a360ddba8b04b51c7a973e79214f7ba442c5aa4d5f8f9b69991aeca5926b8078

Resubmissions

24/10/2026, 15:12

261024-slem9afb773

24/10/2026, 15:09

261024-sjyncazw4r8

Analysis

user interaction
yes
max time kernel
12s
max time network
11s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NL-X.exe
Size 3.4MB
Sample261024-slem9afb77
SHA256 a360ddba8b04b51c7a973e79214f7ba442c5aa4d5f8f9b69991aeca5926b8078
MD5 a39f445ab688aa065e7f3bc2386a730f
SHA1 0a45d19cc45beb32f5227f32313ff175b9997bb4
SHA512 f89fe4a6a78e9dc55ac269f11fef6da7928c636c2f10ccca120e2a0d292249845912d2343b22d2744e91336de64ae7b8a1faa69235785182c3e57d496693271f
SSDEEP 98304:nr6utwIUEvj7rTTN/V701kUZK6rE0ourDRvr6E:nr6utwZ4B/VI5wBgr6E
TLSH
T1FDF5E12751AA8D47C5B097FDC156A34A8A33A7C47A32E39F39307514EDE57D30E2A2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{18EDAD3F-61D5-447C-B32A-6EBE15050786}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1040	4596	NL-X.exe	83
PID 1040 wrote to memory of 3128	1040	msedge.exe	84
PID 1040 wrote to memory of 4736	1040	msedge.exe	86
PID 1040 wrote to memory of 4692	1040	msedge.exe	87
PID 1040 wrote to memory of 3392	1040	msedge.exe	88
PID 1040 wrote to memory of 4692	1040	msedge.exe	87
PID 1040 wrote to memory of 4692	1040	msedge.exe	87
PID 1040 wrote to memory of 3392	1040	msedge.exe	88
PID 1040 wrote to memory of 4024	1040	msedge.exe	89
PID 1040 wrote to memory of 4024	1040	msedge.exe	89
PID 1040 wrote to memory of 4024	1040	msedge.exe	89
PID 1040 wrote to memory of 4984	1040	msedge.exe	90
PID 1040 wrote to memory of 4984	1040	msedge.exe	90
PID 1040 wrote to memory of 4984	1040	msedge.exe	90
PID 1040 wrote to memory of 4124	1040	msedge.exe	91
PID 1040 wrote to memory of 4124	1040	msedge.exe	91
PID 1040 wrote to memory of 4124	1040	msedge.exe	91
PID 1040 wrote to memory of 1548	1040	msedge.exe	92
PID 1040 wrote to memory of 1548	1040	msedge.exe	92
PID 1040 wrote to memory of 1548	1040	msedge.exe	92
PID 1040 wrote to memory of 2296	1040	msedge.exe	93
PID 1040 wrote to memory of 1544	1040	msedge.exe	94
PID 1040 wrote to memory of 2296	1040	msedge.exe	93
PID 1040 wrote to memory of 2296	1040	msedge.exe	93
PID 1040 wrote to memory of 1544	1040	msedge.exe	94
PID 1040 wrote to memory of 1544	1040	msedge.exe	94
PID 1040 wrote to memory of 4584	1040	msedge.exe	96
PID 1040 wrote to memory of 4584	1040	msedge.exe	96
PID 1040 wrote to memory of 2464	1040	msedge.exe	97
PID 1040 wrote to memory of 2464	1040	msedge.exe	97
PID 1040 wrote to memory of 2220	1040	msedge.exe	99
PID 1040 wrote to memory of 3888	1040	msedge.exe	100
PID 1040 wrote to memory of 2220	1040	msedge.exe	99
PID 1040 wrote to memory of 3888	1040	msedge.exe	100
PID 1040 wrote to memory of 4680	1040	msedge.exe	102
PID 1040 wrote to memory of 2196	1040	msedge.exe	103
PID 1040 wrote to memory of 3604	1040	msedge.exe	104
PID 1040 wrote to memory of 3604	1040	msedge.exe	104
PID 2196 wrote to memory of 4616	2196	msedge.exe	105
PID 1040 wrote to memory of 2732	1040	msedge.exe	106
PID 1040 wrote to memory of 2732	1040	msedge.exe	106
PID 1040 wrote to memory of 3316	1040	msedge.exe	107
PID 1040 wrote to memory of 3316	1040	msedge.exe	107
PID 1040 wrote to memory of 3316	1040	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\NL-X.exe
"C:\Users\Admin\AppData\Local\Temp\NL-X.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffb49a4c188,0x7ffb49a4c194,0x7ffb49a4c1a0
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,6827635334272688343,3678809640773837529,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,8208540153942638688,6041630519529497063,262144 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,14853612543654396969,8607701866561628205,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9427374558999049401,6880535319555858352,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9865235690046791951,2911164958604398060,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,18134193094862009420,13569049301642519589,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,9410030071598565808,12302842609322584505,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4332,i,7459475566648904164,7388915078805731755,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4460,i,16862343612865609357,5580145986272496065,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,11169902748232455092,1768611158435655272,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,12354122923853944395,16248341963589818343,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,18111723084369833705,8781097810402562691,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,2278030223908955759,13755809709997126697,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14362658916832200532,3118013020325515922,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14362658916832200532,3118013020325515922,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17831407999841384616,2410073090846474878,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1120
      4⤵
      PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8971519449715457953,10503442817550382972,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,9229791920445137041,17132567203753886592,524288 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6724,i,3383372351705924308,3470956315774288741,2097152 --field-trial-handle=2192,i,10945754246271492441,2005461157431879694,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
    3⤵
    PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3b8004d7-e6f8-4ece-9da2-c9cd1b223464.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b8004d7-e6f8-4ece-9da2-c9cd1b223464.tmp
Size 8KB
SHA256 a305df7f1e825c22da1a1910d07cd3d64ed1b319f1569d76d8758458e6c224d2
MD5 1b704b4880c6a8d93b56aa5b864872d4
SHA1 123e4473ca679e77668a35bad657581d4653ad2a
SHA512 5a3f0df1c9ac06236ce345d2356bbe32fde364258f752a30c46cbdea619492a0b900dcd3f3f0bdd340eb710dd773b790de7728b8e267033bd551ca902c757b50
SSDEEP 192:DGNw6KsE7uxQmiUyDU2gxuTvuRnu97bU6:DGNw6LEqP05gxuTvVPU6
TLSH
T17702C639A8B86CBB8EF3AD45B94776135FA4112FEA913F84DAE81E1C40D725C130B536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c62a477-26dd-4f6c-a288-69cd3d6790ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5c62a477-26dd-4f6c-a288-69cd3d6790ed.tmp
Size 18KB
SHA256 d8aa1f872fd9cf037664fe026975d64ac5925426d4db2178c47bfad539deffb9
MD5 5a7b5d1bf44be4d126df7fd83e10e263
SHA1 65a3f4c5fd17170dc5ccf5a93b0ee51c0a65bf95
SHA512 15563d1a702aab7f2f025d2c46d2825b9b520fe1cc1c84eca134ab9b548d86163745bfbd6766d3c6e6df2f767468fdb53f8ffea4f2b8b06d5ad8a8ce98602cf3
SSDEEP 384:znX8NJ5QY2EqenLDGuTvUGBJrJEvg/7+G62I7u5:zXt0qCSeUmhJX/7+G657u5
TLSH
T10F82283D8C745C3F89AEBB04B54E3A275DA8117BD5B06E98D7D40B0CC0B625CF74A62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

804644d9-b29d-4a2b-9d3f-1fbad62f7f79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\804644d9-b29d-4a2b-9d3f-1fbad62f7f79.tmp
Size 8KB
SHA256 8cd8b20b9b67d31935e232ec122b0683e7aa25671214333096b018e87d1b3b5f
MD5 8a25fc21a8b8a68d8ec6bf9f72c97f1b
SHA1 134da9962df508cf8d7dacb6142a177079e9671a
SHA512 d2a585626d946ada91848ab5fd658dc09f190e5a837c2d3139768fb668dc6c4e88cff7bf0e349c961572e19b532f2c82fce49748f9a6da3778f3d1c95f38ddd6
SSDEEP 192:iGN06KsE7uJQmiUyH2RxuTvuRPGeSJrb62CqhAU6:iGN06LEqnZRxuTvUGBJrZKU6
TLSH
T1B912F87598B8AC671EE7B814F4873A53AEA4217BED856F44D6E80E1C00D735C1B0F52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
MD5 d57c7e44d35c9cdb36ed14dfab0dfab0
SHA1 8b9d00e4fc1ace8371328737a28deb3bfb8ed61a
SHA512 00b1b35765c219cf319043400cea5573885f0ec520a41bbd3dbea4d771ffe15fb3bc1f53440e052b4e9c0fedc69b2f606d82e0faabbe997cf35324282c5dcc03
TLSH
T11ED02280FBA80230E0323833C3E2C323220AE0E000802EC808E382CE3F22208000FCEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b49684898a5c4ec5e3f3bf2d330348c7015c8372404c03bdd117821c87a8d935
MD5 bcd723eea129db62baa2d86759d7624e
SHA1 db481d998b0ef701f9dcfa676cfd171313e50b81
SHA512 30ec259f8366badc22a669e8b26846154666dd93d4895a643fd896f32fcecdc9511f73719de2ba37d58029286c6a9cfbc1f328e14c61139e214b935ac5f0a854
TLSH
T16CD09251EB785AF8F83D203B83E18602220CA6E346912B89599988896EB5146545ADE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 798df09e54df6f20104c3db421e9c171028a1a3e0e66d5471b3e5f70d71b3aab
MD5 a8d604277fa08c1ca035a64d150e5c89
SHA1 0f21b4b451362031a3bad7986a28d45ecaf37f33
SHA512 511b21bc43d186ed2da4a7845c0b0553e5f98ab9d99a323e62613b5d11cf8975342569def41fa657cf266f300f402868edef6111697d02a19b2e4a26ae2a709a
TLSH
T18BD01240B7940520D431243382D082121105909000405A850492418D2E12104000A898
MD5 SHA1 SHA512 TLSH

