hxxp://archive[.]today

Analysis

user interaction
yes
max time kernel
57s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://archive.today
Sample260116-d3jafadj81

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134130079316228290"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177663406-413462311-1670868024-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177663406-413462311-1670868024-1000\{DD498F3F-560C-4ABA-9FCE-62EBFA9FD4DF}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3712	1624	msedge.exe	83
PID 1624 wrote to memory of 4912	1624	msedge.exe	84
PID 1624 wrote to memory of 5972	1624	msedge.exe	85
PID 1624 wrote to memory of 5972	1624	msedge.exe	85
PID 1624 wrote to memory of 2804	1624	msedge.exe	86
PID 1624 wrote to memory of 2804	1624	msedge.exe	86
PID 1624 wrote to memory of 2804	1624	msedge.exe	86
PID 1624 wrote to memory of 6112	1624	msedge.exe	87
PID 1624 wrote to memory of 1548	1624	msedge.exe	88
PID 1624 wrote to memory of 6112	1624	msedge.exe	87
PID 1624 wrote to memory of 6112	1624	msedge.exe	87
PID 1624 wrote to memory of 1548	1624	msedge.exe	88
PID 1624 wrote to memory of 1548	1624	msedge.exe	88
PID 1624 wrote to memory of 4108	1624	msedge.exe	99
PID 1624 wrote to memory of 4108	1624	msedge.exe	99
PID 1624 wrote to memory of 3780	1624	msedge.exe	100
PID 1624 wrote to memory of 3780	1624	msedge.exe	100
PID 1624 wrote to memory of 320	1624	msedge.exe	102
PID 1624 wrote to memory of 3856	1624	msedge.exe	114
PID 1624 wrote to memory of 3856	1624	msedge.exe	114
PID 1624 wrote to memory of 3856	1624	msedge.exe	114
PID 1624 wrote to memory of 1852	1624	msedge.exe	115
PID 1624 wrote to memory of 1852	1624	msedge.exe	115
PID 1624 wrote to memory of 1852	1624	msedge.exe	115
PID 1624 wrote to memory of 3912	1624	msedge.exe	116
PID 1624 wrote to memory of 3912	1624	msedge.exe	116
PID 1624 wrote to memory of 5712	1624	msedge.exe	119
PID 1624 wrote to memory of 4680	1624	msedge.exe	120
PID 1624 wrote to memory of 3772	1624	msedge.exe	121
PID 1624 wrote to memory of 1444	1624	msedge.exe	122
PID 1624 wrote to memory of 1444	1624	msedge.exe	122
PID 1624 wrote to memory of 1444	1624	msedge.exe	122
PID 1624 wrote to memory of 1428	1624	msedge.exe	123
PID 1624 wrote to memory of 1428	1624	msedge.exe	123
PID 1624 wrote to memory of 1428	1624	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://archive.today
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffda4b1c188,0x7ffda4b1c194,0x7ffda4b1c1a0
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,9896854744150618515,1240952131815892828,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,6297839825152605406,5362291343300938887,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,11793085416316711234,8804672132333578669,262144 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,4833528353437729517,2727259580188002439,2097152 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,18053307594484120657,17134073577968618321,2097152 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3740343410407004401,4107684169888505372,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,3342784107673513412,13510728405271879479,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,9115132990065575326,8085615801165232798,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,9115132990065575326,8085615801165232798,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5728,i,5559756014609166432,3741005497384122506,2097152 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4884,i,9001632419165621534,847787904738506767,2097152 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,510502871525518772,15641920117507280108,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,810832243846156449,17359127131142695243,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14382603679090513510,15410923664505012237,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,16552337937268185660,7495685437021807754,524288 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5872,i,17223132889138560478,7547438600731078622,2097152 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6508,i,11824733823966663889,4349042767443055577,2097152 --field-trial-handle=2324,i,10505654622844957611,5379461652598959274,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 80afdd9e9ca30356a7d4014d9a9192d9e2d5d610434334ed62573d20c1ac0570
MD5 27bbcb6da1e60afcacf415693c0fa9ba
SHA1 138746a1e420eaf2bc91df7bf3d81f8059ecf492
SHA512 89d7c031c215a0ff1bec5af4f007abba67225b887753eab20141772bd96a4727d0d720d0b06b9b2ec120f9d560948774178117116466afb4fe8eb8947d99498a
TLSH
T1E5D0C05D531D1C2FC1CA243811495B1C31CFC42A80438B01607B5C040A011C024CA1C4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75a010b31787b9df7ff5a3520fde8550780d2d163d883665dc95653afe04307b
MD5 2a45f4fbb143ce089ee4c6f1a0c00a93
SHA1 d83cb466891b27c92610db46fc4e78063cb7860c
SHA512 835afa6be58f507215a772904ac9172f9e6dbcd59bed9602f51c2c591c8f78d591f40b8f5bb662516c7fd76dbb2aa04b32d1838aadd83cefbc6adba7c73966d8
TLSH
T11FD0C05953190C2FC1C6243811895B1C32CFC02A80438B0160BB5C140A411C028CA1C4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1b7e3952a2164d7cf2a95d4baecb268bb407ea239507c9b8c96739f565e76ead
MD5 b7b84636974acd8ab6b6d15b83a264b6
SHA1 6094e5d7ce9f59c46e0033e64891d16bd4bbc0ce
SHA512 7fd998ec5dfbb4fce53a8b81cfac36306db031670535c7e1029c38f7c15fa42a96fb7478cd7148665fcd8078208fddca19ae31a78c9b150475eeaaaa27817dd8
TLSH
T185F028AACD21FC3718FD0B2C60586B86E750135B2A80945F3A3C920C4FF463B858681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 356KB
SHA256 56b39064eeef3efbb00d9dcb7b2d01c361a274cb885d41ac90f4d0c1c769e9c9
MD5 765be9bad9f5cb1c26fbda2a0ab4c63d
SHA1 4a8d98432e248a46a81f36d11d7168d9476d5c8b
SHA512 2cedd09768fbacd7978e184773605c578af42edd6b424e592384a02709769a332f45bba50e859c2a96aa4000f933e8d5aa6c3afc7e4ff6331955f1903959e50a
SSDEEP 6144:Ux3iPYsDnAZBe4wWgI/kR0RoxvXgXZWIU7vOYWYSqOHDv6l1lcEyoZqg7:Udn71/qO+goIUKYS/HDy/Ry1Y
TLSH
T1757423EAE7A5343C7E582FBFA811274F7C56947136581EE750A8E0CDDE217823704AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6b6656be5a61d17dcbad3476a0b97a5524227ce9044c2a1a37992fdf8c8beabf
MD5 2f859a6347c127af076bd832d5947f82
SHA1 d6a88aa56d01e5f956e21c5b6b84f303b9fb057e
SHA512 1270f70e827423198c297d6ab835908f904c170106c17303865bf71f8108d8dd51e1f4d7c2b3344d199be31ffaab38ced09a9310426b92b5b637bf40aa97932a
TLSH
T1C161E7CFC08D5A37CB782979D5D2B03836B0749ED94B0E192DCE84F8934271A304D5AB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5895a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5895a4.TMP
Size 3KB
SHA256 c24278e2036ed1684b7687ff83ab2f071d8da0e907f9d79abb8097e3a4dc4399
MD5 e84d3079e35352a3fb673b57cbebbe8e
SHA1 7e5cca9bf4e36be2b938d835ccf01f657e96fa2b
SHA512 efecd6655c6e0298d1ee190fa188570a2ce9c67b31b51580c76c7a4192fb42af95c0db721be120f090b61aa6328d5d1eb1527f0e20f1146d6f315140baab4d2f
TLSH
T1B061D6DFC08D5A37CB782979D5D270383670745EC54B0E2A2DCE84F8578675A308C5AB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
TLSH
T196B35227D6A54C6B01F16264EC794382F325436F9282A82F3A7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 50c35d9d782057c0bec9093e1f9be9bbc62f307480cdca142281611929290d54
MD5 fde22b64b43a59bb824413b5a0e8b080
SHA1 d505fb022672519213163d5d4a2c3e8e1d93f7dd
SHA512 77d296b83a067cfa960b22098ad64dfa80c1ce1b50cd6ae8e62e9df0272ccb4f0663c4a643a25d62636bc14c3193b28abb34d9edfacdddb27f00a5fcfdf82654
SSDEEP 192:sxZZRyyMqZ/K1Ml8MuT/fQs/vd5FkgxCzk37c0f8kzodpdIH596+WNYJlXSNY5Le:sxZZfmT/fQs/l5Fkg9Lc0fgKHccX1exP
TLSH
T17E720A55AA386D778CDBD309F644BB53D6F90573D1804E48AAFC8A0C04E6BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a621fcf9bc873671f4d804bbfabf53f8c8d1b98705693480b2296ed19d7a2db7
MD5 1039c5e4557d7ee8a565f13766aab820
SHA1 72cb14eba14ebb9575e7a1dd0829b71fdbe825e4
SHA512 f0442e339278e80b3605d83cb6851baa731d253cbbef5ab97f0ef158a780ef993e3bd49d898b703744e246510935f4f15a9a58893910b7622370ba1b4bbe3d29
SSDEEP 192:sxZZRyyMqZ/K1Ml8M7T/fQsPvd5F0gxCzk37c0fmkzodpLH596+WNGY5LaYiIgjP:sxZZdjT/fQsPl5F0g9Lc0fCLHcGqmjP
TLSH
T1F062F9556A38697B8CCBD309FA457F93D6F95573D1805E08A9FCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8cac4cff84183d6f14c711638346c9062ad521d63d000655f7c67e5029a11eae
MD5 2ac4198fca913e6aa03d429e96e24348
SHA1 890ade6aece18f8adbc2b6992e90de5d64e437c2
SHA512 8a2be7ae95f562d722d13b7a52e93e358e6f76e9ee5e195a5115aa69a44c76df4ef85793a1db89787a34e21529fddb7002f913a0355182a437a13c41355ae569
SSDEEP 768:DcMWtJO7pLuLDVZWvVX+f8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfAMMLl+8NFSrop:DcMWtJOEDVZWvVX+fu1jauAMMLkcFJFj
TLSH
T188F20C3B6D0CCB7E4F804E9CDD267E8A7DE8018B5AD8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6bad7840ac6d9cffbd43bda4e66d4494302b2bdb37a9e3898e1388d89aafd30c
MD5 bbdfee297f1befc3ad82b0134b2c6941
SHA1 a9f421e61ccaf52362cafdaee0869801d6fee4ae
SHA512 455bcab384d570888bf184ee4cf68636bdd98bbe91084f3b2e733f53b118b27b09c66a06ebe8021ee70a4e0d54de98eb322074da76c9e0415ea8d5855f69b09f
SSDEEP 96:l/KyCGIK/FQKfYyxKAKGKhaarWHLVNN+Ldobr+KtBR+ZjrQBhmKpyKPK2woKH6ug:05MsK5Rzt/ath/9dmBotZTxfw3vAZdSV
TLSH
T13FB23850712E16C0387E299EB959901F874621A32070FD6B75F890A20E6BE3C5DFDEED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eefbafb13db1d0e5f2926c36dc6b58f080e30926d74c0cd1b71962db11632766
MD5 09e726be65032dfb8b11ba4590e945d5
SHA1 8487e2ba6504e7cc0fa7e4a2ed1e638dedcd919e
SHA512 eae1afe48f733c382a88b4162724a52da964a879bb76e75f7927593417f9f96dbbeda4f491b7100725ea8dd3b104a2f41f880f07058d67ed37b04baee59a46a3
SSDEEP 384:n6iFavqMg3sNB8TUNTUlIm2Z9rKFHTvfOYACg1S8df0yiZHy1ycxatk0vI+Rb:xFayv32wgvEyYAdf0RZHyX27b
TLSH
T1AAC24B35E8A8D9ABEDEB9FD9A7493643EFE001A7C58C4AC4D9C85D0D109719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1f8c0a782a219b8e72e17afa277ced900b293a809ab22ba6266da79462d963b4
MD5 a050b644bccabd8abd32366312e2fdf3
SHA1 840d96d482ced3727c0dd26b7dddb03707629aa5
SHA512 e0c57ef713bdca4bcb1f93cb05e51a111de8eba8e7e2495923d27ee3b32b2e14cf2db33b4d663032309af80df3f2c1bbcea729f583f295401af76de595cc7898
SSDEEP 384:n3iFavqMf3sNo8TUNTUlI4GZ9ZPbpTvfOYACg1S9frMOJcxatk0vI+Oo:yFayY3fwg1nQYJMO42Ao
TLSH
T181C23935E868DEABEDEB9FD6A70A3603EFE001A7858C4AD8D9D85D0D00971DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1d321784ff419e108e315acfca2ca8fcd6b80ed5cd163dd0259d44ba057139f1
MD5 a10d0a427bef9530e0a58ac280c771e9
SHA1 f5a73393ba805b0ffe6bb755f5444b5d0087e699
SHA512 084aed9a54eea7d0ab7c23c94addc2cb3d1cb9c202d0f692739be13030f6a3c39f30d5557cff766bacbedc4a2f977532228dacab064362afcce49ba306914ce2
SSDEEP 384:nJiFavqM63sNo8TUNTUlI4GZ9yPoy2TvfOYACg1S9frsOL6dK6urKQFcxatk0vIF:gFayh3fwg15yRYJsOIuri2I3
TLSH
T1D8D24A35E8A8DAABEDE69FCAE70A3603DEF011A7C98C4AD4D5D85D0D00871DE530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/320-182-0x0000015F542F0000-0x0000015F54439000-memory.dmp

Download

memory/320-173-0x0000015F542F0000-0x0000015F54439000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads