hxxps://is[.]gd/YvW4Wi

Analysis

max time kernel
148s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://is.gd/YvW4Wi
Sample261107-mae7raw16k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{75424BE1-1B74-438B-89C1-6EF13BD2331A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 976	1764	msedge.exe	84
PID 1764 wrote to memory of 3032	1764	msedge.exe	85
PID 1764 wrote to memory of 4900	1764	msedge.exe	86
PID 1764 wrote to memory of 4444	1764	msedge.exe	87
PID 1764 wrote to memory of 4900	1764	msedge.exe	86
PID 1764 wrote to memory of 4900	1764	msedge.exe	86
PID 1764 wrote to memory of 4444	1764	msedge.exe	87
PID 1764 wrote to memory of 2064	1764	msedge.exe	89
PID 1764 wrote to memory of 2064	1764	msedge.exe	89
PID 1764 wrote to memory of 2064	1764	msedge.exe	89
PID 1764 wrote to memory of 2632	1764	msedge.exe	90
PID 1764 wrote to memory of 2632	1764	msedge.exe	90
PID 1764 wrote to memory of 2632	1764	msedge.exe	90
PID 1764 wrote to memory of 1840	1764	msedge.exe	91
PID 1764 wrote to memory of 1840	1764	msedge.exe	91
PID 1764 wrote to memory of 1840	1764	msedge.exe	91
PID 1764 wrote to memory of 4608	1764	msedge.exe	92
PID 1764 wrote to memory of 4608	1764	msedge.exe	92
PID 1764 wrote to memory of 4608	1764	msedge.exe	92
PID 1764 wrote to memory of 3044	1764	msedge.exe	95
PID 1764 wrote to memory of 3044	1764	msedge.exe	95
PID 1764 wrote to memory of 3044	1764	msedge.exe	95
PID 1764 wrote to memory of 2308	1764	msedge.exe	98
PID 1764 wrote to memory of 5048	1764	msedge.exe	99
PID 1764 wrote to memory of 2308	1764	msedge.exe	98
PID 1764 wrote to memory of 5048	1764	msedge.exe	99
PID 1764 wrote to memory of 3616	1764	msedge.exe	102
PID 1764 wrote to memory of 2092	1764	msedge.exe	103
PID 1764 wrote to memory of 2092	1764	msedge.exe	103
PID 1764 wrote to memory of 1260	1764	msedge.exe	112
PID 1764 wrote to memory of 4668	1764	msedge.exe	113
PID 1764 wrote to memory of 4992	1764	msedge.exe	114
PID 1764 wrote to memory of 1884	1764	msedge.exe	115
PID 1764 wrote to memory of 1884	1764	msedge.exe	115
PID 1764 wrote to memory of 3540	1764	msedge.exe	116
PID 1764 wrote to memory of 3540	1764	msedge.exe	116
PID 1764 wrote to memory of 2572	1764	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://is.gd/YvW4Wi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa143cc188,0x7ffa143cc194,0x7ffa143cc1a0
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,6531905600236003333,15999112891035080999,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,4647637718413484974,10402903419055902178,262144 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,9701884443519954827,11502895009554635659,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17024769600357441576,10422105123559388060,2097152 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,7944126352370595895,5214327840161521176,2097152 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,15944949458572706442,5032809335471377736,2097152 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,1287292721241556204,747599559529310986,2097152 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,3376507518023774289,9096612179595985037,2097152 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,8216235508755411064,9971819379967784360,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,10113142180079315436,4231708450951420993,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16369645438487728386,16534049926267556321,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16369645438487728386,16534049926267556321,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,14239574025354432360,7970632083946180052,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,7258269305835901251,13595515736871828003,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,10852671730809184361,6866687705654999604,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,6916731389684071165,18177275123115006349,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,2574710532436946847,17373345320434415943,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,8168296557253329796,6669938370021326886,524288 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,18023422579395866475,10090781055615763741,262144 --field-trial-handle=2308,i,14464726985058924009,9932393872284353208,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c7b352d-e886-4775-b02b-1d208b31da3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c7b352d-e886-4775-b02b-1d208b31da3d.tmp
Size 18KB
SHA256 05f201d5b1db68bda56a96377ed4063eb2f2afd3bf923320e2369d966695cea5
MD5 aa5d449f0d087e76627eaff848954008
SHA1 eab89da594477b5fab13f646d190d2feb4ce9e7f
SHA512 3ef491f4e7109e26cbb24fcfa457176a04611b310a040b0bb718916c270aea461c7718d95141c471fe7ea16e50604265e98a00d07d4e39b92d28d5f2fd40b978
SSDEEP 384:GQkUSv0sN4kKGw25huS0hZEEOx2xcmaXAQfH7vBEngt6IIlk:m0uzV08EvpCAQfH75EK6La
TLSH
T142827D32E8746D3B99F6E740F18A3643DEA4911BD6C92B90E6DC6F1C01CE29C135BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c11567d-1daa-4798-bd1e-864ad3c770f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8c11567d-1daa-4798-bd1e-864ad3c770f1.tmp
Size 8KB
SHA256 1fdef2dac19026dbdc4d11d2169e13e15a5dc7c13078ce369f59e4b6d3a9a187
MD5 6696c8f5d174d87511851c1bace391b9
SHA1 7487cc874eb97a52670b9881adaa1524a8ccf337
SHA512 c9da815fb78c7de2ca8aa6d94cda33b493c17c0b89f0ead13049b55687c5e752a518adbaabced0cf08c351806c4ee9166e0bbbea5d61aea204936985e5b22412
SSDEEP 192:SONJ6xGZQmiUyC8sD0hZ/1OECjzoM2oRYcmaXMdr23UqlU6:SONJ6U3EsD0hZEEOx2xcmaXlfU6
TLSH
T11012FB36A478AC7B9DE2B644B4C735038EE45117EB89BF90D6EC2E1C01DF59C135A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a6eb5861393f83eb8b8016687c085da7ebeddb12e0086793cdaa97de2bf4d89
MD5 8f87b0f71fdb0e4babafb4d64f50918b
SHA1 ef9954a611e31dc1fc21cf5cdda9b032620389c3
SHA512 80b6b9a9ac529a7fa05c075fcb3af3a9438a9aa4a8462d2e9843ebf64816a6abb19f112e682567ce8c0abf07c734928796f290fd602cffbf3df31d92dc5eb530
TLSH
T1F5D02220B3038C80C8CCA0BC0F208B002E0EEC080022E2038AF000C0ACC2FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cbdecd303a7e9ea0ce94baa450d3b047a1edf586300e4947c57d88291910733
MD5 2d8c10d42a8ac6e8eb6e6d36c53591ab
SHA1 9cbb2af787af4f0174815753d1fb7231fae30ec8
SHA512 0365b2fb9fb7c3ddb4d312af474044b0160cbad1e022fa186751cfaa355015874edf8f80c8abdabc28d5fad2b69acf8c17686c8382dcb23c267475468464b67a
TLSH
T180D0222033038C80CCCCA0BC0F208B002E0EEC080022E3038AF000C08CC3FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

