896608e54883504d4d0033e3f7c264004d21ce803498ab209c66970d4005894e

Resubmissions

18/04/2025, 21:39

250418-1h4f7swsaz 4

18/04/2025, 21:31

250418-1c8tqsynv2 10

Analysis

max time kernel
20s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Murder Myster 2 Hub.html
Size

12KB
MD5

7e8785b112a2ce7261eff35b26ac0e92
SHA1

b570b0ebe790f82aeb6127e891b0e7657d49db77
SHA256

896608e54883504d4d0033e3f7c264004d21ce803498ab209c66970d4005894e
SHA512

e2935257e3c2fb75bf5ff799e5721a60febcd921684d905c1a8e5c0c8f60a0d8db4c3a7045608cf022408bb67b7683bc2420bd4eb4fc92d254a6b4420608b687
SSDEEP

384:OpRilUshGGzUeUIOUeUmSEi/Li01UOUTVxWApJWDWigqWia03StSimSiYSi/43R5:OpRilUOGCfvOflS5/u01/8xWApJingq1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894860073355090"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-83325578-304917428-1200496059-1000\{A63CE54F-0C68-4DD5-AD6A-411438C122C2}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2696	2612	msedge.exe	85
PID 2612 wrote to memory of 2696	2612	msedge.exe	85
PID 2612 wrote to memory of 2304	2612	msedge.exe	86
PID 2612 wrote to memory of 2304	2612	msedge.exe	86
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 3780	2612	msedge.exe	87
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88
PID 2612 wrote to memory of 1116	2612	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Murder Myster 2 Hub.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2cc,0x2ec,0x7fff793bf208,0x7fff793bf214,0x7fff793bf220
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1968,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4236,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4252,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5140,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5068,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3556,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3556,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6120,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6668,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6676,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6968,i,12317452188642458135,13098844789155239150,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
6e82345aefe362b4c5071e7df6c07407

SHA1
44176a6b5c2722280699b8cc9a174d168fd4c161

SHA256
ee1ec48b6b166582c51a4141a84f48731ce18a62e4b7faeb9d60560c8f9c382a

SHA512
20c0f5862226a3eb17832e7c793f809f2333e0e0068dbe61b5865517fdd9f84bb5ca8d97bdb19a005a25b789ac75a09067350940f042fb5123cdb682ce2c98d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
caba3b97f983eb81b0720471256478c8

SHA1
339f3ecc344478074922a419c72f2d5ae5057596

SHA256
ee9a4e8df1a64f019f80b1d75be15fd30693816fcaab4c7425230e96b6badba3

SHA512
2509f6b967fd54eb3dce44408b7e0b5c32c2900a68082f573aa8382def609314022cdb0759ce9cbd88f6a7c2b83b3026f464388f3848fed913cae30d7f2b730f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
36f9fd1ea77d2f590556c7d635edd948

SHA1
77be267292d38d47ce859e8924a6730130f7f2da

SHA256
3e876f232d2a766cc7244538ab5fc61da25853942ffe237bbee3077f0cbb435c

SHA512
5c222b04d880e65af08e3ca8e8695af07d0c29ef5cf70c74fa0d81baf12f7dd7ad11073cff8651767e4743f40bc3fa93df6198bd3cbdcbcf38ba1ecbedea5a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
34KB

MD5
04b4cc5e83e4b5c37284c177c7318c04

SHA1
8d141ed4a722185295059b98eef7dde112268ac2

SHA256
540ece2d4241326c93055dae883ec9c4d360cf56d24b62d3c3db31beafbe538b

SHA512
3f5d9a859a86911107152cc6a86a7e263189f84f788323a20cb7a65346b34c28732da3ba9c2d69ea13ebcc7cde67d0ca2f1be6535c332251cd3626b1c355e169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
100KB

MD5
f989b3df1da7e8451d64c0ffe01afd82

SHA1
6d40a628150a04b2ac77118d21aa0d9c390f9d8d

SHA256
b3dd5fa06cb6876e60aa8ca688701fb3d3632058904efeb7fc68ce8fe160aefe

SHA512
544d93570f305f9badc0ced4b257de50223769c779094e7d279d1270d8e409224a02eca6d2a887cad337371e43928cefaee10cb5c34bf43c6d1131364360a7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
359KB

MD5
c659e7367ef7d6e3a7a8f1af3f081719

SHA1
24966f989863581ec11c5901903fcca55a22d86f

SHA256
6891eedd9f963af4db8d2cef70190fc8b8519ba40c67cafc67cd2bdf663575f2

SHA512
f42afe479be984ba441e1f06ce3fd17720daaf1384a2e270d7120bc8bc36bf33688cfc463429b0aba0ba5d5c18ad9cc08bb23cb1a77348e6ba3d5cffa8bbcb7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
8a75062021727c26c37ffdb066946680

SHA1
00f6febd898ae740442db1de3cde5d207fbef2c5

SHA256
f7d75d869f928e6a1af930f67c53b8aceb478d70bfcd8b7e4c3f17d6adabc919

SHA512
aa95dc0b3f375678f6d54bbf5c3eafaa5d4af5266d54ae2fe57db1e1449a60a7763654254f9fe4ac19fe7b0b676f2816fe9319b6bb3d1f3d2cbdc082d59c98e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
2f5a368a9dab9337943a13ac8c34cd7f

SHA1
5c03d2e28bae037fe332f44575fa6b34a2ef591d

SHA256
ee7290829018e912280d250820accdc4115c4a7c1fca61beb29b3530e4ff40a5

SHA512
f663f05ab62e1d5ea86818fbee0073460cbbb25f0e5b6aa4931c282de8a6b45f93a4424053f0e4f93a72b9fa45324d14752c02a8d0ed46e93442efc66d7b90ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
5d33b4bf3ed5939617a06d62ad90314f

SHA1
b30ffde227498e30af6f6a0f74a585157ffdadbd

SHA256
9805846586ad92fa00b421f979fb46d1d4a3ba6a0567bfc31c1388d8a6c66d54

SHA512
6496c93295624c0f40abddaad9134087bafdefc2f59d14c60b17faa731d162398f81fec2e3e6347a2356e6a5689070c9819e261fd42aeb4a6c94b72d96eeefe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6a380d4-5862-40a9-a645-ceea7f421bc5\index-dir\the-real-index

Filesize
1KB

MD5
121a3d7d931df0402f103535e723264e

SHA1
09df7da057fc51f0a83300520b2e32424f6bece7

SHA256
3f523a12a12ebcbdcb50665116c1acf598ee9eb3d1c539778c16cc5e9620766d

SHA512
ad0dede348db4f3131784e59029bbc9cf4485634b285a58c5c734edd6b856a181203fe4a9cc34eebeb97151662a0a0d11d352944306add5aa4836431caed565a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6a380d4-5862-40a9-a645-ceea7f421bc5\index-dir\the-real-index~RFe578184.TMP

Filesize
1KB

MD5
d71c5e81b3faf9d8fd5b8eb29a52b5b8

SHA1
ecf109573e2cd025b62f3d8da506a3a2a43d1b60

SHA256
58918316303ce6afec642f2dac5e88f416b677e070eb51a64e170a0ef7f0c82e

SHA512
6c08466137b63569f87fb595559607068083a16a9042b3f170a6d1f91a8b062ad739af9db85c12b43ab9fe4cd51f9d65a403d07ba7f2371737cba0e1167f55b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
e95c0a3ecdc7ca2441555b7d2a90a6b6

SHA1
57dde7791436f423d9f264c9c6cfb4871167f9bd

SHA256
39c75777e99984c503bba916449eb5cd7c18f4c3a6e87aa836e978a7b7db59d8

SHA512
f012efba1e93762e50a2c6088455bac9f817356f19c0957037124f97f30db7baceda562e969a8617b25beb36caa44fd5667c9ebe4a3d02799c06f4db44d49045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
a43fa22cea077911ed844bd2465f2b9a

SHA1
1d7fbf5bc8de970b28ecf78134f4b1d323574a23

SHA256
c69d92b7b59ea9425977a8a1f47e2f21d87d3a18495e72f490ec7f88db405709

SHA512
ece2257d4bdae78caa5c44c53e37449c03c4b396a29de09c6c988ab8b0f6b6f6ac30f58be7a1569dea2b43f3cda75a2a0f2acc2bc192e399b7cdc4bcefdac2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
37acada5710e591d29d342a6b1abef21

SHA1
8012cf55f2e6ab47f8593796c3123d04c37fafda

SHA256
2c35e8fb6fa1aaecc3f672a2c305d8547fc7e75ae8911c338abaafce6a050683

SHA512
0be62fbc716fb94e04352138a4bcbb226dc69ce3397352904bf2f6ddeeac850e2a844922af067505f87bb4fb8b93f9c4596dfd46509c6a30114e62326f11ae5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
b21d6d87d4bcbb9ae497b7f217cc206b

SHA1
532964953f3063a90fa7322926d3364e988bcbc7

SHA256
ae0af770f3f2077731bd8cb7f57251c4d5c1e17eca8fd711119fd4d335cb1dc9

SHA512
9555f074b338df7569edffadab805c5ae805fbf123b66d4db24fa6113e15d117b82c4bf6550fe1c87abb592e4bca160a12dfe4c085d9d1534c062a32fe72dc7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
925ddb7bd27fd0846a893fe8c2506f08

SHA1
dc5e82c6e7b4b834a4d1deb8cd78216d8fca117e

SHA256
321708735b410f996081e3be277302d7660d6fdbdfa06bfa334deea85bcf9756

SHA512
6b35f336990be753e99fff32160118c2fba93763c197e305715599cd097de73a9a67e60803689aa116e42327066b016081f2733521f9cd263a815f4eb4f35843

Download Submit
C:\Users\Admin\AppData\Local\Temp\10a5aa68-fdd9-416a-9fc0-e2607776daa5.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\9728ae10-a606-4459-b981-33f12a505d27.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2612_1659061251\4363c1b4-058d-4dcb-a7f8-80e6b3149784.tmp

Filesize
153KB

MD5
b0917d8e6c5b6be358bff67f84eb8336

SHA1
a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

SHA256
dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

SHA512
cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads