hxxp://43[.]247[.]135[.]185[:]8888/supershell/login/

Analysis

max time kernel
88s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://43.247.135.185:8888/supershell/login/
Sample260418-mp2djaex9k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209837878157309"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{16746CA9-212A-49A7-A4B1-9E6C2D3525C9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4916	4744	msedge.exe	84
PID 4744 wrote to memory of 4932	4744	msedge.exe	85
PID 4744 wrote to memory of 4936	4744	msedge.exe	86
PID 4744 wrote to memory of 4936	4744	msedge.exe	86
PID 4744 wrote to memory of 4936	4744	msedge.exe	86
PID 4744 wrote to memory of 4964	4744	msedge.exe	87
PID 4744 wrote to memory of 4964	4744	msedge.exe	87
PID 4744 wrote to memory of 2064	4744	msedge.exe	89
PID 4744 wrote to memory of 3884	4744	msedge.exe	90
PID 4744 wrote to memory of 2064	4744	msedge.exe	89
PID 4744 wrote to memory of 2064	4744	msedge.exe	89
PID 4744 wrote to memory of 3884	4744	msedge.exe	90
PID 4744 wrote to memory of 3884	4744	msedge.exe	90
PID 4744 wrote to memory of 3848	4744	msedge.exe	95
PID 4744 wrote to memory of 3484	4744	msedge.exe	96
PID 4744 wrote to memory of 3848	4744	msedge.exe	95
PID 4744 wrote to memory of 3484	4744	msedge.exe	96
PID 4744 wrote to memory of 1992	4744	msedge.exe	98
PID 4744 wrote to memory of 612	4744	msedge.exe	107
PID 4744 wrote to memory of 1068	4744	msedge.exe	108
PID 4744 wrote to memory of 3888	4744	msedge.exe	109
PID 4744 wrote to memory of 4588	4744	msedge.exe	111
PID 4744 wrote to memory of 4588	4744	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://43.247.135.185:8888/supershell/login/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa922fc188,0x7ffa922fc194,0x7ffa922fc1a0
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,10172250410910837499,4120458611370146821,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,13139871299257908113,17660237355823803524,262144 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,722638123234311541,4827895136015110137,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4368726054777735197,5431137583098221677,2097152 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11210900897146491779,10925795073312233475,2097152 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,6718637308484366278,8528806292983463904,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,12183234247318525951,9440401443597860250,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,3238554242935435328,7520579143882501529,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,3238554242935435328,7520579143882501529,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,7677918827959752919,8566738974705063423,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16698350527331889720,10376579065068635893,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3826681293070784507,15025291744241400413,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,10028948505341892947,5497521448511888630,524288 --field-trial-handle=2476,i,5006026316022999188,4240003905846064744,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 abd5e3d78f731a819371db6d379ddea07a4b7c10857266c561d708d1f9efb971
MD5 e1e884cc4b83ef5faa29292a538ce3c4
SHA1 d57c7fb84178f37c4676d1511b6afa1c864dc683
SHA512 bf382577a596810bda174db688c67b4d4456fdea365aca1f3d4c403de65dc057380c29f1cacb22b66dd4889d8c028fc71ae24d521441e6aaebb2228565a46d7b
TLSH
T1D3E022AAC821DC3B48F90B2960524656EB52235B6B50984F3F3E92488FB463B0996C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f12b7f9f816b5cae3bfde6cd0b3fd9948f7f346d760241478178d778a8397a61
MD5 41e8b5a9c2d55431064fb106ae0b9a44
SHA1 79e83bb433381f12d05e1cb8b23636c77bd1e6d1
SHA512 0db6b64a52b9010bd59c2163c281c438be3cd17025d919656193c2cdacca08279aae58253eedb0cddb81dbf5020b6cf9c61f358ebcefe002416ee3a95f4be6ac
TLSH
T190712B54919EC06AE7E051BC159429A6B3308FDA42C73E7635FF467FBB4D7AD0081D22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586c80.TMP
Size 3KB
SHA256 3e65855d453e12d0e62619fd2add3046191c765164e22ae87a0787a3b9b5e8f2
MD5 305e61f8c60430fd5afcb535e8d9d05f
SHA1 b7c569caaee798e4f5f9df0c4a1d1c13027814e8
SHA512 9412de9ee834a4ac8214b5f906af67921df62c13e84cefc3baa9f2ca5b21dee2a6b92f24612329862932d297000b599fc1b41686335b93e0b57367858b7a2cd8
TLSH
T17C712A44819EC06AE7E0A1BC519429A673308FDA42C72E7635FF463FBB4DBA90081D22
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

459ff847-99b3-4060-820a-2993cd8b7e60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\459ff847-99b3-4060-820a-2993cd8b7e60.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6e8664a70924d306910846f2fec0672c56d2f053d5132d461ff66c35712e90e3
MD5 663e21ad8ffea1bea039b92ec451ddd5
SHA1 5324c6b944aaf7d6688e7542881fb78f4e1d5bbe
SHA512 750e6dc8778feb598236ef05f27af93044ea857087bfb3347a2556d456ae8b0d4adbbeabf74dbf78ad000a01877dcef76b53c4d9c0fc5e6e41d222f2c7a3642e
TLSH
T14051FAF783E4852ECA0196F0AA186E2FCE2D0515436C7D5A89E4EF1B93E3471E241B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d3f9c8e470be8dfe16628bb7ee784424004e640210b7775606f9bdb1e3b176ab
MD5 c5c9daf6a799e72ca7bb4ed63c2827cd
SHA1 be8018cd5dca91c9b45248a172665c64db42a812
SHA512 4a80f13fa57dcf339c152aa4bd3fb29f627627248125e1ebbcc8c0b98f3e794a77e6a96eced64eeb2ba1da5bbfea827ed405ee5ebd7beb54f1d1cb3e34004d2d
SSDEEP 192:sxZ7RoyMqZ/K1Ml8MkN2/fusbVp7svkzodp7xHW6+WNDjZ/YK0HeNUOIgj0J:sxZ7xMN2/fusbrYvX9Hbx/dNPj4
TLSH
T10972F9056A38997B8CDBD219F6857F53D6F90563D2904E44AAFCCB0C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f7b6f587bf1fb52b0f1529f768bad69564c5fb31ff6205fbdb1d1afaf8537902
MD5 4ed129aa741948fd538f50920d566099
SHA1 d8149898f535f4e0f17699b7c9c1336075fbcddb
SHA512 50398d731df09ebadc6a5b6b96c96a5f8d5b3621c22423395d36e160c60bf9b402410bb8c5cab1655530955c25958faca6ff0aa540e4cf41d198b3d03a1b26db
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7Ex4Llhf51Yrox:AasqZl+E/BlWvBDeTu1jaWEx4LXB1jAA
TLSH
T155F20A3B2C0CCB7E4F800E9CDC2A7E9E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b690902167949257a75a700db754e10fd75a629c4406f87dd8865e78da212667
MD5 5e8290165c9ce430feb698ea27a5f447
SHA1 2c815f708c69ecde34d65dae72aa78440a7a46ef
SHA512 42dbcf2dae5b997dc49004ef1dea9adcbbe807e3e9dfa89bafca30e78a2069dc995ae03176294fc78f7ab513219cd781b5684c3e3e50eeeb5199063d2a562523
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnE:+BOVglYXrbtZqRvJj9rS
TLSH
T181B24D11753A0380397E294E9595B96F62C230A37098B42B3BB944B64F6BF20CDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2cc05c494431bebf903f4fe570da4957ebc381358700077fffe9ee936e620ed9
MD5 193b6f1052f80898435854bb3678065d
SHA1 8667fdbf34870bcdc87c15765a916cc5425f282b
SHA512 f45073dfe7269159fb3bb8f45c5da7b7dc75d8298f046f53fa672d8b0f38124bf892d4abeb055eeaf28518286d002353f22f9aeebe50bacf46bed34be53102dd
SSDEEP 384:nuAiFavqMg3sNE8TUNTUlIm2RihYWcrmvfDY70JifyDQ/S7o1dKuiNhErN1k+rvH:ubFayv37wgTi62Y2B0/mo1tijwJ
TLSH
T13FC25B35EC98D9BBECE68F9AA7497A07DFE00197C58C4AD8D9E85D0D00D719E2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bb9945a8e50f619d87f04253f09b3bd13279cb8572d2b0ded9ddbf18fbffac69
MD5 a9b566461b2286d3464faadd4db34add
SHA1 424b24f45c38e131df81866894596b7189b64c6a
SHA512 4224f3f0563d0e5a995fae8add47bcb9e6438504073fab68d4246cdfcfd58f5ed33ffd248c9943a09fa32e97d0ac093242bc1722b5e4c1a6a4c725485349ffee
SSDEEP 384:nUiFJjccCs+Bt0S3n3sNJ8TUNTUlI4DRihUzZ6umvfDY70JifyTgndSBFH+SrN1K:vFJccQH3+wgwiyyY2B+dSmuY7
TLSH
T103C23A71A8A4CDBBECE78E9AA3497643EFF00157869C5DD8E9C95E0D00870DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5015764db554e12a8056c4916387f7375b903076fcfe4b996fbecc69aa824ee2
MD5 44be269bf1e2d160098735f4a2951c90
SHA1 976862da710fad0995368cd16fa95a4ca2e75a9d
SHA512 af011bfcbd7f3047720e99395ffeb841d0b2fce56a67f9dcc2e3aeead51d225f655d289cbad75535191ad0255cc5b29514208842d55108a64b3cb6a3619c2aba
SSDEEP 384:nRiFJjccCs+Bt0S3n3sNJ8TUNTUlI4DRihUzZ6umvfDY70JifyTgndSBFH+SrN1K:4FJccQH3+wgwiyyY2B+dSmuY7
TLSH
T137C23A71A8A4CDBBECE78E9AA3497643EFF00157868C5DD8E9D95E0D008719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5802489cf3d1521a7ab0899f3585686a496ce84c4cce688216dbebf4cce395f6
MD5 2c3b8ea3df271d6fa3505bee0ca29557
SHA1 03616cae671d65fd9f57de99b027afac0f6ae416
SHA512 b6a8ca7ee9e2d5eb739c1136a64175b09af54b1296189154e5d2cbe75c6da6c1a9f7f4e1776d0c3350130c5b6fb109f67a0b3ab929cf9c0677083305b3f076d0
SSDEEP 384:nZiFavqMg3sNF8TUNTUlIm2Rih3wdsmvfDY70JifyTxndS7o1dKuiNhErN1k+rvH:wFayv3OwgTiuPY2B5dmo1tijwJ
TLSH
T1D0C24B71EC98D9BBECE64F96E75A7A03DEE00297C58C4AD4D9D85D0D00D719E230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 26d60125b3f34c46bd4f62c5cd055135704cfa8984171381659dfaa67836d619
MD5 6f61fa1b6017a96650fd69a5d4df6f8e
SHA1 05da14f01e555e2c49ee094d22cce91bdba24548
SHA512 32b757566fb75ab776c048c0ec795cfcf83139d0c9780330f99075f46d01e0f0bf96b2a99d2761daf6572c37e023363b2f1e4c55c6a83c168d3e1c335973d662
SSDEEP 384:nUiFavqMz3sNJ8TUNTUlI4jRih9zZ6umvfDY70JifyTandMvPks8XtrN1k+rvI+/:vFayo3+wggi5yY2BMdGT85l
TLSH
T1BEC22971E864DDA7EDE68F96E74A7643DFF00197C68C4AE8EAD95D0D008709D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a141d60eb787ec816ee375c89bb58c375f3f2c026ce12f6496f64d53ec5eb931
MD5 74c9cacc18a0d2c884c5d09b16e4cad9
SHA1 4cdaa1aeeb3814a2277a545ab7bec52186ef59ed
SHA512 2a154dacccfd14f46b0e7987d6f686a0330526d8ba99350bfd7c40eb6ad157d1d6298bea3959888b8278fac49fa7f07563c3ab2146b61cabfaf579029ae5831a
SSDEEP 384:n++iFJjccCs+Bt0S3Jr3sNJ8TUNTUlI4DRihUQZ6umvfDY70JifyTGRrdSBFH+Se:+VFJccQJ3+wgwiLyY2ByhdSmuY7
TLSH
T16CE2C5F198D38976E8AE4B57A37D2E429EBCC153B5485994FBC85D0CCC860BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 389867b98631d4019c0cb19e8b3f49cf8a550450dd958217ccd2fae4c94861c4
MD5 e93de1b77d857a4ad04ad6ff4b0b1aec
SHA1 f35e0513b303e75bd970c41d5b0347d320eef8d7
SHA512 58d873c8baf30e9654cd986b9d4da8ab9cafcd020aa467ec22b6f2869ac2e6a8c043a3499084168cd1353a1bee4c90f1deca0456d0fb61c51bf5e8c214db019d
TLSH
T19A410959AAE92148F3B76F5A9BF2A86D497EBD771E06C45D00110D4F0A26B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1992-223-0x0000013E6C4D0000-0x0000013E6CC0F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads