hxxp://192[.]3[.]73[.]173/24/secured_stub[.]ps1

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://192.3.73.173/24/secured_stub.ps1
Sample261102-j2gccaee62

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{4AB4077A-2ECD-42ED-A16D-7108F8A34A94}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4572	2876	msedge.exe	85
PID 2876 wrote to memory of 1888	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	87
PID 2876 wrote to memory of 4816	2876	msedge.exe	87
PID 2876 wrote to memory of 4816	2876	msedge.exe	87
PID 2876 wrote to memory of 3536	2876	msedge.exe	88
PID 2876 wrote to memory of 3536	2876	msedge.exe	88
PID 2876 wrote to memory of 2672	2876	msedge.exe	89
PID 2876 wrote to memory of 2672	2876	msedge.exe	89
PID 2876 wrote to memory of 2672	2876	msedge.exe	89
PID 2876 wrote to memory of 2452	2876	msedge.exe	90
PID 2876 wrote to memory of 2452	2876	msedge.exe	90
PID 2876 wrote to memory of 2452	2876	msedge.exe	90
PID 2876 wrote to memory of 4152	2876	msedge.exe	92
PID 2876 wrote to memory of 4932	2876	msedge.exe	93
PID 2876 wrote to memory of 4152	2876	msedge.exe	92
PID 2876 wrote to memory of 4152	2876	msedge.exe	92
PID 2876 wrote to memory of 4932	2876	msedge.exe	93
PID 2876 wrote to memory of 4932	2876	msedge.exe	93
PID 2876 wrote to memory of 4812	2876	msedge.exe	98
PID 2876 wrote to memory of 4812	2876	msedge.exe	98
PID 2876 wrote to memory of 1280	2876	msedge.exe	97
PID 2876 wrote to memory of 1280	2876	msedge.exe	97
PID 2876 wrote to memory of 4936	2876	msedge.exe	102
PID 2876 wrote to memory of 2864	2876	msedge.exe	109
PID 2876 wrote to memory of 4104	2876	msedge.exe	110
PID 2876 wrote to memory of 4292	2876	msedge.exe	111
PID 2876 wrote to memory of 2444	2876	msedge.exe	112
PID 2876 wrote to memory of 2444	2876	msedge.exe	112
PID 2876 wrote to memory of 1644	2876	msedge.exe	114
PID 2876 wrote to memory of 1644	2876	msedge.exe	114
PID 2876 wrote to memory of 4520	2876	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://192.3.73.173/24/secured_stub.ps1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd3c4dc188,0x7ffd3c4dc194,0x7ffd3c4dc1a0
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,9505416964289849952,1343412686949637700,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,18283002442220269969,5805910699002992247,262144 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,13805863697155752470,13677469875141804793,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,9071835072437920556,1598447701693502335,2097152 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,6190438743432988395,896770873888471554,2097152 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8653659926572210537,12805744346092479503,2097152 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,13554587876241618282,8449221782970091170,2097152 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,15323686329225004500,17118293403076096196,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6140429161831978749,9751113956928955528,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,2860094252155832810,16420803824125378630,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,2860094252155832810,16420803824125378630,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,17119933947946990625,13604526048299822865,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,10759814983210164926,8976353517098926975,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,4602447854988719831,8515452040849612723,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2960,i,1008654101191903616,3221883808518263765,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,15348180700414149127,1920578778037636211,524288 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,1016749654486034423,14956320709382384335,262144 --field-trial-handle=2212,i,2708911590436548595,17014432470586110319,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e101886-f485-4903-a825-cbe169bfb967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e101886-f485-4903-a825-cbe169bfb967.tmp
Size 18KB
SHA256 34e1de0bc4753b0c356063306a320d4bb2b2663acc2e5415ee5301683b7ee5aa
MD5 faf30e73294fccbcea6203ffd909cc81
SHA1 bcd7a3ce839d65a56a732d6a5b5e4649b084ec75
SHA512 db0f2907e1be7eee96145605a4e73c40bd53ac07a0da27881efcae4ac659031a9952aee89d2c8b8b008352be2afdb1dd51e888ed9360d11beac63ce3992cd60f
SSDEEP 384:3QkUSv0sNKiASZ7wZWSRuHX58EzO/ARwH7vBE/5IIlG:J0RG7wrSakO/KwH75ExLU
TLSH
T1A1827E71B869AE3B0AF3A605F14A3553DFB4902BD6C52F90D6DDAB1C00DA39C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

208e9804-5eef-4afd-b8d4-e314d0e0400a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\208e9804-5eef-4afd-b8d4-e314d0e0400a.tmp
Size 21KB
SHA256 2e5d138b505b2d38624e38114d7c1571f4465af7edbcdc4cdea4e74ae82cf4b6
MD5 4bdf1ab3ed4c1e73bde30462056bdf4a
SHA1 5bab876d4303376def4c69bc5217c782733de70a
SHA512 6405e3e2213b5a7982ac81dc202945ab31205679cfa62ba2caf114550a9fe403a93ade306e5f26063f5e0407da501543b4ca1bbd8fd71dafda81f0d53ec8c795
SSDEEP 384:OiFzQkUSv0zsNS8TUNTUlIlTASZ7wZW1RuHX58EzO/AYwH7vBE/5IIlG:lFdIPwgmG7wgSakO/RwH75ExLU
TLSH
T18BA26C32A899AE3F5EF79A00F24A3513DFB45067C595AB90E3CD9A1C009A2DC234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5efcdddf-bb2b-4a3c-b47e-8b8c5bfd810d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5efcdddf-bb2b-4a3c-b47e-8b8c5bfd810d.tmp
Size 18KB
SHA256 4259ec5e9a3b119d102a108fdb7c6caf7bc92479d7f6792b63f396cb0b442261
MD5 e539ddfb7dc9aeb6212cf7cd7b5cf26d
SHA1 f2f6974ffdbe9b04befae9363789dd6db4d4ac70
SHA512 a9ffea715ed6958a3caff73f06416c4d1ec3177b41056fd7265fb9a047193702cf66a10c643e604bce5a0f07242e02a828d5fa65e224b0a480c0915381d5b278
SSDEEP 384:KQkUSv0sNKTASZ7wZW1RuHX58EzO/ARwH7vBE/5IIlG:y0WG7wgSakO/KwH75ExLU
TLSH
T1A4827E71B869AE2B0AF3A605F14A3553DFB4901BD6C52F90D6DDAB1C00DE39C234BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f49672a-2364-4ce9-a24f-e69bf3d4b5d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f49672a-2364-4ce9-a24f-e69bf3d4b5d4.tmp
Size 8KB
SHA256 4d8bbb7da184ca7aab3959d12984c127ecc4f9319885e9f54f3816677c9b2d30
MD5 bf441b0673c0cbb022e7f043604b0fc8
SHA1 b44abd3a3b8dd00e67194c0ace7597d2457ea6a7
SHA512 c46b32ceaa7a0a0b66d07ea12387b2724f45486ccc69da026427ac5684c28e232a20a0019de8863061435b3206b976517be49e3c3e0323fe134b0f36f2cdf6c3
SSDEEP 192:EONT6wlDdQmiUyLc84X58gZrvOKGPaNQveAqiU6:EONT6kbp84X58EzO/ArwU6
TLSH
T189120835B9A8BC2B5EE2A544F48731139FA5512BEB467F90C2EC2A1C01EF36C134B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9d215ad-5944-4e27-b8ea-1c268b71503a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e9d215ad-5944-4e27-b8ea-1c268b71503a.tmp
Size 105KB
SHA256 1d62e22dec5c299be491cb2f809a917a5b2650bcf6f26d1655b204a91c995427
MD5 a1423f7d471bb13fff5ecfcdaea6454c
SHA1 7ded49e29e2ee4ecada313702dc82cddf87e8600
SHA512 6e90c834830dc60cf4e69d47a842a672355eeac4f32e8a0122d66df5ce75da4ac71274dc3cb208dbb06f3cd4f506485158442b7832ede2cf24ef8c5b26c1705b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T119B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

0360656e-f973-400a-80c7-59127a8da580.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0360656e-f973-400a-80c7-59127a8da580.tmp
Size 10KB
SHA256 0d0e9bc070ba32cc34e2e7ac47ade6eeb08779082e319d3d0fc5d428f52be845
MD5 adcb2b80362f1780b279c61bfc946fa6
SHA1 5bfbbc514df58ac62c3ea95abed6a0b6075c98c2
SHA512 5ac75b3bca2b2bddb06311c20b4c9b8d5ac6dca5fef2040cf4b41b9fbad07ffd4e40c5670fa2b58e6165a8d53f63923be4a73cad8cdc09201815ba7807275a29
SSDEEP 192:sxZsRdWc/fYsOeIdpQ4HCI6+WN4mG/YrDvRkIgrJ:sxZsac/fYsOPhHws/x9
TLSH
T1F222A8516E28AD7B8CC7D219BB19BF63E6F9503251D41E88AAFC851C04E77DD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46afceda-76f5-416b-935e-606beceec73c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46afceda-76f5-416b-935e-606beceec73c.tmp
Size 10KB
SHA256 54b8c28cdf02e6adaf638a2499cb97a7b7ab68a455b27e7ae132fb17a8ec39c4
MD5 b31e7cd4af81c74cb15dda3143a36b8e
SHA1 dcd2e1c96b19cc63a386788ae0f6739c64069e60
SHA512 039a213ae7fba05869bfe25fa44889360506256324ebf627b61533ae1f7ac285cf84dd4464fd82f3386c0f89c9532fad1d0076eaccdebd2d958203a9573ca775
SSDEEP 192:sxZsRdWc/fYsLeIdpi4HCI6+WN4mG/YrR2K5kIg5UJ:sxZsac/fYsLP/Hws/1e
TLSH
T15332B8526D39AD7B9CC7D21DBB15BF63E6F9503251901E88AAFC861C04E7BCD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bf79ec8-c80d-4351-9a2c-251dce35e068.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bf79ec8-c80d-4351-9a2c-251dce35e068.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6c573ce5-7eaf-44df-a0c3-2cb28bfebf61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c573ce5-7eaf-44df-a0c3-2cb28bfebf61.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3b1dff557f5803ffe9483e05f79c3dc3e07b44c7c36753764d7f2a6058f5f926
MD5 4c61f406bc1b91d1624b2cc1c76dc877
SHA1 0c743323b9c7dcfc0ec9ebe2df0a2ae7b8b6eeaa
SHA512 8e4ed29976fcfe88aeb9f8f3960d5ff98add2b9caba1b1f0ca92f62afe329d9aa8511fe10bc0ed2699bcdc7323c6fbd5a9e79a22efab230c9f0c1c8b8dd820f6
TLSH
T102E086FA09CDC26EB208664B41EE474CC2D4B63BE7C4A94E6B48C8887642544A697AE0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 920e03bd0130912079380dd0b550609480e33670806c24303a2026cbe481535b
MD5 d52de33a8854db98f2107e037d167c0c
SHA1 64d1eea6707c0428fc06becea66b7ee7317ef3f1
SHA512 670f239aacc6293b361232d35734149e3f8648a8f4f0b98dc102abb6cc9d51cd26dfc84d29d0d2919df4840a14bd2e9d01692d6b0f5216e7657ace0b8bfae7e2
TLSH
T11441FC87E7F5B055DFAB473149D114B7353898B2ED43ED12D4B8C0B97B4EB069104263
MD5 SHA1 SHA512 TLSH

Submit Download

de40040b-94e7-47b0-8d2c-a57009e20eba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\de40040b-94e7-47b0-8d2c-a57009e20eba.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

b18e9d73-e428-48c0-871d-1d97dc3f23c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b18e9d73-e428-48c0-871d-1d97dc3f23c8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

deab4aad-bae9-4c46-99b7-2546e7cd0d1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\deab4aad-bae9-4c46-99b7-2546e7cd0d1a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f73d52ed-8228-4cbc-b9c5-60f30680abae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f73d52ed-8228-4cbc-b9c5-60f30680abae.tmp
Size 1KB
SHA256 bade36849c5995a33865f7247d4b6f84b55768cf758c40a055d2ed25f7ce2ad4
MD5 d7be311f2066a78da9276a09f420cb47
SHA1 121a417c6833d9d6d80f6bd0c94312e816fa79d6
SHA512 95c4fdd523de74ccf91386ab34f2f04d5a82c677b6ae5167bac8d62e1eba8340bf12a536204f9629f5e3c347c03d0a450434f754738e5baab849619e0d9b909f
TLSH
T13121ADF3C3D586AED91516F06A24AE2BDE2D060682187C19C9D4EF6B93F3035E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f641422bf88ca018b335619d1f466fba3dd2c2c4125a82fddcf2cdf44e481479
MD5 1c7f3e3cfe9795406697872ab9824187
SHA1 290d7584ba9cce9b891d85f2c061f417e198abfe
SHA512 669d630ce2a9622f0fb4b77804bd03a8eee72ad49910e6e3e58d715545ac8f18916aa2d021e6a4d3af074036deaae5aaa132ff0d1f6867a8c61628a891953c54
SSDEEP 96:KIDCKs0+aCYKjilmBA9xvDnk3DePdJkKlBdHk5Rx+vzR6KaM6qEQKxyC:E53smBA9xvDn6DelJFBdHKRx+v21vR
TLSH
T17AE1E15135BB020038BD769881B5872A52433677301AEA3BBFFC44A68E6BE445DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a669b9d3-f7c1-4331-b836-48e72d12a343.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a669b9d3-f7c1-4331-b836-48e72d12a343.tmp
Size 10KB
SHA256 635ef14246599db4f0b8cb71c1fb4eef22488f15ebe55aec598493750a9a258b
MD5 5f80430215423992d24baf344ff5ba41
SHA1 81be6d3cae9ffed9990519148a15d6f8b25d172e
SHA512 56e4a37b3749917b8f7dbd5d49b0cd1e0e410e8cd967555b16526712fb55df4fcc13e54d46ba19b355314ae91ac2136df26b5d786fbfeb4e71e3505a706cf2d2
SSDEEP 192:sxZsRdWc/fYsLeIdpQ4HCI6+WN4mG/Yr6lRkIg5UJ:sxZsac/fYsLPhHws/Ue
TLSH
T1D122C8526D29AD7B8CC7D209BB15BF63E6F9503251D41E84AAFC861C04F7BCD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a77b8d72-69ce-409b-acbe-25e33c7fcb4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a77b8d72-69ce-409b-acbe-25e33c7fcb4b.tmp
Size 27KB
SHA256 f795ca8fede84f7c15413ea27bb85bb9b81107a4fb68be82071d3e8ae7b0e468
MD5 beac19cd81dd4e3e14349c2d6185ffd8
SHA1 b178cdd478ea03fc0ab651424b597cec7205d535
SHA512 7062f1cbc8cf1b7df230034326fc117d546f0ac5c074588465c6f3a8f2986e7c9dad40d4432821b0de6d36210f70670f7ae824c6f2ac83bca8ccca784b6b86ef
SSDEEP 768:c9y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb/roRTR:c9y4J/DWvbtBhu1jajiLm0bsRR
TLSH
T19AC20A3B680CCB7E4FC00A9DDD5E6F9B3E9802C796948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efb363bb-643b-4e3a-a2bf-b3f185caaf7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\efb363bb-643b-4e3a-a2bf-b3f185caaf7d.tmp
Size 10KB
SHA256 92cc6eb27c473efa357cebbd3ea156f9eb9e3f66aabe2fce501ee83c7c61246d
MD5 2d41a5c102b7d7cfd1d5877e04bd365f
SHA1 0bc268d857979e7998a3b841f0f3724f3ea098f9
SHA512 1d4028337ad8457e5c1b6537d3e211814a3383aad2aaefba8662310678a1c394d923a555fa32a50ae84b6c014d34504606999a7a1cab4c8ad0f64583d3aeb468
SSDEEP 192:sxZsRdWc/fYsceIdpQ4HCI6+WN4mG/YrDvRkIg5+J:sxZsac/fYscPhHws/x0
TLSH
T15222A8516E38AD7B8CC7D219BB19BF63E6F9503251D41E84AAFC861C04E67CD220791F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65cf588d-95a4-47be-8b2f-52ccb182ae53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65cf588d-95a4-47be-8b2f-52ccb182ae53.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e91c60e0-fc0b-4c22-8cd6-6db11f06a1af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e91c60e0-fc0b-4c22-8cd6-6db11f06a1af.tmp
Size 8KB
SHA256 dee016d5f9e23dbd80ac1b810eafb4b1228347beb22aebf55d4bb749ffe707b5
MD5 53e4610add8b84fd04f07728e1ea88db
SHA1 7d02f3dc34f2264c9bc2319cf54e0c1b68aa9c3c
SHA512 3456dce032b6a0dac903ec2d657da94f1cf005cdcc24a84a524a39dca1313c069f4ea2a1265904a5d75eb9fe648f5e3b8c933d1877dde2f245e07d8eeb2cabaa
SSDEEP 192:1ON36wlDgQmiUyUcW4X58gZrvOKG/Dl4vU6:1ON36kgkW4X58EzO5uU6
TLSH
T19E02E934B9697C7B8EF3AE09F58736139FA4202BE6556F44CAE81A1D00D739C2347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6abe90a3-0b35-4e44-9316-85f003d5d461.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6abe90a3-0b35-4e44-9316-85f003d5d461.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd73d43ea17ba5513570c19e9e6fc6b732036349f94984789ca29520ee9573ef
MD5 0d73c9fd0e3889ae0ac657e68132f6cf
SHA1 d3d7d2df694192b2c810637528f2e7195174b384
SHA512 fc985192f136b76b3a51c3c7146843a1ae3967ece73f219df46c00ffee1feb5542d4b1a709db50343efb5080745542fef3a2e328e008cdac7ca4882879acef0b
TLSH
T10A410958A6FE1148B3B76E1AABF7A47D487EB8672F06D46D10110E4F4A22B04CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download