Submit Download

3403700a-e690-4090-84a4-aa87bf500bd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3403700a-e690-4090-84a4-aa87bf500bd1.tmp
Size 10KB
SHA256 55c48e2e3a9f0f53bcae6b43390547710b09ade748ea0a045a4d258777b682eb
MD5 580323ebe52df29110eacb6c6ea69362
SHA1 952f282411d750be09195f73623a32d015641d42
SHA512 a8c974b88795f5261e60c3f60801c7e14107a259952953abbcc746a587b32a04620dc1c60ab1c4905211d91d5acf3de1a39404d6145487743f1ba182142a6c01
SSDEEP 192:zZLTRICa/f/Xs6WpVAlXGEdpfk/W6+WNCD3tq/A10YgQc8IgyJ:zZP1a/fvs6WvAlJ8/bKU//SO
TLSH
T1AC32B716A924A93B8CCBE61DFA25BF13D6FD142291D15E48EAFC892C01E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

749a6115-3150-4cf8-b205-df11c873b26f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\749a6115-3150-4cf8-b205-df11c873b26f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

87642aed-6829-4735-bcbf-9c51363f33a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87642aed-6829-4735-bcbf-9c51363f33a9.tmp
Size 28KB
SHA256 1b2438e04fd770e97f1c845a89cd029fa19d2d97364698ac871b3b5415a7106b
MD5 9885b342a009bfca405da514271a4d38
SHA1 ff72298e1de0bf163ddb3023de11375ae8f688ec
SHA512 7825432e77edc84c4a2b57b246181758832d6bd3a9c3f259ed09031883180383b7bdbc3c9233325c42b972e8aa0e8c300e57dc07cbd0d601f8dbda59ab1a27b0
SSDEEP 768:TTnh588N2nsWRmUUQ6I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BrLl/Ii090EroeJ:TTnh588N2nsWRmUUQ6Iu1jaKBrLpI79r
TLSH
T16FD21B3B244CCB7E4FC01E9DEC566F976EA802C796688D4047FE994C02C77EE512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 1e7f71bbac4fb47b58e6167b417bf48413872e8acec333d61a06296eb14338dc
MD5 bfc7b2e81e782867d5d2f9ffe4a8a1b9
SHA1 e3f25bd9a032d84c59db9de184db2a62d9c5aa45
SHA512 5d3c45d748289c022a1b4920d26deaebe08e3a23a8d9f2ec02d047cee3d70e85acad595b65b99f0de06f683afbf399f73ae487475fee4cae9495c700ce6d4ae3
TLSH
T1ED51DB5906718A92D364A33465D72B673B7E6AB270831E7308ECCAF8FF86315C117483
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2c0dae24d51218c921a282e6a1efa3ada907668a6ce38c4ed55732420b09d79a
MD5 7f35fb6632b309387f9b78025da10e4c
SHA1 dcadca8f4bf09e6895e2d3ac2359ee25627e38cc
SHA512 26f78389915032e43f95f7a1ad158ff3bd376a84121599bd3572950683f5de32de188adb488ff9b8d8c16d5848a2d6a6b1b34526de7103f91c997346d9577841
TLSH
T1E251C99906718A92D364A23465D72B673B7E6AB230831E7304ECCAF8FF86715C117483
MD5 SHA1 SHA512 TLSH

Submit Download

2ba41237-3c76-4664-8d1a-d82549ef2e0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2ba41237-3c76-4664-8d1a-d82549ef2e0c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

53a1ace9-5738-460f-a8be-a94d80a50e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\53a1ace9-5738-460f-a8be-a94d80a50e50.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c3192727-8562-4605-b2aa-2799039f811d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c3192727-8562-4605-b2aa-2799039f811d.tmp
Size 1KB
SHA256 d826cee0d8e179f7d42482fd92605feac1c69e061ef54c176a8054b0a9d9f7a4
MD5 97e0a8599572b29fb56b79ff396e6b63
SHA1 5fac91b23f1af0430cb1e7049f66e5243c4d2a12
SHA512 3f0a6f26f34856d0484a6634c6b64ce95a0bcaadc697236c5f67360d9ac9316fa2e614f01438ff438278b3f1207ca0594e2817be2a38df7af98b60e45e198053
TLSH
T17F219DF7C3E4957E890596F4AB14AF1FCE2D0A15431C3C1A85E8AE2B93E3871E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 aa6e01a4260cf4c9e86b53022a9e1052feb651d746857ea2d8776845fb76e952
MD5 4d83ed7a061dd3e853a3c8e80595c8be
SHA1 0b7b13cc126268c794446d73954299975a318f91
SHA512 57269b480abdeb7067ca3c900b49cf94329777d00d3159e5e2d52f8d6b59a4f74625f75627ecdb1d1a3586faf3778341685233d72e07720120d2846dc5abc76b
SSDEEP 96:KQL6KUEWOm3osm4YxpMZsvUxKH4vGxTuWBUYSi0gKtey3iKEgyKAwKJKc:kxOm3osm4YTMZoU64vGxuWBUYSrcxvH
TLSH
T1F1E12A4176BA028478BD291D81B8872F464132B37418E62B7F7C02E69E7BE055DFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ace6446d-bba6-4a11-9c00-be1d12f9fc75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ace6446d-bba6-4a11-9c00-be1d12f9fc75.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b429c98f-cfcb-47df-a314-250d20372002.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b429c98f-cfcb-47df-a314-250d20372002.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a464edb-c7a5-45cf-a915-14950c52a8ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\5a464edb-c7a5-45cf-a915-14950c52a8ac.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f7937203-6705-4d89-8002-d1b200358d45.tmp

Path C:\Users\Admin\AppData\Local\Temp\f7937203-6705-4d89-8002-d1b200358d45.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae0cf5cc-2ecd-4ab3-a95c-c129b899ba4f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1040_942867507\ae0cf5cc-2ecd-4ab3-a95c-c129b899ba4f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads