c155d839effa1587a
TLSH
T1C0E02BA9C822AC3B18FB072D60944B4AEB5113572E51854B3A3C91188FB4A3A8185C5C
MD5 SHA1 SHA512 TLSH

Submit Download

84a5ce0e-59d5-476e-8d36-8603628baaed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84a5ce0e-59d5-476e-8d36-8603628baaed.tmp
Size 12KB
SHA256 b1eba87342ce8299e073b67eb14f4985eb710ec1d6316dd04b2bb881754a438b
MD5 e90fe5d4e113d1de641aaeba170f0cb3
SHA1 d627a33fb3f11b39566a1f467dbe85a80727ba01
SHA512 ead2ca8888219c004744629bc21985cd13b5e271ad85f1caa1ac4b9ae8d7886f60542577aa27d7f2151ec18202d8bb94cbaeb8405f6c5331c52c85e748cb5000
SSDEEP 192:sxZpRBFo/fFsHI1ZqMq2zodp5v/EA6+WNOOM/Y0g1QpVuRv+BIg53cJ:sxZp9o/fFso7q9Z/6I/5Qa4vQRA
TLSH
T1D642D915AD28AA3F8CC7D61ABB55BF53D2F95136A0851F48A6FC8A1C04F76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

494d6e1c-d924-4008-8f62-1451d926f0a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\494d6e1c-d924-4008-8f62-1451d926f0a2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

467e245c-3de5-42b3-9b2b-b364bd44dfef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\467e245c-3de5-42b3-9b2b-b364bd44dfef.tmp
Size 1KB
SHA256 a37a206b39036f49eeb1298084cbd61faa5e60f1db84348799f18cd1d3fd940a
MD5 82079436051458edd28c7f6663334dbf
SHA1 ceae1f60b062c6f7c3b7a5b2e915875f2e3a9520
SHA512 1c6613778cd0fadde8ef67581914b212254960204d84bc42ada3ea1bd6ff6c78346e9bb45d576039350d766e32eb32858dd4a48763f77ae303194400d6194e5a
TLSH
T12F31AFF383F4856E8A0196F0AA18AE2FDE2D0515432C7D9AC5E4AF2783F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

67e68f3b-a99c-4b36-8de2-bccad933d1a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67e68f3b-a99c-4b36-8de2-bccad933d1a5.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

cafc8dac-9835-455f-9e8a-445bc4fad667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cafc8dac-9835-455f-9e8a-445bc4fad667.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2dfef952b0edba0cfdaa0423208790c711b8191a21dd2ad35256b51840661335
MD5 c87d723fdd99292aa54b80b6522df697
SHA1 51bece49d88ff8f74abbcf063b6174e667f8beba
SHA512 f4dec712a556b3d6226534969422e8e94bd2779eee921e3c918f6771a60b9dea290de293fc28c5c19ea16821fc19a48ce8dc88da82345c39573950c15bc19675
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAge:ohdNdBzXXFPXgRbKvtp0JlznUmxH
TLSH
T1F7B2565130BA12553CBE390890B59B2F528135B3711CE62B7FFE10A68E6BE481DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bdf54296-64b1-4b07-bf52-f2549ba336e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdf54296-64b1-4b07-bf52-f2549ba336e9.tmp
Size 11KB
SHA256 9f7aafbf78628c8870832bf6eb26f1e9bd52d7e6363ca5d1c4090cee7487f7b2
MD5 bbcf107185ce59de601e7abb4047aa07
SHA1 f8e6b1397816f8993040a71d4caab1b27cfc8d4c
SHA512 eec156982e516f030db7d01188dfd6780f139a8b0d639d576c725bc5b3da0040abbfeb75a02378cfd8db04a65e73d7086bc99609a1842f6413bb4052ddfdb550
SSDEEP 192:sxZpRBFo/fFswI1ZqMq2zodp5b/Eq/6+WNGY0g7wpVuRv+BIgjcJ:sxZp9o/fFs97q9p/eG5Q64vQjA
TLSH
T16542C815AD28A93F8CC7E61AFB557F53D2F95133A0851E48A6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa5c8e51-8a38-4ad7-a33d-a8b2207795ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa5c8e51-8a38-4ad7-a33d-a8b2207795ca.tmp
Size 27KB
SHA256 a41d196cb73008a11f3a50bd69d2f126269f8e67eb0de20a2cec808d06bbb4f5
MD5 dfe2e0c232283d861edff56b633dce62
SHA1 eb86909b2ecaacf97a0910d6c2ce60cfae1fb4d2
SHA512 a68f3a9e0088fd11db5435fadc397a386193742735762b6b093cf4c73f4f0284249f7b489b7fa20270aed706f9b6b00aac15e67423e9ff6fd5403aef8e3df4ce
SSDEEP 384:nyiFzQkUSvm38NJ8TUNTUlIR2CC7G4GoSRxzyfoBjI9zDqiMPvhYPJAxJOCh+gLW:5Fdm3+wgrCXETdBs9DyhYPkJOC6Lr
TLSH
T124C25B36ECA5DEA7EDEB4F96A34E3643DEE04263D98C9AD4D9C91C1C009719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b843a5d9-718d-4371-96a3-d0c7ec311fde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b843a5d9-718d-4371-96a3-d0c7ec311fde.tmp
Size 26KB
SHA256 196212013a5466ead56ca0fe3f4eb97cf016960a0f9f54fa389f11e7bf21c032
MD5 c22245260f5be70847e15b030697e20f
SHA1 56e51c602b00911dbf20e70ea270d00c830151f2
SHA512 a4d35299f8ea7239a0b491cb8f8ccf290fd72b035aa6376a674484d1ec08a1207d3e2fb0c653df13773124fb58ffa65b8ec07ddbca9e870c983aa46e64ae6a0b
SSDEEP 384:niiFiZcI638N98TUNTUlIxBCC7nTgSxzyfoBjI9zDqiM1vhY7O6R2FeoS5gL/7Im:pFQ63OwgCC4IdBs9DuhY7TRFm
TLSH
T14BC24B36DC94CAABEDEB8ED6A74E7A02DDF04253D98C9AC4D9CC5D1D009759E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b97c6edd-9abf-43c2-82eb-6aa2b189a26c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b97c6edd-9abf-43c2-82eb-6aa2b189a26c.tmp
Size 27KB
SHA256 3482ae45c0644af635194efc558f0fc16ab0ff3404ca849f8c7ad9c2fc1fa5a9
MD5 aa7d1f1adf31a1e4f2adb1ccda5f4541
SHA1 767f347fac8a365d22fb18260f4dc158fc16d641
SHA512 19c2970190d546cbe67f91edfff2f310f7481e73af2de8ae53a1b467d34722f6e07238254435faabb04f48bbae48a650e5d7e9da2f191f6f8f20ee22ff19e7a5
SSDEEP 384:ndiFzQkUSvY38NJ8TUNTUlIR2CC7G4GoSRxzyfoBjI9zDqiMF/hYPJAxJOCh+gLW:UFdY3+wgrCXETdBs9DmhYPkJOC6Lr
TLSH
T10BC25B36ECA4DEA7EDE74E96A34E3643DEE04213D98C9AD4D9C91C1C009719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f13df817-b721-402a-9451-e76e022d9d87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f13df817-b721-402a-9451-e76e022d9d87.tmp
Size 27KB
SHA256 9b776375cf480e14396383cf644e6893cdf46fd8e0237ec39e6e4eacaa922d03
MD5 2ba43e961f32584c89a9e391952fb907
SHA1 9df586d50efc59efcab4fe5397d865e58cc98435
SHA512 d20ef67e88c2d3fac8cadc6f285193b2ed97cd761a5c02dda6b402c5e6747fdf1fcb816da1dd16e6c8fb51185b8954fd07d6535eedebd94e23e956f62af00f5c
SSDEEP 384:nXiFzQkUSvm38NJ8TUNTUlIR2CC7GGoSRxzyfoBjI9zDqiMPvhYPJAxJOCh+gL/e:SFdm3+wgrChTdBs9DyhYPkJOC6Lr
TLSH
T135C25B36ECA5DEA7EDEB4F96A34E3643DEE04263D98C9AD4D9C91C1C009718E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4d9ac66-edb9-4380-90f6-2dc76bba9c76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4d9ac66-edb9-4380-90f6-2dc76bba9c76.tmp
Size 25KB
SHA256 44fb1336f94a6134cffa53a0026e10f9a92efc4db4a695747b2008c2f638e26c
MD5 012d4eadb24e3ee3c39436ff3a4f72ac
SHA1 b64222faf5df8f865ff462d6611e1ed3f89c78a5
SHA512 e6068b7ce39ea3b010778459384844f083c4b5f2902763d0d30ee592b2654ef70bd0f38f3bd6e53adfe5121162a3cfcd03d7b5d66c07f292841c5413ea7b3b4a
SSDEEP 384:nSiFiZcI638NQ8TUNTUlIxBCC7JrVcxzyfoBjI9zDqicQh807O6R2FeoS5gL/7Im:ZFQ63vwgCCtVWdBs9DZhf7TRFm
TLSH
T164C25B36EC64CAABEDFB8F9AA74E7A03DEF00153959C9AC4D9C85D1D009719E1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4740-196-0x000001FF199A0000-0x000001FF1A9A0000-memory.dmp

Download