hxxp://36[.]92[.]154[.]210[:]31395/Mozi[.]m

Analysis

max time kernel
88s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://36.92.154.210:31395/Mozi.m
Sample260418-mnnfaac12x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209822346983522"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{B7CA3164-E10F-4805-83EA-69EB5060229C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4368	4464	msedge.exe	83
PID 4464 wrote to memory of 3708	4464	msedge.exe	84
PID 4464 wrote to memory of 4400	4464	msedge.exe	85
PID 4464 wrote to memory of 4400	4464	msedge.exe	85
PID 4464 wrote to memory of 4400	4464	msedge.exe	85
PID 4464 wrote to memory of 4660	4464	msedge.exe	86
PID 4464 wrote to memory of 4660	4464	msedge.exe	86
PID 4464 wrote to memory of 2612	4464	msedge.exe	87
PID 4464 wrote to memory of 2612	4464	msedge.exe	87
PID 4464 wrote to memory of 2612	4464	msedge.exe	87
PID 4464 wrote to memory of 2660	4464	msedge.exe	88
PID 4464 wrote to memory of 2660	4464	msedge.exe	88
PID 4464 wrote to memory of 2660	4464	msedge.exe	88
PID 4464 wrote to memory of 1480	4464	msedge.exe	92
PID 4464 wrote to memory of 1480	4464	msedge.exe	92
PID 4464 wrote to memory of 2724	4464	msedge.exe	93
PID 4464 wrote to memory of 2724	4464	msedge.exe	93
PID 4464 wrote to memory of 3888	4464	msedge.exe	94
PID 4464 wrote to memory of 672	4464	msedge.exe	95
PID 4464 wrote to memory of 3888	4464	msedge.exe	94
PID 4464 wrote to memory of 672	4464	msedge.exe	95
PID 4464 wrote to memory of 672	4464	msedge.exe	95
PID 4464 wrote to memory of 5744	4464	msedge.exe	96
PID 4464 wrote to memory of 4788	4464	msedge.exe	98
PID 4464 wrote to memory of 5184	4464	msedge.exe	105
PID 4464 wrote to memory of 3884	4464	msedge.exe	106
PID 4464 wrote to memory of 6140	4464	msedge.exe	107
PID 4464 wrote to memory of 3732	4464	msedge.exe	108
PID 4464 wrote to memory of 3732	4464	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://36.92.154.210:31395/Mozi.m
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb5b0fc188,0x7ffb5b0fc194,0x7ffb5b0fc1a0
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,14545708407950944303,3852586617270756892,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,12657867480619878838,2175611826829572848,262144 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,10920552802129243518,14586167383618879834,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9502799296392056890,5055160796222111414,2097152 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,2228072882796126960,353142275587431767,2097152 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,328745322935008138,6850656535909357397,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,5821062830569715489,17124770608465902127,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,1986073122171633522,16548615566451656231,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5456,i,7620482644882592598,1121804707535328141,2097152 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5015712832313282095,3354658431886906139,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7494277899169148801,8218003729757180879,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7494277899169148801,8218003729757180879,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,5630936472556681905,9225152600241669588,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,7030528545489067761,15248269348894448409,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,7946058460433983771,16180866105906476230,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,9810452541553539363,7755085916250909141,524288 --field-trial-handle=2268,i,4822155712553064543,8452452364673089101,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5fc213a99707e047904425dca18e0a7e32c8a14321bec6b4f6e4dc0adf0d61ef
MD5 02b584790eac40739dfad5b087fe5317
SHA1 9870684ebba1e7b2483974eb253c243cb200b64a
SHA512 8bcbc72344d9e41b1f08f9d40267a5429be5d2eddd0a7afb479e9051fc522ded8326eb77a6838e7539fa4d1d95d9e7a05d6d003a814b5e62b318e14529b32c5b
TLSH
T180E02BAEC821DC2B04FD071964528747EB59135B6B50884F7B3ED2488FB07374656C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7228c95dd4f364a708d598c2c557c5d72a5606b52080c0a4e4deff6589f5d6c3
MD5 eadebc0655f7c3b85ea0974cb632a820
SHA1 2c45577e075b5ea2dcf7801c1fb3552f0fb46b9e
SHA512 f13a16bfc1a4228c75fdd994375c3fad2c4c4cebab0ac2b782e4440dc59c831d22877019d6e8387d0e02a609a7ab211f66008c928ac2f17cbbadde05713e46d2
TLSH
T17F41CCF383E4856E8A0196F0AB186E2BCE1D0550436C7D5A89E4AF1B93E2860E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d3109736743fcbae35a828ba0d6eb24df79466c108abc12624b7b6a68f9be02d
MD5 b24a2c30c900d8e43e4db14f21c76366
SHA1 1aa294c906da5d568fc930adbcc6b1f235121519
SHA512 d63231c136d665af5315d3f093812eda9f04068756e5e7411cf30a8e040a73402ff97cf37e8ee00de293278d71e82f5e61ef121b1caea5684b9d538195a55a1b
SSDEEP 192:sxZQRzyMqZ/K1Ml8M98/fWsFCp7TvOzodpLHW6+WNGYKbsJNOV0IgjYJ:sxZQI18/fWsFqfvVLHbGCNOKj8
TLSH
T13662F9156A38997BCCDBD209FA457F53D6F9152392904E44AAFCCB0C04E6ADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 86917f94d12ba9e265c2b4437fed533e85fe356aca9a2ec130bc4e40be277e1f
MD5 d1564df87fa5c1df984a2cb57ce8bcf5
SHA1 c556affd80c06f54be1d04d5fd98e30389238795
SHA512 a3728833d9d8f40408968f0e2c89e409ae77f6b353434c7e4e105956053aa3d62dbd8e4ef31a54d0a94e278b2b5a10829d01a0339f4b518b65bee4fd874e27d4
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuEx4Llhf51Yrod:AasqZl+E/BlWvBDeTu1jaTEx4LXB1jAc
TLSH
T1C4F2FA3B6C0CCB7E4F804E9CDC2A7E8A6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b0a6efd0d8e6d4f6840a7ab73bbf52f97b25c40f03751187338c52a0728ef825
MD5 82f472a09ea82d02a9d86680ae83437a
SHA1 0427f2957587e5af5751107ada5c930d78f66d82
SHA512 f6a4b5057ed542ea2c6c1e7089065c9be744aa531889cdfda523790e85ad693728cdb43a227d1c11df9d6877de5f7b92cd8b57c967b80754a1f4ab28fc45a45a
SSDEEP 768:+BOVglYXrbtZqRvJaZYVJPzHCzm9hdB1nSpJGPp/pg:+BOVglYXrbtZqRvJaZYVJPzHCzm9hdBY
TLSH
T117B24B11763A03C03A7E254A9595B46F62C230A37098B42B7BB944A65F6BF20DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a3ba5b301faaa24959af8869752dfa2e67b9a37ba78882826df9509ce16e5706
MD5 b31c600980a0611bba6e1accc90f6b69
SHA1 2a661587dc332b5296b6530d63120dbcdac2d45a
SHA512 6145ae568578cbfb6a903ffaa0ec288e3757ed4b208b0e14c21ee3c1255cdff126c0ac345d96acc71466d924f9d3335cfee40b00f76e58e479cbf5d365a38551
SSDEEP 384:nuNiFavqMg3sNf8TUNTUlIm2RihYeRrmvfDYoleDkmY7sEQlS7o1dKuiNgXMrN1b:uEFayv3owgTi/2YolX7sVlmo1tiiXob
TLSH
T1F3C24B31E898D9ABEDE79FDAA7497A07DEE002A7D58C0AD4D9D81D0D00D31DD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 283530e3779b69a50e0c64d0d5224735df2e4c19fd80e22ed31eeebc38be7dd7
MD5 f8fc7a97b0b18cdf1884598034ca2d67
SHA1 8b792e5485f7ae47d6ae76bb5cd2c34e86f205d4
SHA512 d17d73fa581204d9c4dd2e79c9327629a79b9749bb72669f97d31b7464b002ff887ac416ea24851f8ea6c7bf331b39a82e3d39a9a5b293a69f8df354bd5352d6
SSDEEP 384:nciFavqMg3sNS8TUNTUlIm2RihHhICmvfDYoleDkmY7susbngS7o1dKuiNgXMrNN:HFayv3hwgTi8FYolX7sfgmo1tiiXob
TLSH
T131C24A31E898D9ABEDE69FDAA74A7A07DEE00297D58C0AD4D9D81D0D00D31DD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 414624065c8a903fa811a792afb7482a5ea3c800c070bb9e0b8926ef69ff9141
MD5 5042d312d9bbcc5238ded4fd8f5cbf92
SHA1 b8782740e53d72da233018ba08a17a34d2ee537a
SHA512 72a473aa08b1b157330622d89776968fc5fa07be772696012b8df7398dce4d5029547fac70f382ae2fcb818a645cb8d7be67c20d3b3b1959556d624cd71ee634
SSDEEP 384:nBoiFavqMq3sNe8TUNTUlI4ARih2m/hmvfDYoleDkmY7susLngMvPks1rrN1k+rI:BzFay53Rwg3ilkYolX7sPgGTBG
TLSH
T172C22931E858DEA7EDE79FDAB74A3A03DEE0019795CC4AD4DAD95E1D00871AD130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8cba7a521e6a3c3eded18295fbfa6cc451b6fb2a578dbe0be24b4780ffc3fba9
MD5 21c439277be4861ad41697756e8d1447
SHA1 d541708ba517f20acfcc8cec72cdfd05b48bc07d
SHA512 3f45b2f67dbca84eaa125cd75464e717efb8cab1c5465a40948ef908b00b98bca06eff05ff854fb3a3c5b1707c2eaf9e4ceaa27085a8d244152e3f93e8dc34ff
SSDEEP 384:nLoiFJjccCs+Bt0S36sNe8TUNTUlI4FRihKm/hmvfDYoleDkmY7susLngMvPks1I:LzFJccQaRwgaixkYolX7sPgGTBiP
TLSH
T1D3C24A31E8A4DDBBEDF78ED9E34A3A47DEE001A395885AD4D9C95E1D00871AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 48be31065b8c256bd9653a1a2337c998972f97aed340d1a92f41d01df4e34369
MD5 6403d022474466e726ad48a3c50608b3
SHA1 0c019e257f040f5330eaec4e28dd99d0a4916109
SHA512 6e1b39ab5631eb2f3debd50ba96509afa2f11c40e43ee0d734bd233944315d224fc5c7a3ac2522e2f340bd417c3d554c94fe320240afb8b6bb8f608fe7ff6249
SSDEEP 384:nBoiFavqMmsNe8TUNTUlI4ARihKm/hmvfDYoleDkmY7susLngMvPks1rrN1k+rvw:BzFayrRwg3ixkYolX7sPgGTBG
TLSH
T129C23931E858DEA7EDE79FD6B74A3A03DEE0019795CC4AD4DAD95E1D00831AD130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4925aba928c76fdc4108d45c49ae724ddb63b616946f712dd2f2f9d39829531d
MD5 3aa7057aa031840e886baae0e84550b0
SHA1 dd2ae739cb749c7fa481e54ad07d86433f7755d7
SHA512 b9e1bd72adae6c38e783a5eb54357b1f53b6c317edd8ee417fc69abe02436f8c01e3ed58aa658815c6115bb646c03bf9505eaaa4eb00b91188fddbd5b216b830
SSDEEP 384:nLmiFJjccCs+Bt0S3IesNe8TUNTUlI4FRihKm/hmvfDYoleDkmY7sus/rgMvPksS:LNFJccQxRwgaixkYolX7s3gGTBiP
TLSH
T15CC24A31E8A4DDBBEDF78ED9F34A3A47DEE001A395885AD4D9C95E1D00871AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc54ccb49932472b298bf7a7f61f0daa5a2b46cddce82ec324191c63012824f1
MD5 140b3a8d9cd80b7be729ce5f851bc1d8
SHA1 55d5a94b50a759ec491123bda13095c5b5515ad6
SHA512 59fa72f442b1a3540da0e860c14b6636a5cc9fbe734591af265d92810bd4693c18e493dca2bf80014a67ce0afb7cf62ba4decc4b3a8fffcf2cf8559a939e7005
TLSH
T16741275CAAEA2148B3B36F56ABF6A96E447F7D372F16D45D10000E4F0A22B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Mozi.m.crdownload

Path C:\Users\Admin\Downloads\Mozi.m.crdownload
Size 78KB
SHA256 a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3
MD5 9b6c3518a91d23ed77504b5416bfb5b3
SHA1 0a2d170abbf5031566377b01431e3b82d342630a
SHA512 b2b08d5d5e6c6708d88b793e9340a780d47b5dce61e0a3026b4cdea8a9e4cbf9824037255e4ea4a40fee5bce956485232376d4677ce72ccb6c7f00badd09956e
SSDEEP 1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL
TLSH
T16D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads