d3f92c104ff5c4785d0ae9a3604c619d8371b5b938a94818ca4810a74371fd86

Analysis

max time kernel
40s
max time network
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extensions/ublock/3p-filters.html
Size 6KB
Sample261024-vcadaaa12x
SHA256 d3f92c104ff5c4785d0ae9a3604c619d8371b5b938a94818ca4810a74371fd86
MD5 198b6cdf8ea4542d8965716b69410604
SHA1 a46bbbe62b7ed94dcd55256a9d1fd2b8728b1bc6
SHA512 8b14d163b8ad93021da75dff6d8b7ecaea3fadd3790685a2820b7d989618323039110745f38567239d2802403ef7685e319b0f61882089b7c6b06bbadee5054f
SSDEEP 96:UbM/yP8yUDbNST7CSToMmWeuH6lAxIJMfYIJEfkw0YGKJTyMnRD:ViP/L3aOIJeYIJWkw0YGKJTfnRD
TLSH
T153D14212D4F18937023286DAD6BD5B24A8F0D52AE6925860F3ED07780BEDDE6F403C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
808	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{72297584-854D-4B56-AEAD-676864D73407}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 5308	4268	msedge.exe	89
PID 4268 wrote to memory of 808	4268	msedge.exe	90
PID 4268 wrote to memory of 5516	4268	msedge.exe	91
PID 4268 wrote to memory of 5516	4268	msedge.exe	91
PID 4268 wrote to memory of 5444	4268	msedge.exe	92
PID 4268 wrote to memory of 5444	4268	msedge.exe	92
PID 4268 wrote to memory of 5444	4268	msedge.exe	92
PID 4268 wrote to memory of 1528	4268	msedge.exe	94
PID 4268 wrote to memory of 1528	4268	msedge.exe	94
PID 4268 wrote to memory of 1528	4268	msedge.exe	94
PID 4268 wrote to memory of 5648	4268	msedge.exe	95
PID 4268 wrote to memory of 5648	4268	msedge.exe	95
PID 4268 wrote to memory of 5648	4268	msedge.exe	95
PID 4268 wrote to memory of 3276	4268	msedge.exe	96
PID 4268 wrote to memory of 3104	4268	msedge.exe	97
PID 4268 wrote to memory of 3276	4268	msedge.exe	96
PID 4268 wrote to memory of 3276	4268	msedge.exe	96
PID 4268 wrote to memory of 3104	4268	msedge.exe	97
PID 4268 wrote to memory of 3104	4268	msedge.exe	97
PID 4268 wrote to memory of 3100	4268	msedge.exe	99
PID 4268 wrote to memory of 3100	4268	msedge.exe	99
PID 4268 wrote to memory of 4228	4268	msedge.exe	100
PID 4268 wrote to memory of 4228	4268	msedge.exe	100
PID 4268 wrote to memory of 5320	4268	msedge.exe	102
PID 4268 wrote to memory of 1528	4268	msedge.exe	106
PID 4268 wrote to memory of 3952	4268	msedge.exe	107
PID 4268 wrote to memory of 4900	4268	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\extensions\ublock\3p-filters.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa3b56c188,0x7ffa3b56c194,0x7ffa3b56c1a0
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,14901031814031024276,12680244373799751614,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - System Time Discovery
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,9982926271072981689,8799607592634646668,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,7362807606882454384,1679770632422628554,262144 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,14535638139984924222,16811096224297592401,2097152 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,1552850326766015361,16722108867888890850,2097152 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,9771940720001680284,10937549683503384070,2097152 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,9235050645944251940,10434391089253309560,2097152 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:9
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12391371352921100988,5336381495676193221,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11563529013385138856,15588486873970478663,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,16910775254901430377,6231509534806043265,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,16910775254901430377,6231509534806043265,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,3184607947462324154,11459726496691594093,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17108896844323442666,2836688917782323467,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,18145654248574569076,6650070190406470759,524288 --field-trial-handle=2224,i,1712009796864403536,9739047167763582761,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1fbbbd85-4f83-40a5-ba6d-aa043e022a45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fbbbd85-4f83-40a5-ba6d-aa043e022a45.tmp
Size 38KB
SHA256 255edeed7ce828822be30a3f4ac3d2318af9f960847265bf14f7029cafa17716
MD5 7045ebaf3303e9a42ebad4182070562f
SHA1 2e006afbd1febcd4d330c9358a29a265089c27a1
SHA512 ae561484b897cc4cd4a2c9d5e23280f4a5017a09b4397a90e8359e71d11da9013c4e2b2fc441e2e09473c8783e6227b70d70c4ab8ff9d428d35185567072f1ff
SSDEEP 768:z/UxvxjgC+93NrwO0kqu5fgGM1TnXMqO/uAaP8:GZj3+93ocfgt1TnxOGAG8
TLSH
T14E03BF36A8556D739CF2D380B20AE397AEF645A3C5C51DA889ED3D0E068B25E530FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63627398-7283-494b-a910-46ae8ba8d2c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63627398-7283-494b-a910-46ae8ba8d2c4.tmp
Size 34KB
SHA256 cece3d6dd3de6e18be5687f236c11ed45b23ff2dbcc9c4e11c4512cf98e2d0a3
MD5 7d4ab7c94ff207d5493a4e0618718373
SHA1 43d662e0440d9193ed78024fa0c1cee0b81ba4c6
SHA512 698dd2569bbcf4d07dd0ee2344cd46e0f751260bed8bcf8fd7bebdd19f31c4b6984ddd61bbaa2e5be5e295f2b23cfebfd61aebc371c5eea335bb60e6695c6d70
SSDEEP 768:rX3EpxNwO0kqN5fgGM1TnXMqOau6DuBLS:rX3aqnfgt1TnxO1IIu
TLSH
T195F29E32ACA5AD739CF2D380F20AB2926EF18157C5891E9899DD7E0D06CB25E134FD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96142461-92b5-4ac4-a0be-de003aa0bacb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96142461-92b5-4ac4-a0be-de003aa0bacb.tmp
Size 37KB
SHA256 e7ecc01e071a0d7e4d046dbb94781a06996b22a5666240c8779e22addde13558
MD5 35db10382179ccd7555bc6e39e48dd58
SHA1 3a8b804f07dbda2d5bf79a6270ef0c09d71b7881
SHA512 e9633baea8b25ccaa1cf7186df1e7ebdabdcfcb55658e31eda86cf18ffa479fd84c817b3b46f60aedfebbe572e6e97512c512c752304836ae35c5c0fa9ae88ae
SSDEEP 768:5/UxvxjgC+93BBwO0/Ru5fgGM1TnXMqOe9AaP8:sZj3+93ORcfgt1TnxOGAG8
TLSH
T1D603BF36AC556C739CF2D384730AA397AEF144A3C5C52EA889EC2D1E069B35D530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

12eedbf5-6651-418a-9bcf-aca470a72a4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12eedbf5-6651-418a-9bcf-aca470a72a4d.tmp
Size 11KB
SHA256 7cb9dd755ef82a751d21b385be5ff4c3a78fb759c6b8ddfa6c6d68c1e59e4fba
MD5 1a4168170891d763ac337b0c1943077c
SHA1 66fc3c5ae93a1e2d5dcc5729086aad9bea212364
SHA512 730376a32e1767534d1e3679edbd88ea533220900f433dc2166fdf9598f415236fd3bb8f69321e00aeea6311ca2829ef0cf1834be42b08f2fbc26701a38f67e3
SSDEEP 192:sxR0Rybs/fgsrqNzoA8p46/g6+WNIYRLF/3jVGEIgDCJ:sxR0es/fgsrt//5IaPa
TLSH
T1D432B715AD68AD3B9CDBD31DBB55BF53D6F9103260D11E48A6FC8A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19b21ab7-a1e6-456b-9f7d-472477436493.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19b21ab7-a1e6-456b-9f7d-472477436493.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d82676a-1e05-4449-8b9c-057a85a690ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d82676a-1e05-4449-8b9c-057a85a690ab.tmp
Size 11KB
SHA256 77dc82043873273b842f5d8de313af265d2e72423db127abbe21cfe1b4ea863e
MD5 469dbf2cd0e7ac6023daa4ea56404ad2
SHA1 89de202562433450f659fcbd1be90d1fed207fe9
SHA512 af85847585a409371cb595ffd526474a5ea67eb46afb1500140abdd56251d5be14600e5475177547553ac109dbc79b5451ad35134e1d46c535f78dbcdefa3ef3
SSDEEP 192:sxRfRybs/fgsHqNzoA8p46/g6+WNIYRLF/3jVGEIgIJ:sxRfes/fgsHt//5IaPs
TLSH
T14732B715AE68AD3B9CDBD31DBB65BF53D6F9103260D11E48A6FC8A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87918988-809d-4efa-bd8b-ea08ccc66216.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87918988-809d-4efa-bd8b-ea08ccc66216.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6d5e40a14927a698529d5cc387de33d63d68afcbd9ccbf1b470b04a8a0fe552d
MD5 71dd09cb421567895ccb0648f5505f51
SHA1 b6971b40d31591614374f34e0125d714ada45d76
SHA512 f3001ee2ecdbb379b1b02c94a2e9339293d760dee7582185ba046eef7720acab49384173b8dc837d104db32f53ab75500b9a033039958e10196f9b21eadea756
TLSH
T1E161D88DCBA941B8CBAD597091ECA89336B41DF09067BF0137A9CDBEE84236C03D045C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df38ceb2e06e133647725fb4af69a0fca55201828b12b85726acd3efc4d2ae6a
MD5 4b96665c337f2749b7f1f51e355c9ae1
SHA1 b15f264d0fb76d6ae58fe7153052a0ac1e97c607
SHA512 4559ed5eb39497aa2e3c054f6092d0990f2dba66d59fa156927b2f7350a131f5c2c6e609a1efaf24812b11294b9f2d40d3f8d64d8329e3d0c9f0fe4284ea4178
TLSH
T1DD61C78DCBA85178CBAD597091ECA89736B45DF09067BF0137A4CDBEE84236C03D045C
MD5 SHA1 SHA512 TLSH

Submit Download

b6898a0a-8f75-4fa5-9f26-3b00d71b819b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b6898a0a-8f75-4fa5-9f26-3b00d71b819b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

cc92bc84-1173-47fa-b14f-8ca3b7071b85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cc92bc84-1173-47fa-b14f-8ca3b7071b85.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d0cd18a8-a25f-453a-bba8-36db609c63ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0cd18a8-a25f-453a-bba8-36db609c63ff.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2d40bf0480730d0995b83f0fcbc658ce9550afbb059e307ef73264ef571699cd
MD5 838a8ef02b01381bacd845fb47f96ead
SHA1 a592810e31311aebdbdba2b44c6b28f1fc3fcca6
SHA512 5dad9e6cea9bf4ca7955420e5fa01130cbe7ea37be80708aa168c43325417371887bcde0afc6c943b3b90803ae8f9792bcd4a0eee30605fe42f788cae380bfbe
SSDEEP 384:Ua5g+TcfCtgflFfXHKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwE9tTRkGroqY3:UEg+TuWgf/fXH8F1+UoAYDCx9Tuqh0Vl
TLSH
T15BB2DB2F644CCB7E4FC10AAD9C1A6FD76D9802C797548E4047FE994C02C77FA921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 da82b264d11c8375f633ae6cd7dfb5c70d05173081e01e00ad628e38e6ff06dc
MD5 e2b10f9eb8897169166b0af4efb271a3
SHA1 dd1ddf93531f9a0c44c9e3ad99e5e055b09b2f52
SHA512 385497f3a162341b5a4f15929858b95ef85da9d5d29ca317ec5529414ddbbced7b22368d54e4b93da0b3fc7f4f7b873f9c3023918d824e17496fe7480562964a
SSDEEP 24:KVWm3WZWeW7+WoVWoWMWk8WoWoaWPIzWaWkKmWHh+WsWk1wWiW0SiWaYWrIWiW5W:K0eI/KbyQbypgILKtCc5vIJKAoMvyO
TLSH
T11D91C01131BB06127C3E260984D59A6B575132B2302CF97F3FACA1A68E6EE142DFC5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a95bcf32-a082-43e6-b81a-ea4b4f249679.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a95bcf32-a082-43e6-b81a-ea4b4f249679.tmp
Size 38KB
SHA256 d9906ffab842ee70d4b051e26525550b4e4e455b6b51b7ad8ffc6fd6d5e8da43
MD5 c1a2a2afea28648477460911ab6c4b7a
SHA1 f9b50f9bbf482dbbb389c604b13961c64145f1c7
SHA512 daa0688975e297cabf188757bc220a6480127936e04cf79945ff372312960a0b08897a2327ed5fa22bfbc8574d82c56068bb442e07ffb1922b796465143a5891
SSDEEP 768:2/UxvxjgC+D3pp8NwO0kqp5fgGM1TnXMqOauoLe:rZj3+D3bdLfgt1TnxO1oLe
TLSH
T1DF03BF36AC55AC335CF2D380B20AA397AEF55567C5C51DA889ED6E0E06CB25E430FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads