hxxp://200[.]115[.]102[.]14[:]33789/i

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://200.115.102.14:33789/i
Sample260418-mp84dae15s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_500703767\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_500703767\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_500703767\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_2072654260\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_2072654260\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_2072654260\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_2072654260\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4420_500703767\deny_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209840058121018"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{0DAC87F6-5E58-4BCB-BDA1-14F6DA93FCF6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4484	4420	msedge.exe	85
PID 4420 wrote to memory of 4356	4420	msedge.exe	86
PID 4420 wrote to memory of 4336	4420	msedge.exe	87
PID 4420 wrote to memory of 4336	4420	msedge.exe	87
PID 4420 wrote to memory of 4336	4420	msedge.exe	87
PID 4420 wrote to memory of 4924	4420	msedge.exe	88
PID 4420 wrote to memory of 4924	4420	msedge.exe	88
PID 4420 wrote to memory of 2100	4420	msedge.exe	90
PID 4420 wrote to memory of 2100	4420	msedge.exe	90
PID 4420 wrote to memory of 2100	4420	msedge.exe	90
PID 4420 wrote to memory of 1964	4420	msedge.exe	91
PID 4420 wrote to memory of 1964	4420	msedge.exe	91
PID 4420 wrote to memory of 1964	4420	msedge.exe	91
PID 4420 wrote to memory of 520	4420	msedge.exe	93
PID 4420 wrote to memory of 752	4420	msedge.exe	94
PID 4420 wrote to memory of 520	4420	msedge.exe	93
PID 4420 wrote to memory of 752	4420	msedge.exe	94
PID 4420 wrote to memory of 3100	4420	msedge.exe	96
PID 4420 wrote to memory of 1280	4420	msedge.exe	101
PID 4420 wrote to memory of 5888	4420	msedge.exe	102
PID 4420 wrote to memory of 1832	4420	msedge.exe	103
PID 4420 wrote to memory of 4236	4420	msedge.exe	110
PID 4420 wrote to memory of 4236	4420	msedge.exe	110
PID 4420 wrote to memory of 4236	4420	msedge.exe	110
PID 4420 wrote to memory of 5896	4420	msedge.exe	111
PID 4420 wrote to memory of 5896	4420	msedge.exe	111
PID 4420 wrote to memory of 5896	4420	msedge.exe	111
PID 4420 wrote to memory of 4024	4420	msedge.exe	112
PID 4420 wrote to memory of 4024	4420	msedge.exe	112
PID 4420 wrote to memory of 692	4420	msedge.exe	114
PID 4420 wrote to memory of 692	4420	msedge.exe	114
PID 4420 wrote to memory of 460	4420	msedge.exe	115
PID 4420 wrote to memory of 460	4420	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://200.115.102.14:33789/i
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd38e7c188,0x7ffd38e7c194,0x7ffd38e7c1a0
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,4289180519593358767,5773337321317671816,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,15845420069330004963,3375753459928118195,262144 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,9721087363555508587,809595329049701047,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16028866922623018691,14374368503785916511,2097152 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15918941987216824767,16143821605563350112,2097152 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,8562316462958939978,2749014574756069767,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,2558356620230206234,4765598382521265168,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1944091410982993483,11565224342076179380,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1944091410982993483,11565224342076179380,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17376019874914791313,5470784461947511903,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10235035888298596214,8497951852331877448,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5429955072283217842,16353506431519067613,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5032,i,7264070495906425352,16404999502578588484,2097152 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3512,i,18315572018978493127,11566654006348491266,2097152 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,17768711983565733061,2849909880932238959,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3529299127603280716,15299506329486895138,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5134479007902690153,13885643387284504738,524288 --field-trial-handle=2308,i,14292752729875171632,3066330281455775479,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4420_2072654260\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4420_2072654260\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4420_500703767\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a48d054f40c951cb771d0d59cfa537eeee68ca7396417f311a5f3b7ca6f59522
MD5 bf72d40cda04e23fb1b9bd98462fc30a
SHA1 dd3ebc46086347a0f7733e5fc03847f9fbd8389d
SHA512 aef27904de59cdd0bc886e97118f04b5d850f5689d4dfaed4e9fc9942679d77187674c3b8bf21a7deaa77342618e4e89dfbdb7b12d5ed98f5decb6486fc804db
TLSH
T1CCE02BAACD21AC2B09F94B1920124B46EB55135B2B50984F3B3D92488FB46370555C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f7e9d27fcf3f6780c2c34071fa4faf5500e18418cb0a4dd5031edb3854f33e7d
MD5 1875b871b304447b49a106c82d66f5aa
SHA1 67fd16d4e94cb396298f6054d47db1d9daf59837
SHA512 c445c0d48e0e034b2d5e976a756c27149dc7522c325fd8cee70d8a43f89f9d888c06ec235f3658db5633120bb3c9225392d0917f2b49b219d345137a29867275
TLSH
T1A641D0F783E4856D8A1195F0AA187E2BCE5D0550432C7C9AC5E4AF1B93F3871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ebc537636393e2f98e975cade03599ffa805835d29c9b2ab8c2f311f1a08493a
MD5 3649936f0ae79aae088a2ce15725cae4
SHA1 32cc5e136e43a0c727a02f8c318cb1b0e1c28a9c
SHA512 ac919ff69abfaa2b8a0d7303633fd04058c107cd8b1d5d14d500f59b0241f67d1a4255bc6378de81447e5588aeecab8d538d547fcf8ef238d445f1b691f3276e
SSDEEP 192:sxZoR4yMqZ/K1Ml8Mk0/fcs9Dp7EECvXzodpLHW6+WNGYKb2WENcWGvIgjGJ:sxZonM0/fcs9dY9v8LHbGXENcWAjS
TLSH
T12D62E8156A38997BCCDAD209FA457F93D6F9553392804E44AAFCDE0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 245a8cf5668697186541355e9b81eb4a439a82a0cc13aac3a9aa2e75bf797358
MD5 943028c93b5f67b62b870980859c2796
SHA1 085a71d3ac49cc06035f0d7d0de7784cf81cf846
SHA512 ab70ac2131676b2e8dcf50f97dc490540e275899d1bdb436b70f854a6a2cfd2098b96b0d7797f0ef44fcc276ff9a6fc058c42e905fc9c9ae79686e56e3e49c8a
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVldEx4Llhf51Yr0:AasqZl+E/BlWvBDeTu1jaCEx4LXB1jAi
TLSH
T190F20A3B6C0CCB7E4F804E9CDC2A7E8E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fcc17eb2727ec016f6172c39313356f4429e07940e14f60991a011549a70e007
MD5 1e1bb8f43a5528dbb4f73ba426cbd0a6
SHA1 4e8d7e4e16ec019e205bdcf1fd4b5b4968ee0e05
SHA512 e06f1eb57363da84fece748a397d631480a6c91903309bf4ec0a4a2ef398e4aa8538051f4c94b3237e78955520ae1b882501609c77fffdd005fced5895bab161
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnN:+BOVglYXrbtZqRvJz0i
TLSH
T15FB23C11753B03803A7E695E9194B46F62C270A33098B42B7BB944664F6BF20CDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 abd0e6f8281bcf7350128e9eb52acc499a350902c216ceb3dec2f6b6117dac4d
MD5 6d07597318ce8338d310a08c0e6e309d
SHA1 b571d8a5610761c23db97ac2c04a643f99c02db7
SHA512 769938a18d1ea2b09471f899a645cb9379391e1544fc017cdcaec344b9f2adbb668669cdf52a316c5db2b135eb0fe4206062a850677a53d4800aedf32fbda9df
SSDEEP 384:nuvGiFavqMg3sNx8TUNTUlIm2RihYa+r8vfDYudXWsQSzS7o1dKuiNr9x2rN1k+U:uvtFayv3ewgTiU8YuAtymo1tiDYyyro
TLSH
T13AC23B35EC98DAABECE78FC9AB597A07DEE011A7C58C4AD4D9E80D0D10D719E1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4cfa9f72b349682dcf06f59cfd810ec3f8683706da99792e1a9b1a72ab4c79cf
MD5 64810850b71b8ea1f77b024769d5e410
SHA1 9345abc8de5863d2bdbb4a1ff393951d92ef5f3b
SHA512 ebc59e10b2b8e1f47785a3400980fd5cf98bb0a9e3ddd217522f8b7f4b3593ee3152e682395977405bf26c249747a2db1188a8cf5b960d8f759e3e830397440c
SSDEEP 384:n8GiFavqMg3sND8TUNTUlIm2RihYsHP8vfDYudXWklnSuS7o1dKuiNr9x2rN1k+U:8tFayv38wgTiNYYuAEfmo1tiDYyyro
TLSH
T134C25B31E898DAABEDE78FD9E75A7A03DEE00297C58C4AD4D9D80D0D10971DE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a74d27d7677f42d7555f0d427613b504c00cf0470c3ec79d220e9da8af0f474f
MD5 dfe3339dd3fd8d32ab4d94f9a38c4802
SHA1 ae43d087148ed868787dac24bb75802878ef3ceb
SHA512 647c2c632775c629c92ae35abfa4888ab25d0064ea02f4d80e1d3d6603a00ed90921e2a51cbd0537536255561a45f15b3f6045b81aea268385c2b0d5c574755e
SSDEEP 384:neGiFJjccCs+Bt0S3x3sN38TUNTUlI4cRih2Lu+8vfDYudXWkonSuSBFr+irN1ke:etFJccQR3swgPi3nYuA5fSqeCK
TLSH
T10CC24B32E8A4DEBBEDE78FD9B3497A439EE001A3C58C5AC4D9D95E0D008719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dbd4980ce184e6105b1ea72585f916ee0a0ac8bc17606899e1373b42c356970e
MD5 7af610d74e8ae9f19c37e4adfc09185e
SHA1 a3b64267bfa1394e48c80771a91db5d8a285a23e
SHA512 8c390a4f88f50aa390e375d50fc4e1e2d56b25ab1b602ea87fea282bfd6bdaaf268b9174c36fc16ccfe597ee4fc059c44eea2e1b05f73e2ca99aa229d60b35b1
SSDEEP 384:npGiFJjccCs+Bt0S3x3sN38TUNTUlI4cRihtLu+8vfDYudXWkonSuSBFr+irN1ke:ptFJccQR3swgPianYuA5fSqeCK
TLSH
T198C24B31E8A4DEBBEDE78FD9A3497A43AEE011A3C58C5AC4D9D95E0D008719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3207d7c4da18d3fdb4472c131f9ecf2fbdf1e78125d789bbf0db449716882111
MD5 c33cd381851d783025140d383e640a2a
SHA1 8d81cc5cd609e76396156068bc2b8dd1931aad15
SHA512 4c5194695ea3ba4744311d2054213673693f098ffd16d3609b5a7aac6d8c7e6b90d514934e974262c755000943b70b603f1b4637f027752981035b81eb49b485
SSDEEP 384:njiFJjccCs+Bt0S3Pl3sN38TUNTUlI4cRih2Lu+8vfDYudXWkKrSuSBFr+irN1ke:OFJccQd3swgPi3nYuAJfSqeCK
TLSH
T159D24B32E8A4DE7BEDE78FD9B3497A43AEF011A3858C5AC4D9D85E0D008719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 06ef869bad02c4ee587bfd834ddf2e4b2b6188b0b9a6f88e21ffff2ea14751ee
MD5 18a3b17ff968230e183c470ad6d87ac5
SHA1 09a0dd496eeddef5e56ce834be1ef74128e8f656
SHA512 b39c7ed2c829a41d17a5f79b302a0146558624fe3cb384b7729e0294b1bec420a3d38482cdfc733a3f33e5d12667207f517da77458a8fe7eb9497d24948323df
TLSH
T11041FC58A6F91148B3B76F56AFF6A86E487ABC772F07D49E10110E4F0A22A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads