hxxp://ggeemm[.]com

Analysis

user interaction
yes
max time kernel
40s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ggeemm.com
Sample261102-1zd8msdv41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2420	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{EFEE20BE-91BD-4D0A-AAB4-F53C5F42D178}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3852	2520	msedge.exe	89
PID 2520 wrote to memory of 2420	2520	msedge.exe	90
PID 2520 wrote to memory of 1320	2520	msedge.exe	91
PID 2520 wrote to memory of 1320	2520	msedge.exe	91
PID 2520 wrote to memory of 1320	2520	msedge.exe	91
PID 2520 wrote to memory of 4232	2520	msedge.exe	92
PID 2520 wrote to memory of 4232	2520	msedge.exe	92
PID 2520 wrote to memory of 1368	2520	msedge.exe	94
PID 2520 wrote to memory of 2980	2520	msedge.exe	95
PID 2520 wrote to memory of 1368	2520	msedge.exe	94
PID 2520 wrote to memory of 1368	2520	msedge.exe	94
PID 2520 wrote to memory of 2980	2520	msedge.exe	95
PID 2520 wrote to memory of 2980	2520	msedge.exe	95
PID 2520 wrote to memory of 4268	2520	msedge.exe	96
PID 2520 wrote to memory of 2988	2520	msedge.exe	97
PID 2520 wrote to memory of 4268	2520	msedge.exe	96
PID 2520 wrote to memory of 4268	2520	msedge.exe	96
PID 2520 wrote to memory of 2988	2520	msedge.exe	97
PID 2520 wrote to memory of 2988	2520	msedge.exe	97
PID 2520 wrote to memory of 4304	2520	msedge.exe	99
PID 2520 wrote to memory of 4304	2520	msedge.exe	99
PID 2520 wrote to memory of 4304	2520	msedge.exe	99
PID 2520 wrote to memory of 1808	2520	msedge.exe	101
PID 2520 wrote to memory of 1628	2520	msedge.exe	102
PID 2520 wrote to memory of 1808	2520	msedge.exe	101
PID 2520 wrote to memory of 1628	2520	msedge.exe	102
PID 2520 wrote to memory of 4772	2520	msedge.exe	104
PID 2520 wrote to memory of 4524	2520	msedge.exe	110
PID 2520 wrote to memory of 4524	2520	msedge.exe	110
PID 2520 wrote to memory of 4524	2520	msedge.exe	110
PID 2520 wrote to memory of 1300	2520	msedge.exe	111
PID 2520 wrote to memory of 1300	2520	msedge.exe	111
PID 2520 wrote to memory of 1300	2520	msedge.exe	111
PID 2520 wrote to memory of 3496	2520	msedge.exe	115
PID 2520 wrote to memory of 1032	2520	msedge.exe	116
PID 2520 wrote to memory of 4376	2520	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ggeemm.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffafa1dc188,0x7ffafa1dc194,0x7ffafa1dc1a0
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,17605257370883525440,12075646144699823060,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11871620902533962058,11605343446978729132,262144 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,6539983849613780907,9280011199386244899,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1686256874967865855,4291334750952955810,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17966655012808837584,9563311578526386416,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,15869789789756489847,10538412242044552115,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,2738815304274925073,4864270862343492687,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,10313660970342057954,18117773710612901172,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,2545606447861613282,9158883033219148542,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,8640821443308031187,7613403480133626847,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11755821792362137061,10068801520843427653,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11755821792362137061,10068801520843427653,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6252,i,5931510331565295400,12828481886869849166,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6368,i,5231486721505255180,3036411797476306413,2097152 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,960826675007015469,14693234135572539296,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7396174956909995879,6692101771954358415,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,11567316870522216820,3521052031417516111,524288 --field-trial-handle=2812,i,5720357196368496857,3328798920212685100,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2a5b8595-8521-4d33-8a5e-4e611370ada7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a5b8595-8521-4d33-8a5e-4e611370ada7.tmp
Size 18KB
SHA256 530997914dc542c6b281ee90f3b302a4603a3394f20e53cf215379152d6d3942
MD5 fd78c3680239f7b0b6652f46b4608972
SHA1 6e5ad36d11b9ef77463a53259e599633a9db6123
SHA512 0043199bedef028493759b6548f5b3e35d331cec2a7623cdec3862ee7c639a6347843c07a8a4ab6863b5f1d45584222ea1ec1e5e4e218be6f668929cb70ab856
SSDEEP 384:/QkUSv0sNlkFZbnUVI2h//oT5VeE9bH7vBEvTIIl6:B0HGIG/AT/XbH75EvTLw
TLSH
T119827C767874AC7B4EA3D654F10A3653DE70906BD7C45F90D9CEAB2D02CA19C230BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f8a96b9-331e-404d-8296-8ff54a43794b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f8a96b9-331e-404d-8296-8ff54a43794b.tmp
Size 8KB
SHA256 bbd5bdb22d18dcb735d47f528daa01fd580d2b1f9364244f3a7281da299fa20d
MD5 52840663228940b540826f063174eb2a
SHA1 4a91bb0e8c9aa38d2bcb1d3b5619ab7b40aa7f05
SHA512 144f516d794b2cb08a076a233e44adcf3281057281227d474210084131202baf136a0bd09719daae69b2fdc914b5993732d356054fb60173c7801731d6b84ac5
SSDEEP 96:KqONkFQsjpfbUmjH5ih/cIPURHl8h4otop5waD2BKP4v+Y1xf//ojd2xyY5qsoT2:BONh6JUm0QmiUypmso//oTpBCDlU6
TLSH
T17902E939BC78ACBB9EE39E45F0477B239FA4106B96915F44DAD81E1C01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1a7dcd2-5c1d-4a5a-9081-06a2e73b42a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e1a7dcd2-5c1d-4a5a-9081-06a2e73b42a5.tmp
Size 105KB
SHA256 2ef96264d2b79f2f32ba7c3f4d8bc3a7cd12206153f6218f7bbe1251f2de650f
MD5 1ad9f96c1fcd1af763818d9e108bb5f4
SHA1 1e2816ec93f878922501ab302f5c8c4e7ebcd07d
SHA512 e00a04412dedd2975b5ca272c9660f6c9931bacff5f3a31e6eda9d9dbf0a5b61954f0ec88458dfe5f52a32f35c3785be60c678cc8a35853099cfde0c58ccdbe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T1EFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

0574a52b-bac5-474b-b544-ad2f0b1b66c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0574a52b-bac5-474b-b544-ad2f0b1b66c8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b2e011f-5eed-4a8b-93ad-b02369a3440a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b2e011f-5eed-4a8b-93ad-b02369a3440a.tmp
Size 10KB
SHA256 4bdf023d6978e59ad265d6cdf32ae07afeba98be8ba3a2e5bb5d552b025e149f
MD5 bd4a7483f450ae1a7ff21319ec63abb9
SHA1 13df8a05f24e9f7f33a286127baf70e158c465d4
SHA512 f25102f3ff600fb414204ef784e459cde01e1119068c2525ff9bf09bd036446744580e4ba2a28aa5c75daa6fffd88fe8e5ddfb8a274e9cdcf393aa72b5a421b9
SSDEEP 192:sxZMRQWc/fpswzIdp2j1UHW6+WNNEYQTXY36J8u/eIg55J:sxZM9c/fpswsBHb2FTXXJ4h
TLSH
T1FF32C8626E34697B8CC7D21DBA15BF53E6FA503251D01E54BAFCCA1C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 637KB
SHA256 21354f06464b71aff2d69fd68d2f14e79029b943a77586137b17ed12f19266e0
MD5 f9919c96ca35283407fce0848eb0d624
SHA1 4777e4903962759ea2fdecf16605bdd26d2a4c0f
SHA512 d1bb814492e528345f6d2b1c36f0547d96258f2b838c9c13836ecc7162e903146bce34f412e3cb91d04771625939ce45b51764924c191b1ed9d96df39d10f5c0
SSDEEP 12288:ZazwRbfghPhnakNVaHJE/omG4ZqeQZqTv6KN9uXttjVcAo1l8iHhdtWfTi+o:Za0Rj0h3p/ZG40Hqr6uu7xg8kWfT0
TLSH
T100D423F19C9F87671EB84BAA80579C445D0D4E5D1ADED0ED80B3A1C5093ABDECA3F802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cee211fd351f02616512b5c59e34a0d82af7b885c18fd5ffc5d20c8122179792
MD5 a5990215ed8458319185c582a30962cd
SHA1 82e28a49b00144cc0e43b887ae49d565b3e263ab
SHA512 b039fde8c02251813960ddb5c06d5bc7dcd313656afc4ec096cdf8d5c48e4c032e0ebb841765220b3f73e14f2945f422e342c86dd514d83910d23bc528cd25c3
TLSH
T14E717175F45888E9F7E8A47096E61CBBB23069B44E8B1F5271E4FB78018AB8E4C42007
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b1db08dd485d15af687f4914ce606353c90052eea4c6dea244d7fb703c35be0
MD5 4746a94fbf30b04d1a07b73accd5e85f
SHA1 b7657e82be25b10fcbbc782b44fc9db5f56db69f
SHA512 fa5da6948f28671a24169f72c1102c5beb63798fe94ec98a98fbeb81057f86af336166f933ca1cd3813a02912740bd03cc655f349b4c11c19103fd0dd56cee13
TLSH
T1C7616075F45888E9F7E8A47096D61DBBB1347A744D8B5F5270E4FB78018AB8E4C02007
MD5 SHA1 SHA512 TLSH

Submit Download

19cf6cc8-2409-4037-bd58-f86eb5f187d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\19cf6cc8-2409-4037-bd58-f86eb5f187d9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

485e3c63-1472-4934-a6b1-3ea995b9c760.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\485e3c63-1472-4934-a6b1-3ea995b9c760.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

9f5065a8-e99d-4fa8-981d-a425eaec1d91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f5065a8-e99d-4fa8-981d-a425eaec1d91.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7fcfb2ef9714f7ffb337f227f70b2edc23708ef4ffc4b8774fc2030cbab9f066
MD5 af18c7f6882022a241f9ddce7c3f070a
SHA1 70796a7887b39a9f7d609d715c2b8311d97aa5da
SHA512 4e834dca783970372445abf5e67306eb6c3184465d3cbb842001d43e96e9ab802bff37d9e2e7302d37108f8d7f71685dc6ed9169257b9bf21542af3d1801fd0e
SSDEEP 192:sxZMRQWc/fpsezIdpXWUHW6+WNN9V/Y36/M/eIgrJ:sxZM9c/fpsesnHbF/Xv9
TLSH
T11D22C8626E34697B4CC7D20DBA19BF53D6FA5032A1D41E58FAFC891C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a8bfd93b9a1b135c0ec38b71ea81d6a2d11a08a19b9eae6a2e6a118a6b45d65
MD5 ac42d634fabfdac698f3d455331fc26c
SHA1 b4b0be14b6462cb9f6a9bf226d1acaee31c2fc41
SHA512 b75e54a2a5815c9ad794fcac90eb3c1bf28f82c2d9ad7bd603e95b2534a1faf59e83b9b74f5c10dcefe79371c75d6024f58429697cfd7aaea8bf993682422ecd
SSDEEP 48:K0tMBdvbfAbzGTISVAK9V13AxFQYWXNNyLmBcAeEE9bI/wISY9K981+9xWtYXoss:KcmEKbKWu9yKmIZisK3qGd
TLSH
T14C91729131B706013B7E258842B9A65B564271F33028F57BBFBC50E29E2AE141DFF5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1b9d97d-ce4c-4d64-a7ec-31674a906847.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1b9d97d-ce4c-4d64-a7ec-31674a906847.tmp
Size 27KB
SHA256 01b786ca2713398aa3dcbf1e9e23fdbf1c3027fedff5b86adc68d501b3a560e7
MD5 b159ba8c73a94b21d513c4499736ae5c
SHA1 cc30a29aabfabb2ad37e9eed5ca358a3d8053805
SHA512 234eaecd95bb320ce2455158b4e6474e2aba7534a6c71c1f5ce5ebdc85592e136363834ff84ee8e880ab3b9f36f724d66613567ceb9655718101d41600277857
SSDEEP 768:4OKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/7ro8t:4OKlm7QWvUYe0u1ja8/L/E/I8t
TLSH
T186C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D404BFA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b22be4be-656e-4e4c-8777-2e930e1b08cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b22be4be-656e-4e4c-8777-2e930e1b08cd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c4625565-4dbc-4698-8aeb-d96769c5a755.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4625565-4dbc-4698-8aeb-d96769c5a755.tmp
Size 10KB
SHA256 82bb113c188be3e1d1ed621bc1ddd3e9fd2b10f297ae902bc5e88c07621ca4c0
MD5 9978061a5fd19e98889737a1b4a48c02
SHA1 bfc49099121b2ee4826ce38fa98db211fb45f247
SHA512 089ce78753599741b48fd610c38ea571ff4e310c6b33e6304afb419dafa56747098ccbc5b7679dda7b4bda7e940ae5fce24cfd264ac57c578b2586b5ec49c716
SSDEEP 192:sxZMRQWc/fpsCzIdp2j1UHW6+WNN9V/Y36/M/eIg5bJ:sxZM9c/fpsCsBHbF/Xvf
TLSH
T1F422C9626E34697B8CC7D21DBB19BF53D6FA503251D01E58BAFC891C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ace2824a-74ac-4d1a-9cf0-8812210c54e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ace2824a-74ac-4d1a-9cf0-8812210c54e3.tmp
Size 8KB
SHA256 6a2a89e6d4f68364e46ba2967238ecb3ebc1e76faeae89c0035b588ec4f07752
MD5 e0f3a08cccc76d85245d0f9d89f1419b
SHA1 6bcdc738c884a5d64029eeda6e8013730efb7688
SHA512 8e65e7a6bd9d4a91772072e243c85c5b547498ea93b1a5a56fd301be5c083538453048db39fcb954f4f0f97df311b6494bffe1d139fe014c5bdc36e90a284c22
SSDEEP 192:XONw6JUdQmiUyuvm1o//oT5Veql1NxGqHU6:XONw6+b1e1o//oT5VeEdbU6
TLSH
T10B120735B878EC7B5D939584F04336139EB44077EB856F90DADD2B2C06DA59C630BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef32d159-9f65-4640-84d9-9820df76c128.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef32d159-9f65-4640-84d9-9820df76c128.tmp
Size 18KB
SHA256 700006f977980e7dd462e5701858e3402fe79c0dfeb1c80234af8d1d35850208
MD5 d9912c55fa06f8d191d7036d37c30265
SHA1 13105682bc9ce3b2963e2aecc727a1b8b545f144
SHA512 7d718bb0920afcbb438b88b3a20442a9c46e74b5c2a6dcf0939b0e349b11f0dc4019f587f313231e39dccf2e8c97506e8fec69688cc098c9525971291a08fa3b
SSDEEP 384:VQkUSv0sNlxFZbnUVI2h//oT5VeE9bH7vBEvTIIl6:v0cGIG/AT/XbH75EvTLw
TLSH
T1FA827D767874AC7B4DA3D654F10A3653EE70906BD7C45F90D9CDAB2D02CA19C230BE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc8c0b3c-9745-4918-bac7-20b2944f35c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc8c0b3c-9745-4918-bac7-20b2944f35c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 095bc3d4a56ec549c136ecdd13879e79af22fc31e75cdf792c22c524ec22da1b
MD5 b6adc3b8a5d8ee01654e46807d8e7935
SHA1 74dcc3ec3228051dca93a238b428d0477d5028f4
SHA512 ca38a5d0b825e5f643365c703156cda16b9df45d62aa5b739f4624ba7ca7f362cbfd4a7baebe920b968df68388cc350c7844d8eddd5919c63a7841e43f8e3586
TLSH
T1A8411D98B7F91148B3B77F5AABF764AD487AB8773E06D55D00110E4E4623B44C8A2733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads