2eaa0e0e3b72ed7c53918fe8538e0825c4e8cbc42f960742f0c3a67403a89318

Analysis

max time kernel
148s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gearsofmedia.com/1xbet-ofitsialnyj-sajt-registratsija-i-prohoda-v-lichnyj-kabinetik-1hbe.html
Size 84KB
Sample261027-pbb8ladd83
SHA256 2eaa0e0e3b72ed7c53918fe8538e0825c4e8cbc42f960742f0c3a67403a89318
MD5 18997ddb6f4863553fea93f7eff2658f
SHA1 57d98ff3de60bd3eee63ac50b6a1343052042a21
SHA512 2ce1c673454c1b75bc503731138aa1458a6aab1d7e2cff6d44bee24517c84ca194203c0bc88043089ae11361a2a0a6975fdb540883f78767a03fcbe296b9ae7e
SSDEEP 1536:Rap+FI4lYa01nThRjjU3fNQ00c3REu8FYYmYT9P5fQLuXUkJw6dUVKURPExbToRv:wMFI4lYaqh5jU3fNQ00c3REu8FBmYTVo
TLSH
T1CC8389203A9F148F220BA15FC8057B0D78EB45FEBF56576630B1387E35F2870967A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{2F58F0A5-12B8-4C65-B54A-308502546790}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1252	4000	msedge.exe	87
PID 4000 wrote to memory of 632	4000	msedge.exe	88
PID 4000 wrote to memory of 3548	4000	msedge.exe	89
PID 4000 wrote to memory of 3548	4000	msedge.exe	89
PID 4000 wrote to memory of 3548	4000	msedge.exe	89
PID 4000 wrote to memory of 2352	4000	msedge.exe	91
PID 4000 wrote to memory of 2352	4000	msedge.exe	91
PID 4000 wrote to memory of 3764	4000	msedge.exe	92
PID 4000 wrote to memory of 3764	4000	msedge.exe	92
PID 4000 wrote to memory of 3764	4000	msedge.exe	92
PID 4000 wrote to memory of 4720	4000	msedge.exe	93
PID 4000 wrote to memory of 4720	4000	msedge.exe	93
PID 4000 wrote to memory of 4720	4000	msedge.exe	93
PID 4000 wrote to memory of 4608	4000	msedge.exe	94
PID 4000 wrote to memory of 4608	4000	msedge.exe	94
PID 4000 wrote to memory of 4608	4000	msedge.exe	94
PID 4000 wrote to memory of 3012	4000	msedge.exe	95
PID 4000 wrote to memory of 3012	4000	msedge.exe	95
PID 4000 wrote to memory of 3012	4000	msedge.exe	95
PID 4000 wrote to memory of 3384	4000	msedge.exe	102
PID 4000 wrote to memory of 3384	4000	msedge.exe	102
PID 4000 wrote to memory of 4660	4000	msedge.exe	103
PID 4000 wrote to memory of 4660	4000	msedge.exe	103
PID 4000 wrote to memory of 32	4000	msedge.exe	106
PID 4000 wrote to memory of 4224	4000	msedge.exe	111
PID 4000 wrote to memory of 2540	4000	msedge.exe	112
PID 4000 wrote to memory of 4252	4000	msedge.exe	113
PID 4000 wrote to memory of 3388	4000	msedge.exe	115
PID 4000 wrote to memory of 3388	4000	msedge.exe	115
PID 4000 wrote to memory of 3000	4000	msedge.exe	118
PID 4000 wrote to memory of 3000	4000	msedge.exe	118
PID 4000 wrote to memory of 3568	4000	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\gearsofmedia.com\1xbet-ofitsialnyj-sajt-registratsija-i-prohoda-v-lichnyj-kabinetik-1hbe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb015dc188,0x7ffb015dc194,0x7ffb015dc1a0
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,11251139461602548478,17574388083286190233,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,11056670215680510033,14612955762879328794,262144 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,5241603080665164548,11114627035770720051,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,12716050051481249160,16141347146415039835,2097152 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,2827168698137597480,7051854594981582323,2097152 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,4117888237700034694,2122096186375903404,2097152 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11565093426142025242,9394099157352999855,2097152 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,13140461204475172539,16747382890068529416,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,228559958014465053,7981879826952611588,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,8502260709792420051,1423975650952600621,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,8502260709792420051,1423975650952600621,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,580242191137964125,3536731545629539203,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,10739885206834013393,14904020339073166484,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,13417055953212888017,7888924344247874521,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,2509708407388783762,2826224472931139686,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,17666955502844164624,6638002666809348909,524288 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,4684114661680606309,10043950074315911345,262144 --field-trial-handle=2156,i,18167934574902874895,5241757237290112955,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5ffb7689-1c26-48a2-8527-f39221415755.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ffb7689-1c26-48a2-8527-f39221415755.tmp
Size 8KB
SHA256 403dc640e8760c1c458529ba62c6b343b6b8e5a49f2633b6d9b9aefc7496b639
MD5 1360f39eaf7d34bd7633efe87c9ecd76
SHA1 5b29e89f918c62764a6bf38b74e1b7d67fd39810
SHA512 4eff96e2038e4dd33120884306ecc03ef7f4e975284d179b3f45f12426e1f6a4d2ac9b77c3123b95d3e6c83acf9fc9569698629fee5c3dac421eabc6f5b4c51e
SSDEEP 192:aONx6IE7QmiUy6PTPuIGmjs9X+8DC7sQJU6:aONx6DtfPuIGmjs9X+FskU6
TLSH
T1ED02E935AD787CB78EF3AD09B4877A23AEA5112BE5952F84DAD81A1D00DB24C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78e6378d-8ad0-42d3-9d8f-6112c5611697.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78e6378d-8ad0-42d3-9d8f-6112c5611697.tmp
Size 21KB
SHA256 4b1b58251b3eb438991801a836910900e79c6fc5bf256f0a883ad76fe8071e48
MD5 c5659a56c4baaa43c932d4a4c0b1f233
SHA1 c293d1b196c996d4518e7a9147692ef82338ee07
SHA512 ea81e1b01cd00fb52abe427b62d364f214cee85411b348f0c7b23d79e15526517d05a14f58f63ac15ebd035a73976751db3281927dac68570d3a495720e8e8de
SSDEEP 384:IiFzQkUSvjzsN38TUNTUlIlegN1pbT1zIGmjs9X+bVZoiZvaTZcpHovIIlm:TFdnewgBNL5ks9X4HoiZvaTZcpHMLE
TLSH
T1D9A26D339CB8EC7B9EA79F50E54A3613DEB48163C5C5AB94E6CD9A1C00DB29C130BE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a4b5813-fcb9-40a1-9417-95df4d31d728.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a4b5813-fcb9-40a1-9417-95df4d31d728.tmp
Size 18KB
SHA256 1b168fa12160b6d007322854cc7765b8d56810c427a3cc366c8bf40bc8bac23f
MD5 bd6795839b997c459758ea5db973e472
SHA1 f27f9f84db4966a1e08bf2aed5ee27efaf87c1e3
SHA512 65438611f1647a197f23f300cf16acd9088665e24a6f7345e02ce1da0c39561a539b4f456c03043e7d92c72cb7588e54085e191844182290cd0ad191f0fa5157
SSDEEP 384:2QkUSv0sNtegN1pbT1zIGmjs9X+bVTiZvaTZcpHovIIlm:W0aNL5ks9X4hiZvaTZcpHMLE
TLSH
T1B4827C31ACB9BC274FA79A50E14B3A13DEB4D163D6C86F94D5DD9B1C00DE29C230BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dbf1f5c-d585-4486-aaaa-1223e1207faf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9dbf1f5c-d585-4486-aaaa-1223e1207faf.tmp
Size 8KB
SHA256 e570262b8f82a48487b871055235c9b6111195ca0570a4702baea0d924f8e646
MD5 fdaeb0eb6c96510b14f4c8e692cda4cd
SHA1 cc25ef885da813770e4775bfefb2aebecc4ea8fe
SHA512 a7427ca28981907380d2f3e145583deb12e0b930c0db3be33b1446da7dd025e3d2fbe1f14c0b72f3978137b8aa4ecbd65b246de918e64e7d19ab7c2626caac53
SSDEEP 192:4JONQ6IEbQmiUyHPTHuIGmjs9X+8iVd27HHqeU6:eONQ6DN0HuIGmjs9X+bV6HZU6
TLSH
T13A121931ADB8BC675EE3A945F08739239EA58227E6887F94D5DC1B1C01EF25C130BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

37f9f58a-ef9f-4b6b-8139-48a31ef9c96f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37f9f58a-ef9f-4b6b-8139-48a31ef9c96f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4ff456ea-a422-4277-a030-b410a568ec44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ff456ea-a422-4277-a030-b410a568ec44.tmp
Size 10KB
SHA256 ade040d0a4101b129286376bc667159c573f43d920022d87bb7b668e2bdde05f
MD5 5011fdb627da1b588fa4da3add613a98
SHA1 db2b19c4c35b378fd44e56254a8f5389581b79e0
SHA512 248e64780aeb706dd9b6acc87c22d71917fc2ca759e24606f616f912da06332147f1c612ada9e00803d63cfd9ed7dfee59b1c36d26ea83960a4239a4ad664661
SSDEEP 192:sxZ2RlWe/ftsMOUWIdpdAHW6+WNGYaplftezIg5xJ:sxZ2We/ftsMOAyHbGgp
TLSH
T18022B6126E38A97B8CCBD31DBA55BF13D6FD503291941E48BAFC961C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f1e8bb8-a46e-4142-84c9-4ca1ccb73983.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f1e8bb8-a46e-4142-84c9-4ca1ccb73983.tmp
Size 9KB
SHA256 f7ec732035b778502c31193d5d0f695beb6e43af6d16a6a97f04f8594505d502
MD5 d0a34ed05a20a12afea2aabe8293d871
SHA1 9c458d722c37ef230421d9a1d6662fe02668a821
SHA512 bab82d84e5e1d5947846e2f0a24a6acbd5d6504e03d1eec89652a00355aa31440c1184d46d8d310ad036d0ad8e751adea69344b13502b8717829b049661dcfa1
SSDEEP 192:sxZ2RlWe/ftsqOUWIdpdAHW6+WNGYaplftezIgrJ:sxZ2We/ftsqOAyHbGg9
TLSH
T14322B7126E38A93B8CCBD21DBA65BF13D6FD503291941E48BAFC951C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f572f24-3553-4cf9-bb12-8888f71187a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f572f24-3553-4cf9-bb12-8888f71187a0.tmp
Size 10KB
SHA256 d84d54957e3f491626fd4a4ae79ee3c90b8f7cc8ecc5e70552b35d5b6a04ec11
MD5 059e5a142d03ec9c58263c30a26f3074
SHA1 71983a8ff2e205710f6731b0022476a8467928c4
SHA512 2562b0d47f0f079efbe07f62a256cc10e70d68fc734f27b2723337b9da693d5d5f4d482365e40795e4f6c09ef3d5c32d1ea42eb0d67f815d74fc5157ea17a720
SSDEEP 192:sxZ2RlWe/fts4OUWIdpdAHW6+WNGYapNBtezIg5rJ:sxZ2We/fts4OAyHbGe/
TLSH
T10222C7126E38A97B8CCBD21DBA557F13E6FD503291941E48AAFCC61C05E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 86fe13e646166d156d1fadef674cb22d313bde7202a63bf23f3df786d8c0498c
MD5 a7592b5e97bd172a3602224c3cc67885
SHA1 6d0917b6bddf1979bec5914bbc680cb2dc7eda8e
SHA512 9b4722c7bd6c4902a196f9a3ef2748883a0e0c50c35d578ca5509204fb98d3b463c806dea932020420b4971952db2c516baaefb46559b2d3985bbef9ae69df8a
TLSH
T17DE026F4A4CCC26FAA88644B057C636CCB81269BD3C47B0E2B08C9897207184A797AD4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e39d95f01f4fc14096495f831aa1360566a2cc795592d57c54a4430ce8e60e85
MD5 85c5bb254a569148b2be145d43057c9e
SHA1 551b817cd81c0ff2def90ce648f15c24eacccb13
SHA512 3e062dbf4ca2a2e686fc9c07db8f82e28fe12c01148b6947581f51c1be1dec5281312b25445e78c905e1d783d4fba7e5aecfb6dd76ed0909dd6b7fe84b16a156
TLSH
T1C8519996E66180B5C7647C71BCC11EC3BF34DAB856B34EF219E8D4B8AF86F526100364
MD5 SHA1 SHA512 TLSH

Submit Download

cc39a73d-4bf2-4189-93b3-c9130a0f86fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cc39a73d-4bf2-4189-93b3-c9130a0f86fe.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8794dde2-4567-49a2-925f-13ffc228da9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8794dde2-4567-49a2-925f-13ffc228da9e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a59d36ab-3171-4684-85be-4a8fc20b969c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a59d36ab-3171-4684-85be-4a8fc20b969c.tmp
Size 3KB
SHA256 c8a769307fa3af74283bdf1a805a0b28ed8342f8ad97e4c6461c256ff7a04787
MD5 f702ca5233ec2fd7241458b68d366c3f
SHA1 8dd47704ec98e7dd238985293e73c638111c925b
SHA512 43712ad10f2bb30d2a37cd913f2bffda691338dcd706e4ab0658bcfb2710010cd4e17f3b2179ba07ab1a67b2fae4e8d9ba98b7750980abb01a589d55469840e8
TLSH
T142519BF686D8476E842656F08B24BD2BDE5D115A42283C658DF4EF4B73F24B0D1023AF
MD5 SHA1 SHA512 TLSH

Submit Download

b03f689a-3745-483e-9576-3bb485584c1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b03f689a-3745-483e-9576-3bb485584c1b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ad28115a55a504e2598322c8c04005331ffc0edd3b622b224ef8efba38591a2
MD5 09cfddeb4ae87060d14d7517214576b8
SHA1 c781d8acc911e513d5175d4f5a8893dc76b9c4b6
SHA512 b194a8bd831646bf1b113586fed9a1f9bc5d5609f3a7358062c75e0d8b2e2db0ee62762661ed9629bb37f44dd977be5487b92d56796b8064d3d7bef5cef8ceb9
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyLitwciAgxb8LsIS0xK941Cxx6hYj03E:KkSIKHq2W1GKewxLCKwAKy
TLSH
T10D917D51B0BA9301387D396850B4862B528331F33059E56BBFAC51F54AAFE018EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad6258ac-c3e4-4fd4-a301-213bbd719565.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad6258ac-c3e4-4fd4-a301-213bbd719565.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe577fe7-2956-4e51-8359-d50a8cdd90a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe577fe7-2956-4e51-8359-d50a8cdd90a6.tmp
Size 10KB
SHA256 8b0e03dfa10dc6f189d41a1ddf9bc3a138844246dca6097fe1876f02245451ff
MD5 13aada7a3eee16e1dd595a1ad3ba1e00
SHA1 5f58525b1551d320160954cf6cbf8776aacd0da6
SHA512 09fbf3d2c59ca1c71f42bb936070c70106994d0bf6e64be080f1f6ac851ffb6fdd9057c3b50db6dcc3ac06fa95d04faf42b5327c52748e57dce685d97bea5c45
SSDEEP 192:sxZ2RlWe/fts4OUWIdpHAHW6+WNGYap5i+ezIg5rJ:sxZ2We/fts4OAgHbG4/
TLSH
T16022B8526E38A97B8CCBD21DBA55BF13E6FD503291901E48A6FCD61C05E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff1fc40f-e723-42d9-8e28-6e9952a4b783.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff1fc40f-e723-42d9-8e28-6e9952a4b783.tmp
Size 27KB
SHA256 286cb27c76d09b18b07fde7421c59b4bd1cebc1359f7a15e1509687f1bf5e520
MD5 bdf578a25c49452c78190da6bd69fcb1
SHA1 53d880bf5e0b27c6e547f84a0584b9c1b1d6904e
SHA512 6e739c8d14b7e871a7a38350b2d23284ed630d1a7152e0b75a56d8e42c1ce7c43c32b0a73a0fecb2c0d200e31cb8056fa51d9bb22f2572b9a9b0e429b1005e46
SSDEEP 768:woWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7/ro4ufedXmRv:woWPcLKWvKeEeu1jaClLiF7s4uWRmRv
TLSH
T1E7C2EA3B644CCB7E4FC01E9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83534ea9-fb13-4d57-92a6-6ba1cb5ca948.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\83534ea9-fb13-4d57-92a6-6ba1cb5ca948.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ab21685c-ce3a-4e5d-9be3-5206565de198.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab21685c-ce3a-4e5d-9be3-5206565de198.tmp
Size 18KB
SHA256 d69c094829361dcdff776625bb47c6265126be6cc6d7e352c8591b1791ae73f3
MD5 aa3fdf0976fe6cf9e8200851a143fb94
SHA1 17eeda3a52631d4b3c2dcfccd15d3f0913167a10
SHA512 f2bac42ec95b51ea8a22f5d3661841714ffb4e5fed93b0b09068b51cba6c868526ef2f5e0ce78b7a25a1e7caed096e93684fac1532f97c89d93c0f451da772d7
SSDEEP 384:aQkUSv0sNtjgN1pbT1zIGmjs9X+bVTiZvaTZcpHovIIlm:C0PNL5ks9X4hiZvaTZcpHMLE
TLSH
T1A2827D31ACB9BC274FA79A50E14B3A13DEB4D163D6C86F94D5CD9B1C00DE29C230BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab38379d-d1a8-4224-b96b-87360ee232d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab38379d-d1a8-4224-b96b-87360ee232d8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8018fbda3de8f534556f494ea4604d66c8c5cd8afebbe09128dcda899252e916
MD5 7910954fcd3801c7c31fe1cbc7d79fd4
SHA1 448f53ce72e47bec3a45542ef5ed694fb6550b27
SHA512 abe1ac44230f665a9439b8ecb6401929d2133881ad829dd14fefaf0b55306c48762652dde7103020eaea855045afa4d6507ab150292fd086992232fec4355637
TLSH
T1BD412758F6EA1158B3B36F59ABF6A86D487F7D272F46849E00110D4F0A66B40C971733
MD5 SHA1 SHA512 TLSH

Submit Download