hxxps://guns[.]lol/8uec

Analysis

user interaction
yes
max time kernel
23s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://guns.lol/8uec
Sample261024-rhmn1sfb29

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2760	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{1657BD3D-103A-4F5D-A7B2-6FBE2DC0FB34}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1980	4740	msedge.exe	86
PID 4740 wrote to memory of 2760	4740	msedge.exe	87
PID 4740 wrote to memory of 1864	4740	msedge.exe	88
PID 4740 wrote to memory of 1864	4740	msedge.exe	88
PID 4740 wrote to memory of 1864	4740	msedge.exe	88
PID 4740 wrote to memory of 4348	4740	msedge.exe	89
PID 4740 wrote to memory of 4348	4740	msedge.exe	89
PID 4740 wrote to memory of 3180	4740	msedge.exe	107
PID 4740 wrote to memory of 3180	4740	msedge.exe	107
PID 4740 wrote to memory of 3180	4740	msedge.exe	107
PID 4740 wrote to memory of 2316	4740	msedge.exe	92
PID 4740 wrote to memory of 2316	4740	msedge.exe	92
PID 4740 wrote to memory of 2316	4740	msedge.exe	92
PID 4740 wrote to memory of 4456	4740	msedge.exe	94
PID 4740 wrote to memory of 4456	4740	msedge.exe	94
PID 4740 wrote to memory of 4456	4740	msedge.exe	94
PID 4740 wrote to memory of 1808	4740	msedge.exe	93
PID 4740 wrote to memory of 1808	4740	msedge.exe	93
PID 4740 wrote to memory of 1808	4740	msedge.exe	93
PID 4740 wrote to memory of 1292	4740	msedge.exe	98
PID 4740 wrote to memory of 1292	4740	msedge.exe	98
PID 4740 wrote to memory of 1292	4740	msedge.exe	98
PID 4740 wrote to memory of 1768	4740	msedge.exe	99
PID 4740 wrote to memory of 1768	4740	msedge.exe	99
PID 4740 wrote to memory of 1768	4740	msedge.exe	99
PID 4740 wrote to memory of 4904	4740	msedge.exe	100
PID 4740 wrote to memory of 3664	4740	msedge.exe	101
PID 4740 wrote to memory of 4904	4740	msedge.exe	100
PID 4740 wrote to memory of 3664	4740	msedge.exe	101
PID 4740 wrote to memory of 2148	4740	msedge.exe	102
PID 4740 wrote to memory of 2148	4740	msedge.exe	102
PID 4740 wrote to memory of 3180	4740	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://guns.lol/8uec
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff97891c188,0x7ff97891c194,0x7ff97891c1a0
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,18361699183109214489,8629009658911087960,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8202015136352419817,17068623180231268517,262144 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,5098110026409354505,14627326824594270669,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16473168219909711590,18196544639296157235,2097152 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2091554245053120159,16812964484363504202,2097152 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,3185212114971382843,2283063687610812115,2097152 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,4511355878808322548,3218288411716836494,2097152 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4992,i,5673485824214286636,15850481542222499431,2097152 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4976,i,11316410470212216544,3767424769255350480,2097152 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,18401289535384070641,5908632723572892432,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,12843183566294906879,2921970260109024066,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7933992103613725382,2949889614861388775,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,13969142866141845979,10748308639737213288,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,13969142866141845979,10748308639737213288,524288 --field-trial-handle=2264,i,2134699045835081292,16252380552682448215,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

477b91ca-00f6-4fa6-a8f9-02bae6eeaeb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\477b91ca-00f6-4fa6-a8f9-02bae6eeaeb8.tmp
Size 8KB
SHA256 3f02b4f92d3b72fa58d922cb82cfd0171527933b5bd1f44eaa0639246b69f98a
MD5 af9a2d4476e45335395c28e84fea4501
SHA1 f84f344455def44ba35c90123fbbb807901f1dd0
SHA512 8fec1fd3f3abf3c09e173005c89863d6c17dd3950ca289be70bc66e9035aa5c0c476b0e17688c327b509d7f1656e1958f94d9dc2d3395c3397f045791dd13296
SSDEEP 96:KqONk4QsjpfbUmjH5ih/cIPURHl8h4otop5daDNBKP4v+Y1xf//ojd6xlYtYqsoh:BON86JUm0QmiUyeTso//0ZeBCR/U6
TLSH
T16002D838BC78ACBB8EE3AE45F48777239FA4106B96915F84DAD96E1C01D715C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

669364e0-ee75-45b3-b882-77e15d979ecd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\669364e0-ee75-45b3-b882-77e15d979ecd.tmp
Size 8KB
SHA256 4e3f05c61f0f9a500a1caaa49e2e62a1bf9c48d3f172045935393dc4a83ce514
MD5 9b1b22c0c2b56893dd0263e9eec6e2aa
SHA1 02305056cffd6a7209723918f2b59504ca524364
SHA512 a5e391ce40c89a412c357a6ef87ae6cc9c43d4fc178c918667e87aea8a4d5d8eaec2acb9cfb0a791899de81a857919f9722467b304725055182a9ec6195e0a4e
SSDEEP 192:qONm6JUQQmiUyXTGo//0ZbQLcmNx7qOU6:qONm6+Q8Go//0ZbQw0xU6
TLSH
T15A122A35B874EC775DA3A594F08376239E604067DB846F94D9DD3B1C02DB1ACA30BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

997ce10f-d793-4277-bac7-6111ddfb552e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\997ce10f-d793-4277-bac7-6111ddfb552e.tmp
Size 18KB
SHA256 72b5c373597c5ba515fb1dab2c3dd68a1f06ca9c87bcb8d15f6465d512251c4f
MD5 d5d1816b1435ffe1b84394a0e4390379
SHA1 024df58bd7ef413008993bbfda1123ab63da231c
SHA512 8d59db19037ab4873ef8360d2bd83abd459d74ac368d8d9a0f4c1ae47ec6eee4d661b81b03bf21176fd27efa5b47f6e2e78f65092db37def5e946cd33d7c52ee
SSDEEP 384:OQkUSv0sND+tK8k/5bGgah//0ZbQwjx2I9XIIlf:+0LpkpS/sZzjx5BLF
TLSH
T17C826D35AC78AC778EA2A594F04B36139E748067D6C45F94DACE7B2C01CB1AC530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

665bee55-f4ac-427b-b9c3-e27d6f82e63b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\665bee55-f4ac-427b-b9c3-e27d6f82e63b.tmp
Size 105KB
SHA256 9260436c94a1833abca9dcb8131c4cccc5ad060d971912bea100bd9a1f921659
MD5 af61b6d65ba3a3316e74e463b5701b5a
SHA1 6eb4c6b1f52ab93bd585b83e03db2052e8d9313d
SHA512 eb387117515b996bd2a3e1182f8a70e62ac5ce6630decd079365c2ee3e53d58b3e9e3b2cb9655230ce60582101fdeae974849f5c45568c2a24be3d96cdd59fea
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
TLSH
T1E1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

0206c2b6-d73d-431c-928c-12492be5b0ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0206c2b6-d73d-431c-928c-12492be5b0ff.tmp
Size 10KB
SHA256 a9fc10ae0bed312261f1b967e375f4db1949b548d1cfab615cae72ae59d3f194
MD5 e189e6fd02b8dd337cb9c3d2907b0a11
SHA1 c1926fa4994b5db5427dfeecdb70a72e52f16aa9
SHA512 2b6804d7cdffc0a41b0b618676d21a7fa6da5ec24540e1c3612aaea657f6f672296a77887a3f249842dac48860883f2d669b21994f7f17303a917b72cf93b179
SSDEEP 192:sxZoRRWR/f5soQIdpxgHW6+WNWgcdY36MBq/Ig5yJ:sxZoyR/f5soxWHbidXLg
TLSH
T19422D8526E34A97B8CCBE20DFA25BF53D6F9503291D01E48AAFD861C04E76CD520B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

204a3ca9-d27f-4878-9d48-e4221518a97d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\204a3ca9-d27f-4878-9d48-e4221518a97d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6c3f29ed-3f82-45bc-a300-1fc913f3c7ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c3f29ed-3f82-45bc-a300-1fc913f3c7ad.tmp
Size 9KB
SHA256 60ba9cde1142fd9f88edbb0a420b6e2dd754a13019382ba9ae8a90beb9ae6106
MD5 7b1f1fcf920b55a03c74a784cdda250f
SHA1 260e16c8d62f3bc9706ad470f16680dc8b4ab586
SHA512 25263cc24e970103bbc9cc4d9a828ee75f1750acdb3ad0f0eec7a9baf41d616f219b62103760f2903bec2678c38e12ed6faeaba8155d78715a2709265ed83257
SSDEEP 192:sxZoRRWR/f5s4ZEdpxWHW6+WNWbH/Y36gBq/IgrJ:sxZoyR/f5s4SkHba/XZ9
TLSH
T16222C8526E38A97B8CC7E20DFA25BF53D6F9503291D01E58AAFD861C05E76CD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ca8828e-5e4b-4c34-bffc-90108f6ce644.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ca8828e-5e4b-4c34-bffc-90108f6ce644.tmp
Size 27KB
SHA256 8275e6bedadfe3d3090bf2531eaf0bd24515b81149ffa5ea384e694328bd6339
MD5 2c972ed48711a44fb4a892e0ddd8532e
SHA1 888040ebe8bb1716e252b72b6bf6202020296632
SHA512 cf3b18a68ebcb6ca4b6651190062d86a9fdd1835821d7ad6c0a4af175ab25ac9d244e24d4cc3e47fa9b78c0e897b5ac7d63285349f2d3c92475082efed4cc3e5
SSDEEP 768:hNKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/qroXs:hNKlm7QWvUYm0u1ja8/L/E/BXs
TLSH
T19EC2FB3B640CCB7E4FC05A9DDC5A6F976EA802C796588D404BFA984C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 18KB
SHA256 95b21d608d57ca4dc574a71569805beb746cae6b77c27e97a814798071b36693
MD5 f661522a88252140a5bd7c3a4871256e
SHA1 9702e7b52a5a983ce3be64e899fcd9e5f0b71787
SHA512 3ddefc245460008a9efc5b38a69b7171578873c28c6dfa4e97cd3d1a9e53c40d6591f90f694b68a403b3a3818879efe3a32c2f95162b353384609b78ac134be2
SSDEEP 384:mI+CPlyETznTji/dZHUgm+NnQw/uJ1G4I6LJ1On+k8+I/9:mwVj3AZUgm7w/Q09691On+k8+I/9
TLSH
T12982CF592EE1E8811C2EF86E92D5C6D8EBA14568D1C2F63D68639C42CC40972AB80CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 176KB
SHA256 a6d1318c3ecd4ed9d2256c7bea54afb232d8dbb33fceb1b1acb248b65f0be80e
MD5 3443a53cc61b8911c3fdc0f3e1c74a24
SHA1 b39582798491a63bb844c810befd5bd854f14ba1
SHA512 c6503be2f1aca4262cc1bbed494c402cbbffcd6d9678bcb7d2754eb02830465593e6b6ea79ff92feb40bb0a943ab07e826362de06442dd8f752101979ca6efc9
SSDEEP 3072:qV9bzkF2QIlOFFOoHq4/7A28TNekf1d4AleO0bezWNh:qV9HkF2xO2o3+cutleNeIh
TLSH
T160040143FB916407D928437E44D42B06B7F5E624FBA3C75F6B825371AEB63E82D02498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 1024KB
SHA256 63151d536a35592c9c3b26b896ecbb82aafa8a9579b85a33610a6689ba945131
MD5 5f9face3f5160b92d884739260962ea6
SHA1 79e8c81d45ba81489a514d85b7493abb3a7fa07f
SHA512 acd9c4437f76a3cdba5bc0b2fec7d47ebad5f45c26eed584ce89f8e019b7da40d71a4fc0941e8f2a7bb6cfd7d7f6567f1727ae721b0a111046de719bd6b0340c
SSDEEP 24576:6rojEpUHtUPHZOMyThE5NExGQ0aDPq0LC/BzQH/3CeYWl:68HGPHZOMy1GacaPq0LC5zE/3ME
TLSH
T1B025235BE368A4B6C8C58970174115A0DF2B2FA29F6824CDE61E3B5BD4F6B4DF4E0E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 497KB
SHA256 8a359375c80ea4fbbecde01e16c6b4f2201d3a28e7b30d399e6ace8ea8800e35
MD5 796fc476d648982e21c887327513c591
SHA1 6761d49ca588d333c718009437aa03e39a4f3f6e
SHA512 775504238c3eaeaa1890076bc0a7c92d502ce9fc628e6076254c65080163a2286ba4d7dcb43e0376018d0be298c2d4b336e69009d939653161691c0ff2ef95bb
SSDEEP 12288:IWipBXIXunduSQJqy4QNR6ku89geeF164CJLtI:PivXIewcoQkDaea6XtI
TLSH
T1C4B42329CA7B5E4DED4A9A307FC324EB58631D2817967AC50A83FF4990F1A34EEC11C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 23KB
SHA256 4f20eef40e4e3be7055c6edf8391adbc2030a113f0ff67227b4c218dbe046c85
MD5 804a8143ec869d5a6abbdb5a2a8bab94
SHA1 4cba312467f6436d8b6e9623973ddbf96b41d787
SHA512 7cccab72be1410e50e54137dadaa18005263f0f2a9b6395a4faae99bb5bc049837f11122958075b0ec7fc8251b02dd03b3574de542e8607db7710cbdd983b9d8
SSDEEP 384:VxFKG7Ei4MRo7F/kX+tJncq2aXsloxHHNsWeHkJNQaHjSZUEzrscsg8VbH:VLth61n2yCzaHeZUW4/g8NH
TLSH
T11BB2E1ED1E52A2D6C64AF6BE540B6809327EDFE9C0AA5DA493C7CC07350B1FA3C0D604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 560KB
SHA256 17d1a02797da9ec3e7d4af65ddbd2c156eb4f3485023537f09d465eb78b35a41
MD5 f1cabc941fffd0ebbf8ecf0922a47eef
SHA1 9acfe33fec2d7d96b22aa29fc07ce12c8908e16c
SHA512 bec73bcfcb42211ef456607da82e3da1fd42edcfdaac672cd8a1bf76b2ca6b775784c7c82b9123b0bee80dad5cbf204838fe4698704606844b32c5e088398be8
SSDEEP 12288:wMV1X0qOh++8ok3Z8i5/YZjEW098edeyThs4:jVCh4b5w4WueMh9
TLSH
T1EDC423F13B3E45BD1FF87B6772B04E9CADB94382829FCC85CDA02F59D9590D09A25188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cd426b6-31ac-4d94-9cf5-1f956f909e1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5cd426b6-31ac-4d94-9cf5-1f956f909e1b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

75f079ee-08cd-4157-9aa9-63b236308109.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75f079ee-08cd-4157-9aa9-63b236308109.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cbd3e72a-657e-4c43-a816-34b0e07eb9d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbd3e72a-657e-4c43-a816-34b0e07eb9d1.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 92843d735b7a148a8b4d3f499db46300febae94359fb6086ec72c8627ef8c6ad
MD5 e68a254aaa5221683fb15ba5f830ed69
SHA1 00e8078392fcffde7e0a86979da9dec6fa5204a0
SHA512 74215ea8b01844cc05c743fcd4951b38aee3c9b5588e1f4bf65c88fff1c0655ba1dc03e53f114b473f6ab4b3a7aaacdf0c38e396d75468693b581442639a5243
SSDEEP 96:KkOoKvaqBKD+6YkQkgkZPeykKmBewkia65Ya5ulSK+Ya:uHJVlv
TLSH
T10191B01170BB064038BE399C9574872A564271B3301AE52BBFBC40A59E2FE085FFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

cd93f584-6795-4a05-9ef4-67f6bb2486ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd93f584-6795-4a05-9ef4-67f6bb2486ca.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c4bc2f2b58c135c9f863b7cae34f0b5f7d1423ef4e77925470b214d0c028e93
MD5 20d5346ef834cfd8bd62978da26f0a1f
SHA1 df0c6da58ec8ab47b7ccb3e3cd46d102bf9873f2
SHA512 fbf015b700e8fec6ebb07e252df184e09335156666d06871c016c618c5a8622025f937bac766d1fa3e36b315e6ef31c31f20386c92c85db92dfe9aee9557a821
TLSH
T157413D69BAE91108B3B37F565BF2A56D087BB9372F0BD45E10100D4F0A22B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads