62d39a9d08acc6eec7956b34e7c87ee4590b4458e7b7640e36b14640373133cc

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gearsofmedia.com/1xbet-1hbet-bukmekerskaja-kontora-bk-1xbet-stavki-na-sport-onlajn-vhod-na-ofitsialnyj-saj.html
Size 84KB
Sample261027-pbb8ladd83
SHA256 62d39a9d08acc6eec7956b34e7c87ee4590b4458e7b7640e36b14640373133cc
MD5 b359b027ea4f16455b9b8b46c094b496
SHA1 a2a5bc7807a0ddaf9ae5cc45930f2d0489d763a8
SHA512 656a1dad7378e92bb5b8dd27caa4e3018adcc9a6d44ef6a67f7bb37b241a7f3fd2360f19e09c7879c1daef8fe13f6ba2f6aeae8971495d6ff78c9ee6a8ebf879
SSDEEP 1536:rap+n7OR1WnfJDQDaSkulYsnnGQuCQ7uiFMEfQLuXUkJw6dUVKURPExbTLRB7yQ:OMn7ODWfJDQWSkulYsnnGQAaiFM8fw6F
TLSH
T1068388207A9F148F220BA15FC8067B0D78EB45FEBF55636634B1287E34F2870967A719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{DAD7C370-4AED-4908-97C6-EE12B392EB80}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1884	1696	msedge.exe	89
PID 1696 wrote to memory of 2788	1696	msedge.exe	90
PID 1696 wrote to memory of 4580	1696	msedge.exe	91
PID 1696 wrote to memory of 4580	1696	msedge.exe	91
PID 1696 wrote to memory of 4580	1696	msedge.exe	91
PID 1696 wrote to memory of 2940	1696	msedge.exe	92
PID 1696 wrote to memory of 2940	1696	msedge.exe	92
PID 1696 wrote to memory of 4584	1696	msedge.exe	93
PID 1696 wrote to memory of 4584	1696	msedge.exe	93
PID 1696 wrote to memory of 4272	1696	msedge.exe	94
PID 1696 wrote to memory of 4584	1696	msedge.exe	93
PID 1696 wrote to memory of 4272	1696	msedge.exe	94
PID 1696 wrote to memory of 4272	1696	msedge.exe	94
PID 1696 wrote to memory of 1984	1696	msedge.exe	96
PID 1696 wrote to memory of 1984	1696	msedge.exe	96
PID 1696 wrote to memory of 1984	1696	msedge.exe	96
PID 1696 wrote to memory of 944	1696	msedge.exe	97
PID 1696 wrote to memory of 944	1696	msedge.exe	97
PID 1696 wrote to memory of 944	1696	msedge.exe	97
PID 1696 wrote to memory of 1736	1696	msedge.exe	99
PID 1696 wrote to memory of 1728	1696	msedge.exe	100
PID 1696 wrote to memory of 1736	1696	msedge.exe	99
PID 1696 wrote to memory of 1728	1696	msedge.exe	100
PID 1696 wrote to memory of 3324	1696	msedge.exe	102
PID 1696 wrote to memory of 4352	1696	msedge.exe	106
PID 1696 wrote to memory of 3584	1696	msedge.exe	107
PID 1696 wrote to memory of 4572	1696	msedge.exe	108
PID 1696 wrote to memory of 3712	1696	msedge.exe	109
PID 1696 wrote to memory of 3712	1696	msedge.exe	109
PID 1696 wrote to memory of 1104	1696	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\gearsofmedia.com\1xbet-1hbet-bukmekerskaja-kontora-bk-1xbet-stavki-na-sport-onlajn-vhod-na-ofitsialnyj-saj.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff1671c188,0x7fff1671c194,0x7fff1671c1a0
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6659170436827405015,11941333821466722358,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,5949333783474284395,6092289819796412423,262144 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,14150597995158897102,16904191972566851198,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,11455637092126037623,12839119686174484565,2097152 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,9945331281609722042,1952761496217285441,2097152 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,7915745375087677431,12547601601979826424,2097152 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,3130984831250335777,4832654949861092822,2097152 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,400794771779023700,17793250083215547883,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13231062858201884293,3682333751997089847,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4936210320058711808,11560810593758092369,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4936210320058711808,11560810593758092369,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,2639801767064122762,10611402711430872003,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,5337304370756042602,11214112270039338298,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,10537280986501717787,3706731627689560119,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4954909535390815704,12299053222243713521,524288 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2192,i,12654595218223516187,15574927134972117306,262144 --field-trial-handle=2404,i,3142062803819128620,10991129648799423114,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37ebb0b9-bd35-4705-807d-01661ca5472e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37ebb0b9-bd35-4705-807d-01661ca5472e.tmp
Size 39KB
SHA256 265b1f761aeeed1cd54e5f6e9148636968ad374a3e4ca06f8baa0f1b29b72740
MD5 9ec136b741f493b6505322edd594ea46
SHA1 f80d271566481b56425efe3f2aea7c0294c99344
SHA512 01d99d0d477084961049cbe39e6bd75c7cc1b02be869d77e4e4e5da0791d8fbfec4f85e29ab7d55a0c27131b613dab450c19da8aa3ef2e718200ba5c0da84ef4
SSDEEP 768:U/UxvxjgC+B3D5Pcgm1BcktDmGA5b65Q92RQMPbUFj0O:BZj3+B39U3AF65dQLFQO
TLSH
T10603C036ECA5AEB3DCF99180364BA35AAFF84473C1C955E049ED6F1D06C768C430B85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3929f99a-ce07-4a06-b69c-2ffc6726a5db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3929f99a-ce07-4a06-b69c-2ffc6726a5db.tmp
Size 40KB
SHA256 8d56876c3cca705281aa9c8ea2db5e69099942158a53cc398f70fb86cdb5c3c8
MD5 f7d89a8bb48c5c61823be3013edeebae
SHA1 bbc7d147c69176287c8d992b0fed575c4075ca6b
SHA512 f88270a640407cef5432d6188a18e27fb47735ca41189fa429c8ebd2fac694953266c617f72cb3d5c91da41b6b6460999765d275a295cf3aaf61e57e8bbd957a
SSDEEP 768:M/UxvxjgC+E37FFcpgm1BcJdPDmGA5b65Q92RQMPbStWm:5Zj3+E3BJAF65dQltWm
TLSH
T1B803CF32ECA4ED739CB6A190364BB356EFF88563C1C955A049ED6F0D068B78D430B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9309e9a8-5e09-4495-b4d0-e2b3b894f9a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9309e9a8-5e09-4495-b4d0-e2b3b894f9a0.tmp
Size 37KB
SHA256 b139f963d4e85f56f0d4921d576cc296ca81d0997619a858523ec38b1476352b
MD5 9108adc37bd251fb4323cd198ab65686
SHA1 9a3ec99213db2bdcd67c9fd9d642977f2f21691a
SHA512 ea6295a4da7ff48ab24e200fc64456e2f04c1975893180b4b135efb6948d9694872aeb71625efab0f684f3803ca123eb6bf98cb869a18dc8fbec634f7ec5b662
SSDEEP 768:1FdF33wggFF9pgm1BcJgDmGA5b65Q92RQMPbS5aTZcqHIL/:xF3oAF65dQlM7oz
TLSH
T19803BF32DCA4DE779DB99BD0B64B7206EFF58163C4C89690A6CD6E1C018B5CD034BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

307dc141-982c-41c8-a2f1-5f5c73c3579b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\307dc141-982c-41c8-a2f1-5f5c73c3579b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4acf8656-db7a-47cf-99b9-030f600581be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4acf8656-db7a-47cf-99b9-030f600581be.tmp
Size 11KB
SHA256 cc6ed33d2944acc9468d9c318f08b8ae1cc49c43f1d150b2547cca151682ebd9
MD5 a6fca7c9a5a35ea10a2ddcd0ca9236ee
SHA1 b9473038b3598365ac0d888b1754fd13f990e293
SHA512 565b74333c308def7970677be1da5b0782b747c11620f85af96a84b64a7510fb7e12c93360587311be5fcd1a59245b6a953f5de29679afa7dc176afa1f1bacdd
SSDEEP 192:sxRXRBba/fs/sEGyYhAzoA8p4Q/g6+WNIY2ROZXGTIgD9J:sxRX7a/fs/sEGb5R/5I8mr
TLSH
T1D042B715AE28A93B5CCBD21DBB65BF53D2FD5033A1941E48A6FC8A1C04E76CD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72f3de61-6919-47ba-97c5-895d7ea27a1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72f3de61-6919-47ba-97c5-895d7ea27a1c.tmp
Size 23KB
SHA256 73a9fb5804214d866aee83a6c82b064dfb492bfadff0ee31ffc90c7e73c68d33
MD5 65be13209aa2e356c819d90ce612897e
SHA1 2fa968a8669f0e4bdbdbcb2e7f174e03b12689d1
SHA512 5bb1ccd51da2effe4501284ec79eae4ecb2d684be4950c52bbadbeeb18abbeee13a834eac1f0b7b9180f205e7f515d4e2af193e5c141616ca721fa1080666bc9
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWTroHr6:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0VJ
TLSH
T144B2EA2F644CCB7E8FD00A9DAC596F977E9802C796588D4047FE984C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94c52c0c-16fb-47e1-ab8f-1d9265a87939.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94c52c0c-16fb-47e1-ab8f-1d9265a87939.tmp
Size 11KB
SHA256 73c8f08c92ae47372386defd7fc67bf15fe7f44530df772e8c7825d92c855914
MD5 044d703333e80773a17b8be5db61a107
SHA1 6d40197b6053d466ed6f9ac141457ba618a403e2
SHA512 c1682777b9c8468b1c9b8b04c33cec93949ffba8658bea4fe362afcc11b6e78a407f0f20d99579b68d9b945a50a141d00e7a2a1ee69c89670d323d2b99599257
SSDEEP 192:sxRURBba/fs/sanyYhazoA8p4Q/g6+WNIY2FUZXGTIgIJ:sxRU7a/fs/sanbXR/5Iqms
TLSH
T1A432A815AE28E93B4CCBD21DBA65BF53D2FD5033A1941E48A6FC8A1C04E76DD620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f0d1684fb6de3d41a5dc2a625ce9750a76388be0f7462e214569aabf92e3e8ce
MD5 ae8ae5311ced122902260d36755f0573
SHA1 51fbfe43882edb9a63338647cf0364c5cfdb436b
SHA512 8bb378d537e8d94f8d893368a5ec821b5fd832d7295ae01edd6c7663f7f85eb0da700063a08b00b5d5abe7ae16806fbd0c0e6cd78504a4b592d1e9c34d09be59
TLSH
T11551A879CA605658FF5822FC4BE42DC73AF055B196CF9E0226A6DBF87B4E3D8C244004
MD5 SHA1 SHA512 TLSH

Submit Download

70ef7c04-9b05-4a1c-b795-c63a6cf82352.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\70ef7c04-9b05-4a1c-b795-c63a6cf82352.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

ba4f1e25-7d62-4c96-bc64-35a0128b6552.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba4f1e25-7d62-4c96-bc64-35a0128b6552.tmp
Size 3KB
SHA256 e947413e0069001a495656d76939c4fdbf2f4b9f32e2f7b765dcb13c9f21167a
MD5 2f96f46e5d6b3ecab46efd117db7b6b1
SHA1 cb39b92681ba2bbbe293a77f6909e9b7ed8762ed
SHA512 7cb66906249f7e47c71674a33617bf134bc77a404493c8143974a1fbfca6de9a84ba0504ea0d886b5a30b130fa45330c7c37e7b9cab8ecdca875421583a05999
TLSH
T1E781CFF687E4436E851196F09A24BD2BCE5C111A422C3CA588F4AF5BB3F24B1E04239F
MD5 SHA1 SHA512 TLSH

Submit Download

bdda850d-38ff-4851-b2d6-6ab53d1d611a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bdda850d-38ff-4851-b2d6-6ab53d1d611a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c0d9bbc7-46c2-41bb-9507-a937fe6d1569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c0d9bbc7-46c2-41bb-9507-a937fe6d1569.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 13e640e1b3c692051fde7463591311d6a770708a177ed5ff616a99635744b1a6
MD5 c1a7e2aaaea691fc5a4e85c2ba88f4fd
SHA1 365ad15b8873358c5ac89302af8a7fb02e465a93
SHA512 b20b5e367eeadd72ee164bde4d6a8b94b62a6edde964385f7f39faf702346f580044e3bfcd7d76bc6814ccfcc61325efa2aacff9cecd59d7d7a9ff0af57eacb1
SSDEEP 48:K41IVKugw/yJ2I3KXq4fEInK5mMbyA6r2qoH:K41iKugCK2cKXqgEYK5maZ
TLSH
T1D7917391707B960039BD750942B4962A664236F33056E57B3FAD81F25F6BE002EFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b0e3cf95-a2e9-4ee1-8b92-1d35f5b900ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0e3cf95-a2e9-4ee1-8b92-1d35f5b900ee.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ec4e57b4-2249-4c74-85a6-1d92c687cc78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec4e57b4-2249-4c74-85a6-1d92c687cc78.tmp
Size 11KB
SHA256 9474f7a2a3406e5a7942db9ea38187f34d278f003f4df9381df96bf1df6d35a0
MD5 968a550c1f019288035eec3da0dc599f
SHA1 58e52de38ed4bc0365117451ad943dcff2987496
SHA512 0c4ba9cd8c58baf909a24c293bbb3bfa806138cd67761d4f0e82f954823bfcf905a5dfbb2750059cdcf7dd976bbcb0f7e9e41a14024d3976f48d12a5d83396bb
SSDEEP 192:sxRXRBba/fs/sEnyYhazoA8p4Q/g6+WNIY2FUZXGTIgDrJ:sxRX7a/fs/sEnbXR/5IqmB
TLSH
T17632A715AE28A93B4CCBD21DBB65BF53D2FD5033A1941E48A6FC8A1C04E76DD620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ff95263-a439-4b99-a748-f4e14a1580f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8ff95263-a439-4b99-a748-f4e14a1580f7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b8de3bfa-997b-4c3f-ae09-028400bf425b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8de3bfa-997b-4c3f-ae09-028400bf425b.tmp
Size 35KB
SHA256 9e32589dbbc75b7fe5df46c5b9c47107f94221002e38ecb31a281e9c279d67f4
MD5 46cd5f49a5bc822556f39cc349ae7ae7
SHA1 9603e822b5653383d3da79bc1c2bc63b981a59f9
SHA512 99a3e7cdf9c97c5c2ece49c0919255fa437e07b9050084fb72c5522c18dff0a35a48738922504e5a22af9ba774d338ea5aaf86188deee2477a3a20e21058488e
SSDEEP 768:mQ34FF9pgm1BcJdPDmGA5b65Q92RQMPbS5aTZcqHIL/:mQ3vJAF65dQlM7oz
TLSH
T1B2F2BF31ECA5DE738DB9A2D0764B7256BFB88123C5CC469099DD6F1C058BACD134B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6fb2e7c-f4b9-464c-8c90-fcb67b536141.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6fb2e7c-f4b9-464c-8c90-fcb67b536141.tmp
Size 35KB
SHA256 52164371a441959d664bf4b82d3e8b4f88105e9079d13617625bfb727e7c7dd4
MD5 0391061e01b6922b1737f0e9a08f0547
SHA1 7e34a3b21a31f7c04008782899aaed303b96b4b4
SHA512 ba2e2eb278cb4a06a6e76889cec52d230b6a58c933238907d1041125507a8a8990587bfcec480067bbebaa3d397a7a76bdf278ff3168738413095370535905e9
SSDEEP 768:RQ37FF9pgm1BcJdPDmGA5b65Q92RQMPbS5aTZcqHIL/:RQ32JAF65dQlM7oz
TLSH
T18AF2CF31ECA1EE738DB992D0764B7256BFB88123C5CC469099DD6F1C05CBACD134B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d64a490-c020-43de-8ffc-5e48601da5d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d64a490-c020-43de-8ffc-5e48601da5d0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f888956f-bd78-48e6-87c6-52ea377dcb9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f888956f-bd78-48e6-87c6-52ea377dcb9d.tmp
Size 39KB
SHA256 cce25656b07ae952fbe4cbff5f10b2fcfaae1a55155e14b874fefe361af4e3ce
MD5 65191210ade7ec17d8dd0c2313f20be9
SHA1 384bb76e610b169b1a8e95a4f2c05c1b03037231
SHA512 557ebd01d04bc7c3d2ee8de6cebd035985681616679d53645a0213d8fb9e636f9584bbb5410b82fcc9576d82e124740fcff5aaa4a4cc6a7622bad19b1b25d47f
SSDEEP 768:w/UxvxjgC+B3uZzgm1BcJdFDmGA5b65Q92RQMPqSFj0O:dZj3+B3PPAF65dQiFQO
TLSH
T15303D036ECA4EE739CF59180364BB356EFF98563C1C955E049E92F1D06CB68D430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download