b4a358e84977cf3cc834e24c0a494001fa3466cce830b882f9f2a91f24a9a809

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gearsofmedia.com/1xbet-stavki-i-sport-onlajn-bukmekerskaja-kontora-1hbet-1xbet-com-ma-1xbet-co.html
Size 85KB
Sample261027-pbb8ladd83
SHA256 b4a358e84977cf3cc834e24c0a494001fa3466cce830b882f9f2a91f24a9a809
MD5 f092a107aceb518b4004a7129439802a
SHA1 9455aaab75b6480b9c24fa32ca04e9976957a0f7
SHA512 a4585614c8ae031060b2824048aff43571899369e271e9745000b329fdff197f18d1ee9e4e78a269ea17952eaf4aa240d24de0c07cbd4db4c9d6ed45f8a2a958
SSDEEP 1536:rRap+vI7Aju8PjmjqNJZqSXzHRVxqb/JSv+vAwzZfQLuXUkJw6dUVKURPExbTMR+:rwMvI7Aa8PjmIJZVXbRVxqb/JSv+vAwZ
TLSH
T1D48399607A9F148F220BA15FC805770D78DB49FEBF16636634B1383E34F2874967A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{6E91736F-3A34-4026-A09B-E3A3D8C527A3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3680	1176	msedge.exe	83
PID 1176 wrote to memory of 2188	1176	msedge.exe	85
PID 1176 wrote to memory of 2212	1176	msedge.exe	86
PID 1176 wrote to memory of 4804	1176	msedge.exe	87
PID 1176 wrote to memory of 2212	1176	msedge.exe	86
PID 1176 wrote to memory of 2212	1176	msedge.exe	86
PID 1176 wrote to memory of 4804	1176	msedge.exe	87
PID 1176 wrote to memory of 1668	1176	msedge.exe	88
PID 1176 wrote to memory of 2860	1176	msedge.exe	89
PID 1176 wrote to memory of 1668	1176	msedge.exe	88
PID 1176 wrote to memory of 1668	1176	msedge.exe	88
PID 1176 wrote to memory of 2860	1176	msedge.exe	89
PID 1176 wrote to memory of 2860	1176	msedge.exe	89
PID 1176 wrote to memory of 3840	1176	msedge.exe	90
PID 1176 wrote to memory of 3832	1176	msedge.exe	91
PID 1176 wrote to memory of 3840	1176	msedge.exe	90
PID 1176 wrote to memory of 3840	1176	msedge.exe	90
PID 1176 wrote to memory of 3832	1176	msedge.exe	91
PID 1176 wrote to memory of 3832	1176	msedge.exe	91
PID 1176 wrote to memory of 1740	1176	msedge.exe	95
PID 1176 wrote to memory of 4364	1176	msedge.exe	96
PID 1176 wrote to memory of 1740	1176	msedge.exe	95
PID 1176 wrote to memory of 4364	1176	msedge.exe	96
PID 1176 wrote to memory of 4044	1176	msedge.exe	98
PID 1176 wrote to memory of 1700	1176	msedge.exe	107
PID 1176 wrote to memory of 4688	1176	msedge.exe	108
PID 1176 wrote to memory of 5112	1176	msedge.exe	109
PID 1176 wrote to memory of 1724	1176	msedge.exe	111
PID 1176 wrote to memory of 1724	1176	msedge.exe	111
PID 1176 wrote to memory of 4880	1176	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\gearsofmedia.com\1xbet-stavki-i-sport-onlajn-bukmekerskaja-kontora-1hbet-1xbet-com-ma-1xbet-co.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fff753bc188,0x7fff753bc194,0x7fff753bc1a0
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17478073779590199071,3960951403873998934,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,2356929244442314433,17471728588475129825,262144 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,18087649009884600056,13288155792126055051,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,15374293561151305075,14149192522046040388,2097152 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13320895650861820741,9806982594190119222,2097152 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10891157664694363611,4060373125766766509,2097152 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,10552522341940296239,11742882900290251550,2097152 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11365774620084701199,4381042642737385155,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12802404779873356121,16457208695216951053,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12914489947522088042,7242296975077149947,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12914489947522088042,7242296975077149947,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,212236925437179798,8296415962832790040,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,1148520670218782907,3394555496877397576,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,10758859066642128863,1766679556259583400,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,9419334579508771868,16236174363656585548,524288 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,11774337709305696640,1456623159171265184,262144 --field-trial-handle=2324,i,8343596417534318859,2360253820985343836,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f9d56b6-1931-4302-baed-d691047a9dc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f9d56b6-1931-4302-baed-d691047a9dc4.tmp
Size 8KB
SHA256 259442931d7426181651d90d6ebe3ff58ad7a2bcaae2958c488ee5a5fec13c84
MD5 9dbc0559a9a91bd17d6b0416dab6c41e
SHA1 9f249042c81575949105143921d9e9214716e84d
SHA512 efdc4c3c0aaa5dff023e9e7f8e65b5c3451f998f10f3f56ed1de68c24846b64f0b583d516f793edbdb29502356e45e12146f904bccb79adf8cc210b1e3bc896f
SSDEEP 192:EONV6nnHGQmiUyW+QYcX5hQDP1Mjzor816McEhl9UU6:EONV6nC4QNX5+Dt8881iE9UU6
TLSH
T12202EB34F9747C7B8EF7AE46B0863313AF952167E5942BC0DAE81E1C00D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ffe4bae-673e-43b4-8ac0-562082b5ac26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ffe4bae-673e-43b4-8ac0-562082b5ac26.tmp
Size 18KB
SHA256 d6df3043d3bb29b12e42e417de0b7dd3f2b116b40c22db8eecb52858b336ae27
MD5 695b2d7dcee5dff6ef8ef8b625fd03a4
SHA1 cc450ff3d84b19f114ce21fef45bfc2470973420
SHA512 11ac11942b32ec8ecd45ad76f311a3f46b06414fe16b36b419cf61830c342961bfa64e595816ed7607415547dfadb66f7a6ce477016c376c7af56aecfad30ed5
SSDEEP 384:pQkUSv0sNeIxbRiL5rQX5+Dt8881xXcKyMvaTZcjIIlm:L0a4ckD2VyMvaTZcjLE
TLSH
T11C826E35A8B8AD274EE7A651B14A3103DFB49157D6C81FC0E6DD5B2C01DE69C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e22fda1-c65e-45e4-9ab3-da34a3d01e64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e22fda1-c65e-45e4-9ab3-da34a3d01e64.tmp
Size 21KB
SHA256 3e9a4dad5679fd4e275fc3b34b2c1751351c81a619c77d8a75fedd52d3f4c7c3
MD5 49536838fcdd658c1d06a8c5b8160427
SHA1 624f8c2140be646700db5b2d9a56cfe6d2c49e8d
SHA512 9525e464e72451007b7f621ac98cae97f88766732b4ccaadb8145c72f5d789d221f6df58adaff3040d6ed64df2032c5ed3b52e8fe41c7ea7652b9c6016ebd8e7
SSDEEP 384:FiFzQkUSv/zsNu8TUNTUlIlIxbRiL5rQX5+Dt8881xXcWyMvaTZcjIIlm:MFd7XwgS4ckD2LyMvaTZcjLE
TLSH
T10BA25C3398A8DD3B5EEA9B51F14A3203DFB45167D984ABD0E7DC9A1C01DA1DC230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a55ad88-07b6-4918-9f9d-59b18472a824.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a55ad88-07b6-4918-9f9d-59b18472a824.tmp
Size 8KB
SHA256 7b7748528889b23b8b534320a08938066bf96c5aa510dde4c3e923b1affd644f
MD5 bce1e897ff660ef6691f9e403914e252
SHA1 fd840bfd81cc6659b5b295f50614bc0f7338b66e
SHA512 192486d863f79f8cbaa9ab22c02c7efd5d173cc4cee6b51bafd9477ac3a77c621b61fc5279c4841a7d550d0d118f86797548edf0a81c985ea5810f8e8eb632bc
SSDEEP 192:pONP6nnHVQmiUyi+pYcX5hQDP1Mjzor81xXONiwg3xq5MU6:pONP6nTCpNX5+Dt8881xXcEyMU6
TLSH
T1B5120C35E9B8FC6B4EE7A591B0873113AFA55127D6886FC0D6EC1E1C01DE65C130D927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

41264714-c715-49b7-a105-9ae0a21035b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41264714-c715-49b7-a105-9ae0a21035b9.tmp
Size 9KB
SHA256 a091365f2edb6de0069981b38d2c49946618ae4a70832e2ef950a15f2cba1569
MD5 a43532d696e7ae44723547dfcc5b0d1b
SHA1 19f6b6b9e0de9d560a508cd3d986c47cecf8e4f4
SHA512 ddd4e1b9dbf1e60b5a7d4594af6e38dd9640504c52071ce8a9dad77da9fb713ab86b1a33b40dbf682582ceec6a0184fd99719d54e9ee016e7731cc54d0f19368
SSDEEP 192:sxZuR6WI/fRs+LIdpd6HW6+WNGYYB1ReXIg5bJ:sxZu/I/fRs+UgHbGfIH
TLSH
T13422A6116E38A57B8CCBE219BB55BF53E6F9503291941E44FAFC861C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ad74dd4-f5a6-4ed1-8281-9147af6f8dff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ad74dd4-f5a6-4ed1-8281-9147af6f8dff.tmp
Size 10KB
SHA256 a09e3e7e8b68e92432c9ff53783dc8b6d0e663fe9bd4ae29dd40184c36c8cbe2
MD5 fc60dce97e734e6dbbf1f0e9abb8fd39
SHA1 33680e1c21638a0752d4139c73cc00258cb9cf55
SHA512 db479de81fad09fd5b41dff34ed8887780b47fe12664e1886fa7929b601e0ca710012abff61da2342cfc0a581695dd57392f7799fe6e0520fb79df336c845172
SSDEEP 192:sxZuR6WI/fRsoZIdpd6HW6+WNGYYBXJeXIg55J:sxZu/I/fRsoygHbGfq5
TLSH
T12B22A6516E38A97B8CCBE209BB55BF53E6F9503291951E44BAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c6aa6b3-8d2b-478b-9efc-1fbb764c52f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c6aa6b3-8d2b-478b-9efc-1fbb764c52f2.tmp
Size 9KB
SHA256 3d0d31849d5cdcc36d91622c5f286e876fe33a4087f73ebd7bb5d16ff3da2059
MD5 8487899b89cf87fb121d8d52597c27ce
SHA1 ddf2707f7cbfe53e1984bce842d1b2d411b3e6b3
SHA512 057665b57f07aa3001e6b4a96156f51daeb13bbf459ea9b144f886516ad5a3c9ef49461c5f34686f4b320d9af2d8e19cae109e8772a8803502641eb57aeb6724
SSDEEP 192:sxZuR6WI/fRsaLIdpd6HW6+WNGYYB1ReXIgrJ:sxZu/I/fRsaUgHbGfI9
TLSH
T1DB22A7116E38A57B8CCBE21DBB65BF53D6F9503251941E44FAFC861C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e4a0f3f0ab1eb10a3db93696e5b4dc6d9baadcfcfbf1f42f7f14ea830ebcf4fa
MD5 ce005f5586d9a2e807d40c133f956644
SHA1 641061dfb3798e9727d815366ce9a3d4b9513ba2
SHA512 765f01fe9555c131715a5bda83824d829155584d2ada35c2e4ce8bbe7e56fbfe6debba98e6e2d4285d7c14ff5afebb239cec86dda68efa67daee505c451ccad5
TLSH
T1C75173428EA1FBA0F7981731BDD21EA73BB08D4C45936F4030A4C4B99A1F71B7120C64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ec60ab86e554e94cdf274740e399e599fb8bbe0f74e9734b5862d6a2fbdec688
MD5 341e9af6435bcd9eeab030c6e6e56c60
SHA1 07b6f3b93d72e7f4a31b8f04c9e2d5fd52c08e9f
SHA512 d80116c9a2d2803847bba141aa869d3b2acd737d2a5b8871e03290de06030ea93839b8f10d0e5df135d7ed5cb1ad6d4b4b3137a9fec04c60381f8df5ea125bad
TLSH
T1375173428EA1FBA0F7981731BDD21EA73BB08D8C45936F4130A8C4B99A1F71B7160C74
MD5 SHA1 SHA512 TLSH

Submit Download

f775c51f-1a19-4d0d-9c07-b07bfd1d175c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f775c51f-1a19-4d0d-9c07-b07bfd1d175c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

19811c81-4ecf-4b02-9054-f00bb4679a4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\19811c81-4ecf-4b02-9054-f00bb4679a4c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

33a0bc22-6c83-4844-8235-2ea9ca04749f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\33a0bc22-6c83-4844-8235-2ea9ca04749f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ea5c3798-3443-41aa-ac35-d86f9f4c06c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea5c3798-3443-41aa-ac35-d86f9f4c06c5.tmp
Size 2KB
SHA256 91937387a4fae917ab126254c0f94c8617a4febe56aab89b44c2316421fcf4f5
MD5 4eb7b66ee53dc4214f85335bdf2d5a1e
SHA1 a2a411014fb3bc7e14bf2a5d2aaa23eba98445a0
SHA512 20ed1b5f61daed29e0d7fd0f9048938e3f4efb2d6241abd0075fcc1f952b18b8a5357759ca0272b1b48aa7f0794bfc2ec0d27e12236012a2c6524170aec532ec
TLSH
T1AD519CFA87D8476E881656F08A24BD2ACE5D111A422C7CA589F4EF5B73F24B0D10239F
MD5 SHA1 SHA512 TLSH

Submit Download

db8a0ccb-a123-4524-ac3c-423c427796af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db8a0ccb-a123-4524-ac3c-423c427796af.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f280474c-7d4d-4882-9a08-66b85957a423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f280474c-7d4d-4882-9a08-66b85957a423.tmp
Size 27KB
SHA256 50c97a5ad1e27894ab24e8991baf8c777203ab235126e93b8eb59bacf10fe8d0
MD5 49d343f00ebd855a3964464413572a99
SHA1 91b7d690ae8005df5df6fd0a78b3fdc76e725337
SHA512 7d90ee6b9d2806209ee50b4b6bdecc1b230835b7f2ea4bc7ccdaee1a253d49702a6a5e124d79adaed856a262e8cb46265254d3a3b8713046e8535f68f543bc1c
SSDEEP 768:cByYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXiropPQu:cByYR7jWv3NpBu1ja/CL8OX55
TLSH
T19EC2F92B640DCB7E4FC01E9DDC5A6F9B6E9802C796548D4047FA944C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd57dff6-5cc6-434a-9c7e-9954e1d7f079.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd57dff6-5cc6-434a-9c7e-9954e1d7f079.tmp
Size 10KB
SHA256 564a9ec34226d4f5e1b068ce1a5e183904e753df6e0a2858b47b189e6a3b59a5
MD5 6e0230bda5605ed3bcb22aea6079dd8b
SHA1 c5eee8572fd63416354cb5207912e70064a66f01
SHA512 95d244c1e802e7b68cb2ce572bbd8815e70a032f597f5619b58de9cb7bc7d6b240ac105505e2299ea9a2444fd12d8f96cb1bcd71941794caeb3c02f3d7eeaeca
SSDEEP 192:sxZuR6WI/fRsoZIdpH6HW6+WNGYYB22eXIg55J:sxZu/I/fRsoyaHbGfo5
TLSH
T1D922C7516E38A97B8CCBE20DBB55BF53E6F9503251941E44BAFC861C05E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1be03fa0-303f-471d-94dc-83e509b5a236.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1be03fa0-303f-471d-94dc-83e509b5a236.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6e6217c-da6f-4d70-bdec-3ec77f1d312f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b6e6217c-da6f-4d70-bdec-3ec77f1d312f.tmp
Size 18KB
SHA256 f2bdb0560f1fb484a1fff17691b2e3ae559f239355e3e77b84ef26a881b9f8a2
MD5 af2b3c463bba087b1d25d5128423a9c0
SHA1 5a4e10c500ee8f38e2bd282565d56d0f9101efbe
SHA512 a1a5edaf04b2464d045a887af0271b9035ba4d1d4c467c30a0dc9f18537a3047e7b0d35494543d207ec0794b0745b4c75dad7d7f86865c005cafb69d475eacdc
SSDEEP 384:4QkUSv0sNe1xbRiL5rQX5+Dt8881xXcKyMvaTZcjIIlm:w0v4ckD2VyMvaTZcjLE
TLSH
T15C826E35A8B8AD374EE7A651B14A3103DFB49167D6C81FC0E6DD5B2C01DE6DC230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32f6663b-1b8d-444e-bc1d-0ba1640bdb23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32f6663b-1b8d-444e-bc1d-0ba1640bdb23.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a7ad39d746c97030acecfdba67783d5428d191990481b5621b6fa1fa71406bd
MD5 a73e07af05507b04d90663b01e5ff670
SHA1 bd6bb701b108128c9ef6a530019bcfd32f397a1d
SHA512 e922cf305901607ce3a5de0a267bfeaa83255cd9a71ee7916afb404bcf15e38ecbdc54c30b35b8522a5d8b7532894dfd84c881e2df32ddd86c281c272484135b
TLSH
T1C6410948AAFA1148B3776E1AABF7996D447F78772E46D45D10110E8F0A73F40C5A2B33
MD5 SHA1 SHA512 TLSH

Submit Download