3d097135-260e-40d9-8f70-69717fcf6c1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d097135-260e-40d9-8f70-69717fcf6c1c.tmp
Size 10KB
SHA256 6fbb06f803579a33082caea641538b39ea21d01db1a00c20b0b6ea80275e2287
MD5 121a04f7653ba0579c24636dceb1a79d
SHA1 b08feacda86813f51d717ed6823e78af7dacb5dc
SHA512 01ec4b6b80ecf9137127bcd7ce448672be248403e813a86b1259aa12329a1b217b55e5b778f2acb08de3a5b4d77ccbdd527adeb0d0b8e1816048108a925dcc31
SSDEEP 192:sxZ3RRW3/fEs6ADLIdpLDHW6+WNQxn/Yr602fIgrJ:sxZ3G3/fEsFDUnHbW/p9
TLSH
T17522B813AE38A97BCCCBD209BA15BF13E6F9507291D41D98AAFC851C04E76DD224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41d03232-b29e-4081-83b9-8a419a88291a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41d03232-b29e-4081-83b9-8a419a88291a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c12ef7b-033b-4408-84f0-e221bddf671c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c12ef7b-033b-4408-84f0-e221bddf671c.tmp
Size 27KB
SHA256 5b9d27f647a9b333437bd815b267de29763ee5a859408ed7768f0f99cbe79d2b
MD5 7303751553ab811be7655ada56b4b13c
SHA1 48645ac54fa6fcb15cb12d0ead854dbd508705e1
SHA512 5f82b1a1e00bb4d92389403e6f45e4395751c9f1a6d1b713e3259c2194f77dea15172ea2c4cfa76b871c8dd4efd8b5468de46e8ae7b2ad57e0b64861f7d2857b
SSDEEP 768:WlqqHHlWvdD/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1nZroLN1cV:WlqqHHlWvdD/Tu1jaF4LYsnSE
TLSH
T128C2FA3B284CCA7E4FC01E9DDD5A6F973EA802C7A6688D4047F9994C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d4d1c4a-401d-4dc9-8e75-bbe5b08fde10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d4d1c4a-401d-4dc9-8e75-bbe5b08fde10.tmp
Size 10KB
SHA256 f8c711ad96a57c508a173052811739be7296b55ae1ea54569182e47db383df6e
MD5 71cfe8357bf9f4ebaa979e85340c8ff9
SHA1 6bf7342043361b364d84a809147857c67632af2a
SHA512 4ad6ad1362ca92c9e8573f7ad1a31ae7063e154074aa19fe51c82b7acbcacbae6d32ef41b60a4a682b90729b55409e0808e291cb5bda1099f1a2741ff56f5b9f
SSDEEP 192:sxZ3RRW3/fEsVADLIdpLDHW6+WNQxn/Yryk2fIg5eJ:sxZ3G3/fEsWDUnHbW/nU
TLSH
T10432B713AD38A97BDCCBD209BA15BF13E6F9407291941E98A6FC861C05EB6DD224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a6598bff4a9d9f4321b3cb264d91f6276a55864aa31bb3ee84e4e7a980879ae4
MD5 dd95eb25fecf18e9e0c8c94c291abf60
SHA1 389c83a0461e0928a6b3f06fd5d2f9129d3adecd
SHA512 969ec8ac23cba83b3f4028f666f27888abeeb8d04958f85a14079f2780ea7a2ad3c3854f07cfb7aa7929b1c90bb31b11d3c6e8a622b1bf9aa058799e6ce0e14c
TLSH
T15FE0209509CDC21D5185645701D4930CC2C1369B93C4BA0D2704CDCE72075447F85672
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 57faf4eee9e3f18ad408a902dd95612eccbc12e6ff967afb30e8fab2050f9686
MD5 455d8092f8ab771702089b9dec69074d
SHA1 8fcc5701424e0a7b8748a9358a2ec040894bfd33
SHA512 2aa9f4908da9cc26c8dd226b36e9679b3817e998f03173cd5a13de15b6e02f0ce14accf01666dd16d784c4a6e463e73fdbcd34dda4d60c909bae80d174774974
TLSH
T1D161E8B456529C8DC3B869708ED510FBBD3B998CBDE3EF1E08E8E97457323A0B188104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc120685bbf9b14c881d448c4264229a5c930ce9d59f04d6f77423463cf2e10e
MD5 908749be1475c73e6eb2098915e786b0
SHA1 b2ea13ee0df3ccc449e1afbe957def963d443d5a
SHA512 2e07556a7e5fe0ae4c4395a5db0d50b38ebda520faee9a58427d970c7f859b1f80e96990bda66f36546617bb016616a1795784a580643176b1732164e84794f4
TLSH
T15761D8B456529C8DC3B869708ED410FBBD3B998CBDE3DF5E18E8E97457323A47188204
MD5 SHA1 SHA512 TLSH

Submit Download

1e15f46c-c21c-4320-a380-da19adf8c34a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1e15f46c-c21c-4320-a380-da19adf8c34a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

90ee2076-b58a-437d-9a24-8630faa0ade8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\90ee2076-b58a-437d-9a24-8630faa0ade8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c79b18f2-9628-41cb-8f47-c3a768591512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c79b18f2-9628-41cb-8f47-c3a768591512.tmp
Size 2KB
SHA256 595908bf65442d471bf734d2cd4a7294e528f7b7f2d69419fc49d12447e42f6b
MD5 e6957e3b69d9abc44e1858c97c25925d
SHA1 6808adf8ddaea2a2c03e711127f18415eba87d3a
SHA512 d9e20d215f5be9b3c895c45b5c8883eeaf0c051aee771c7f3c46d35081781f6c72e36a46d65bff31d40ec3cf9881c6e3cc4bb12b58c40e3ba8cbaeecd5d7831d
TLSH
T1A141CEF783A189AEDE1156F0AA14AE1BDF5C0516435C3C1A89E4EF27D3F30B1E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

feb13ead-56cd-4d14-81dd-2a6aab9ed80f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\feb13ead-56cd-4d14-81dd-2a6aab9ed80f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 398e6814928e09cb673aea9c73a54405afb200589b6bd77e3988d1e829161b3c
MD5 522db780bd89a7581159afa580762bfc
SHA1 b6c392b720e190217985831541f3268e2d5135cc
SHA512 6522bd047499c6da38e4dd5ee22fc181fd426b9bebb14f87b475815a1f2a857871992808d0da8318c06307a5b23088de958fc027962f3337526dc352dc3187a6
TLSH
T137A002112A54A162C4004A74A56B4184361498110706239548A412649DA4188431202C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 aaf99b6f71cf649f440b27f8553aba8e6ea6ce52eb597e4154cf7334e82b8cd0
MD5 35addfc0cdb11ce83fed8f10db8c33ad
SHA1 c78805397b67f1b87dd0f32a5ca3f7ec9a5c04d0
SHA512 f2d6efacc6ff78372050d81337a758e77ed53abab4828d9ed7bf20a2c361a33f64ac24073e97bbf82020d48cf914f4b1d37ddf59832955bb59278b0a5a552841
MD5 SHA1 SHA512

Submit Download

f5856041-44f7-4e74-85c8-d8a5ad247701.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5856041-44f7-4e74-85c8-d8a5ad247701.tmp
Size 10KB
SHA256 21ef154f61b9676f4dafea4a4725a4f8e2e33df3d6e48644ee96c146ce96fb67
MD5 cb5b19eaafc7b8c0ba368f0ca0fd7486
SHA1 eaacba483a592e64d3ea19388f385cab7875646c
SHA512 119d2b6761267e1e76a3683099e2fbb48cf9532a03c0bf65f6862ff4ae83e4a6e22881fed0b166c8f607982571a186407860345e5f1154d6d7995e0aee1b6510
SSDEEP 192:sxZ3RRW3/fEsKADLIdpLDHW6+WNQxn/Yr602fIg5sJ:sxZ3G3/fEsVDUnHbW/pW
TLSH
T16A22A713AE38A97BCCCBD209BA15BF53E6F9507291941D98A6FC851C04EB6DD224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ebb605f-f479-4bea-bcd6-4ffd1376578f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5ebb605f-f479-4bea-bcd6-4ffd1376578f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c5337791-2430-48bc-8694-754cc8da848e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5337791-2430-48bc-8694-754cc8da848e.tmp
Size 26KB
SHA256 09ca104da2d2eea4f91b958706313b059af239133aca11ce230932f3518e67c8
MD5 940a01419698e2730d9357544599f120
SHA1 a1e9d195856a51b7b7034bfb132e5dcf8a720d1d
SHA512 980a1ce9c5a990b9c005d0eed769034811c3afc4a61005be0535cc29ce2de803f3fe18d318fa92049647edb2d10253a0fbc8bf30286f754e9407d83ee9d0500e
SSDEEP 384:FiFzQkUSvNzsNo8TUNTUlIlkKGw2BhuS0hZEEOx2xcmaXaMfH7vBEngt6IIlk:MFd15wg4DV08EvpCaMfH75EK6La
TLSH
T1ACC218F298D7893BD9AE9703A37D2D028EBCD117F5846650F788591CCC8A1BFD34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef98bce-c21a-4d48-8971-f6faec31567d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cef98bce-c21a-4d48-8971-f6faec31567d.tmp
Size 8KB
SHA256 4e311519235369e66a291af558c8b6b10647311a9cfdb82e7611b8224139855d
MD5 c4e6d7d3057605212400ceb83549ad93
SHA1 e835df965ae7e37680e7e58e16bbc5409812f0b7
SHA512 24aea2aa73089d5b0834a55777ac4eadacf170b94f091e45e22e84cf64365ba67e2deb7bb6266471f4c44c151021eea6b72fb0a0d24756e854627acd59d52ee5
SSDEEP 192:ZONX6xGuQmiUyp81D0hZ/1OECjzoM2oRYcRich4U6:ZONX6Uqd1D0hZEEOx2xcVqU6
TLSH
T1F302E835AC686C7B9EF2BE05B5872B174FD4212BE5956F80D6E81F1C00CB69C1356837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1a3927e-df06-4524-88bc-8ca018a971c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1a3927e-df06-4524-88bc-8ca018a971c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f9b2dec1-c944-45b7-9961-3b5f08828461.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9b2dec1-c944-45b7-9961-3b5f08828461.tmp
Size 18KB
SHA256 214e01d34f2a869d9eb7c091fc14627d5f214623fb8cbbc83023d7b5e1494fa7
MD5 ea8145859475a03b35092bec4bb09076
SHA1 84199a30ab485dfac2ea5fecb9f8dd5792c4fb77
SHA512 34065506ead39581492f9841d66ce423b906de07da93d22267810d327434590491e6c5c7294789680713d930572415bff12e24b1477369107339a534906264e0
SSDEEP 384:MQkUSv0sN4k/Gw25huS0hZEEOx2xcmaXAQfH7vBEngt6IIlk:M0DzV08EvpCAQfH75EK6La
TLSH
T15D827D32E8745D3B99F6A740F18A36438EB4911BD6C92B90E6DC6F1C01CE29C135BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ac3173bc8034e597e2f7435f7b1b845b6bda58d3c2cf484b2489a705a1e4074b
MD5 a07c34986e324dddc5ec2bd630236988
SHA1 000acc673c824c7e61213ee6d713f4636ac5663c
SHA512 57bcd00d5510eb7177ac7b6f14faae8fff6799c35c6c2fbf087e1a9e21c33089640dd25877ffaa31b8d182f5869109d67de5d727611f54d7b56d6762890b6424
TLSH
T162412748BAEA1149B3B76F4AAFF6746E487E79373E07D0AD00110E4E4662A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3616-287-0x0000018094A00000-0x0000018094B5B000-memory.dmp

Download

memory/3616-286-0x0000018094A00000-0x0000018094B5B000-memory.dmp

Download