11d0a43560f416b12430123ef9d2d85b05cd093d0ab34062c4605646a0a6ebee

Analysis

max time kernel
40s
max time network
40s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extensions/ublock/1p-filters.html
Size 3KB
Sample261024-vcadaaa12x
SHA256 11d0a43560f416b12430123ef9d2d85b05cd093d0ab34062c4605646a0a6ebee
MD5 40fe1d6a779e6532596cb5013bb1c515
SHA1 3952eefc735302827f1449c09d51c3504d5572ee
SHA512 4b5dfe1ed08e30acbf12672b9bd98b330f971c77070d538905695350bd47a39c523051d5a266320416e5e6ba0cb081afdbdcd80b6eb79f94c22bf89c6aef9936
TLSH
T11571174BEC1CC95763766EC89974A61CA4ECD608E71198E4B6FD436003AABCCEC07D59
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{E79978EA-B838-43EC-A3C6-718EEE6964F5}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 3196	3348	msedge.exe	89
PID 3348 wrote to memory of 2392	3348	msedge.exe	90
PID 3348 wrote to memory of 3208	3348	msedge.exe	91
PID 3348 wrote to memory of 2072	3348	msedge.exe	92
PID 3348 wrote to memory of 3208	3348	msedge.exe	91
PID 3348 wrote to memory of 2072	3348	msedge.exe	92
PID 3348 wrote to memory of 2072	3348	msedge.exe	92
PID 3348 wrote to memory of 4716	3348	msedge.exe	94
PID 3348 wrote to memory of 4716	3348	msedge.exe	94
PID 3348 wrote to memory of 4716	3348	msedge.exe	94
PID 3348 wrote to memory of 5956	3348	msedge.exe	95
PID 3348 wrote to memory of 5956	3348	msedge.exe	95
PID 3348 wrote to memory of 5956	3348	msedge.exe	95
PID 3348 wrote to memory of 5608	3348	msedge.exe	96
PID 3348 wrote to memory of 5608	3348	msedge.exe	96
PID 3348 wrote to memory of 5608	3348	msedge.exe	96
PID 3348 wrote to memory of 248	3348	msedge.exe	97
PID 3348 wrote to memory of 248	3348	msedge.exe	97
PID 3348 wrote to memory of 248	3348	msedge.exe	97
PID 3348 wrote to memory of 4768	3348	msedge.exe	99
PID 3348 wrote to memory of 4300	3348	msedge.exe	100
PID 3348 wrote to memory of 4768	3348	msedge.exe	99
PID 3348 wrote to memory of 4300	3348	msedge.exe	100
PID 3348 wrote to memory of 4236	3348	msedge.exe	102
PID 3348 wrote to memory of 2216	3348	msedge.exe	106
PID 3348 wrote to memory of 1704	3348	msedge.exe	107
PID 3348 wrote to memory of 2168	3348	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\extensions\ublock\1p-filters.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffed5e6c188,0x7ffed5e6c194,0x7ffed5e6c1a0
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15053070987592345557,1255208593077292559,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,2758075046082668912,11574190061530869420,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15962042193571424097,385317624011635291,262144 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,6635886307513773522,11011042073133660230,2097152 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,241558061945389227,5007708449039990873,2097152 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,5841500526146703126,13603360713260509024,2097152 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5243645663100388522,7224313998881712032,2097152 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,16886533643977651381,6463256587748318217,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,17831654683378178113,1617709769116266935,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,15144843590965419504,10350154766226687920,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,15144843590965419504,10350154766226687920,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,9766941738843227889,17526141833791214035,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,17952085871733876544,15228329647714461542,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,1135955618331741794,18029881593678622939,524288 --field-trial-handle=2632,i,11194835097914766200,5675336545337259620,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

611a97a5-d8c3-4929-8c17-ad6cb12a93b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\611a97a5-d8c3-4929-8c17-ad6cb12a93b8.tmp
Size 38KB
SHA256 cfd59a2eef21005941a183eda56668c6fe1719afcdeb9b8dfb3a55e21e40e6fb
MD5 7dc01a8ebd459b6116c5af35ed4cae4e
SHA1 b58eafe109e3b8fd341d18b384dbf8c90da2a00c
SHA512 eaeae9fbb11e5ed34ef28a74dd5999e93cf27af107ee5d8b2b7fb1774f36ef923cbd5ea9be0ac1396fce51218425aae67cdbfc117dc38bbeac68aa334a87567a
SSDEEP 768:dZ/UxvxjgC+23EaSO5K8trWWsxMIYNa8S5oYklnALXSH8L4:uZj3+23JqPTWRdADS04
TLSH
T18003C13A99A4AC739CF663C4720AA347EEF55263D0C469E449EC1F0E06CB6BE5307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

0f92f084-aff9-4e67-ba52-fe24733db531.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f92f084-aff9-4e67-ba52-fe24733db531.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ec03b629eaa274c848f45e7c6a2bd9c22fc2003cd30cd3c0ef8d8f71b0841008
MD5 a637169e1c4332e76beead6fee25980f
SHA1 7b4d2740f5ba6d9913e238aa5bc413f69c72cfe1
SHA512 213bb8c141de9facbfe0bfbc87a7745cc066f7f08667e1326ef05f230161f9e4e46af59d53eaed3d1760a5b5008f196943e92512c3678067fad3144379a53e00
TLSH
T1D861E6625F3CB15DD76CD176E586809EB6E84AB296872EB103F0DFA47B863A12845302
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89a3dccd8a907900ee764d46a34f05d6a252ab3172ce2d478b8dc0aa88727ed2
MD5 16e922cb9e5ebc39d5ed8e48d942be44
SHA1 5995633ce350f48ebdb34aa9facefbdf27bcaffe
SHA512 2db5f0c249f44b64570474984af6f5fff811b34836a17f6b25bddd130315caeee6f01308f1bb2bdd57d1d75e8e502d769bf2c8379fd133cbeea7e8987af5a0ab
TLSH
T12861E7625F3CB15DD76CD176E586809EB5E846B296872EB103F0DFA47B863A12845302
MD5 SHA1 SHA512 TLSH

Submit Download

cb5018f4-213f-463a-844e-10fac3e40f71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cb5018f4-213f-463a-844e-10fac3e40f71.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

a03e36b4-56fa-4a0a-9d00-a8644bcd723e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a03e36b4-56fa-4a0a-9d00-a8644bcd723e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fb50fbb1-dae2-4865-894a-ca761e09f083.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb50fbb1-dae2-4865-894a-ca761e09f083.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 177bc020541368fa47cca0bbe97d661a6802964a45e49a0b59f6cc8b0ce5daf2
MD5 df34790717630aa93a0b63f903cc723d
SHA1 3d06afab46ac775500eda03255b9e2543ea4a2b5
SHA512 738498a515323f935d1abf30ecda90612e3f4383e822a5284f7607953c808c783acf9d8e727a96b239c4a8d2f29513880bfe8d2e948de7f855a4016c46d87038
SSDEEP 48:KcAIbKTiIfK7ionyAQ58wy66+wKLlI1Q+KaLiO+G4uzD+gfy1NINKuu:KcAgKTi0K7iSezOKQ8iONyKuu
TLSH
T1E6918311313B0203793F295884E9966A8251B1B330B8B9AF7FEDC1A68D6FE140DFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a3a0816d-aca4-4ea0-86de-645ee71db38e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3a0816d-aca4-4ea0-86de-645ee71db38e.tmp
Size 10KB
SHA256 655eae09df00874d13768ce90ebc13a9a1db6a0ae5bb17973c67660e0f49697f
MD5 90a27f5d51978ccbb4e5646823457516
SHA1 71fa07d6f4c7aa9efe4affb308037e801f905645
SHA512 79226a6261ed692b6760f61cbfafa44a16a7acd40a5aa476762bb9a0eb1a5362561e808b51b9ec840c56366b7f14698561a06e3c1b4834209fb71e492d5f5286
SSDEEP 192:sxR45RKb9/fusIwNzoA8p4W/g6+WNIYueciZGAIgDOJ:sxRg29/fus7Av/5IOO
TLSH
T1C932B615AE68A93B8CDBD20DFB55BF53D2F92032A1911E48B6FC9A1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b54d93fd-8046-4cb4-b680-92e6e21b7ab2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b54d93fd-8046-4cb4-b680-92e6e21b7ab2.tmp
Size 23KB
SHA256 ed07dc38c8ff95938cb7d333d176d3f600c45353200ed5d01c8d84558245c4b5
MD5 2f914c25aafd650a5f0bcdf8acc4b9f6
SHA1 99729c26dd879132155da5f9ffa143519388b0cd
SHA512 81c33fdefee7b715d120ba2d76c599dba495eaa036fdc2f3ecd3238b397033eece8ab5c8f94e2f6314c626a938d8e183f4935d713f15b2403df86c2b53bf55cf
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6VrocbW:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0Vw
TLSH
T1D9B2EA2F644CCB7E9FC00AADDC196F976D9802C79A988D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d52c2ba1-5bfe-4510-97aa-c8082ea49a30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d52c2ba1-5bfe-4510-97aa-c8082ea49a30.tmp
Size 10KB
SHA256 e1757572943ad922e39a905fe547f9c0db3a1b240d4405b5c05bf7569f3c339d
MD5 228fbe48232848bbea36e2b006bcd07a
SHA1 522dda0c07f7158e90d51d52774bcdd762acbbda
SHA512 5b393bd18d49e4705e840abc1a04f4fd30c0ccf56da840c34694017d274adb0e22c2fd3b22614fbc4360b387266ed596e45921e4717c49f74281410aafb81324
SSDEEP 192:sxR42RKb9/fusMwNzoA8p4W/g6+WNIYueciZGAIgIJ:sxRT29/fusXAv/5IOs
TLSH
T1F232A615AE68A93B8CDBD21DBB55BF53D2F92032A1911E48F6FC9A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c65755a3-4509-4ac0-9ba8-ddc30981f776.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c65755a3-4509-4ac0-9ba8-ddc30981f776.tmp
Size 39KB
SHA256 eecc5d186d5c16799f9d8b032c788d273b26af1fef287c12cd244dce4bba47d2
MD5 bd166dc3ce2ac77a956abe67c164504e
SHA1 988b0ed2301e9e1ac47b799207a3ba7342cc25d0
SHA512 91175ba4d6c35d4119201e0e04b1b4d10ac8649157dc422d376ca0dafc7e2c67244396ec70938f8e5509136f016505c35d5c9e7a847c3184c56a92580879e63b
SSDEEP 768:5x/UxvxjgC+C3tMSO5K8trWWiMIYNa8S5oYklnA+XoZq:uZj3+C3q2TWRdAQoZq
TLSH
T12303B03AA9A4AD739CB693C5730A6797EEF4512390C469E84DEC1F0E06C72AE4307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1e9d3f3-85d3-4dd3-b9bf-53244075657b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1e9d3f3-85d3-4dd3-b9bf-53244075657b.tmp
Size 38KB
SHA256 e8ff3a1970132899dfb45b2217726aa0a5ccccaeb160bc917133b61d2e28f79b
MD5 ce27c5f26f7ba674a33705d63e5d7795
SHA1 5987f3478eec6edaa3bd5ec1f9491e259af86684
SHA512 b1d0b684250b0eed0c12a389c5d9a3d3233a248770fdb64e1785838161a3c2d899ccd2d17c679cb7ab3293e74a494639d3045a90e3456f6d63f03b9bf22f68be
SSDEEP 768:do/UxvxjgC+23ZfwSO5K8trVJMIYNa8S5oYklnAaESH8L4:nZj3+235IzHTWRdADS04
TLSH
T16203C03A9D945973CCF6A3C4760A9357EEE45263D0C16AE88AEC1F0E06D72BD5303852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f68fb92e-bbd9-4518-875d-3f417951c627.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f68fb92e-bbd9-4518-875d-3f417951c627.tmp
Size 34KB
SHA256 766fdf9a5287b35feada52f26ae67e060ad875563000a00fd34927b0549c0c07
MD5 0a3c4a28642df85d26357f94862a88c7
SHA1 23cd7376ee035685af3e1169109635dc7a9be7ec
SHA512 61db49756348d89ea74fb3e8dcfe54939c895cede7fda6cc6b3d24689919e9c4151ee9011a803280139cb38131ab4528d3f4e56339e699888642d1e450fc1ab3
SSDEEP 768:5m23CMSO5K8trWWrMIYNa8S5oYklnA+X67LM:423hzTWRdAQsQ
TLSH
T174F2BF3699A4AD73CCB693C1B30A7783AEE45223D1885ED8D9DC1F5D06CB1AF5307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads