hxxp://42[.]6[.]189[.]41[:]35476/bin[.]sh

Analysis

max time kernel
89s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://42.6.189.41:35476/bin.sh
Sample260418-mptcxset5w

Score

8^/10

discovery upx

Malware Config

Signatures

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
behavioral1/files/0x000b000000024482-66.dat	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000024482-66.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209832793202219"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{8DD0801A-2187-40DA-B91D-EDC9442F4714}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4768	4760	msedge.exe	85
PID 4760 wrote to memory of 1340	4760	msedge.exe	86
PID 4760 wrote to memory of 1804	4760	msedge.exe	87
PID 4760 wrote to memory of 1804	4760	msedge.exe	87
PID 4760 wrote to memory of 1804	4760	msedge.exe	87
PID 4760 wrote to memory of 3084	4760	msedge.exe	88
PID 4760 wrote to memory of 3084	4760	msedge.exe	88
PID 4760 wrote to memory of 3248	4760	msedge.exe	90
PID 4760 wrote to memory of 2800	4760	msedge.exe	91
PID 4760 wrote to memory of 3248	4760	msedge.exe	90
PID 4760 wrote to memory of 3248	4760	msedge.exe	90
PID 4760 wrote to memory of 2800	4760	msedge.exe	91
PID 4760 wrote to memory of 2800	4760	msedge.exe	91
PID 4760 wrote to memory of 6056	4760	msedge.exe	94
PID 4760 wrote to memory of 6056	4760	msedge.exe	94
PID 4760 wrote to memory of 5736	4760	msedge.exe	95
PID 4760 wrote to memory of 5736	4760	msedge.exe	95
PID 4760 wrote to memory of 5708	4760	msedge.exe	96
PID 4760 wrote to memory of 5708	4760	msedge.exe	96
PID 4760 wrote to memory of 5176	4760	msedge.exe	97
PID 4760 wrote to memory of 5176	4760	msedge.exe	97
PID 4760 wrote to memory of 5176	4760	msedge.exe	97
PID 4760 wrote to memory of 2784	4760	msedge.exe	99
PID 4760 wrote to memory of 5648	4760	msedge.exe	100
PID 4760 wrote to memory of 2324	4760	msedge.exe	107
PID 4760 wrote to memory of 1512	4760	msedge.exe	108
PID 4760 wrote to memory of 5124	4760	msedge.exe	109
PID 4760 wrote to memory of 5096	4760	msedge.exe	110
PID 4760 wrote to memory of 5096	4760	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://42.6.189.41:35476/bin.sh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffcbeaec188,0x7ffcbeaec194,0x7ffcbeaec1a0
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,14124477609226612010,6045275625525344256,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,13230728339189346328,3480787554369829943,262144 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,1422573971063745409,9202571063844022048,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7774341517131204886,10510806841993247609,2097152 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17547087196706110113,4727443017564890872,2097152 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,13827619047211523574,13148243369727609895,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,144281530560197558,16752177321043646536,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,4517235130146608092,314603771095145078,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5608,i,395138257049330873,12670352783343820788,2097152 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4383037132043688610,3372648960329992186,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4383037132043688610,3372648960329992186,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,9501625906414269043,876403656320552413,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,8447166423532952057,3264060621482893563,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17140677467027048927,8617089236835712504,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6547236856821004052,13980598485000798713,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,15769280358704320939,8506450595182450308,524288 --field-trial-handle=2320,i,18400541831470106631,3119454969351360311,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cecf0e90e6ef74ebae18a701eddb9f16dd38eadfb30146d9deb1c41db0c0153d
MD5 c142d79447462dfabd67e541ceb53bc6
SHA1 91880e6b0b9138b55d57ec1f19764ea70dfc036a
SHA512 6a3b3c7c7c2e27a5838cd23a95231fbc0a3891e41b5397ca5d4a6de44afbbceaf83c3078148297a2f7026ad7249d3bef7d74ed595faf7b3cd5f4f63c4d115b0b
TLSH
T175E022AEC921EC6B1CF9171970B44646EF5813572A80AA4F3E3D81098FB0A3B46C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 134KB
SHA256 f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8
MD5 3849f30b51a5c49e8d1546960cc206c7
SHA1 61c74136534b826059c63221a2373dc0613a47b7
SHA512 43d79293d1fbf716111c27e50df95a0860a0d706079625fa2b8a6b57c5ee06fa7b5b6b8c0acae33714a2181686426728513c990534e44b6f03a05dde0629ab86
SSDEEP 3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN
TLSH
T159D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8e6a0b715ced568d8c23469ef855183caae1f6ae489ddd5e3a422dc3dc290dbc
MD5 df1893fa948d96b6d788acd0a42bcae2
SHA1 6a7836d3735a1b90d81ed75ac61709d703049301
SHA512 c752ea69b1a0902b21daa28694c83ba7081048f5babe303b069db7db2e813be3d76f4b1dcec1eea3a9eea4087ab34977ac85e8df94d7794c6a0a1a2114201e64
TLSH
T17341DCF383E4856E8A1196F0AB187E2BCE2D0550432C7C9AC9E4EF1BA7E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 23102b61ae54eedbc261394e6bb190c0cb5848af22acd47f640f03abf4979241
MD5 328b00f240408870fd4634c40768a8a2
SHA1 93d2a703141b4ecc4395cf40d5a9d25022e03f8b
SHA512 ce67cd7a27d3a8425f365b7491670586199de9feb3c038f8276b1dafeee3d496f28b0e8bebcf8ce7796f3d02a2b667e5597d85a193a4118d8ccdda2faac7bd88
SSDEEP 192:sxZKRCyMqZ/K1Ml8M9C/fXst0Nu7OZJ1zodpLHW6+WNGYxik8e+igIgjrJ:sxZKp1C/fXst0cyJeLHbG2gj9
TLSH
T1146209156A38993B8CDBD209FA85BF93C7F9156391905E4499FCDB0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a442332363267f90e12794115750a5ccf2ad358b75ddcdb6103353f7713fa843
MD5 1c2077eedd4fd4935a546c291bc934bb
SHA1 fbfa12452c11a45d7e697b7279eb87fc9b0d3d31
SHA512 559c3f1687d814f7222d451a6d6136827027a4331c18f3d0133a608194603d9f17e0c3830cf676bb53c274e42d4a16e66f615f898dbe0d0e73a1c2cf774d56f1
SSDEEP 768:Jdc+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwDFkLlMeNtFrox:Jdc+txWE/VRWvV/qHu1ja9DFkLO6t+Jj
TLSH
T171F20B3B2C0CCB7E4F844E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a5e732b00923f35da1272eeb417fc2aaf6cbcc229a076a183fc58bb481bfa83b
MD5 b7597b5cd73fc80582e9c06801165b2d
SHA1 7deb8346b223242c03464da80d44574d588fcf3e
SHA512 dfb8553e6a5ff1f4f9d4aac0feffcde69e21e7a8d2d9273724c605329ff82957aa409571827165df29dff96027e1518a26921924395b92ca9a8bfd46d906cb09
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xfqJ7:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD1
TLSH
T179B23C10313B06803A7E699E95A5B86F62C270633058A93B7BFC00A54F6BE14DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 34de3b2cdbdc43086813b01ff4cec74d4067dbf63a771571a8b3ef90c58af87a
MD5 e5b7e477de914cc418e42771219226ae
SHA1 74cfa9b54fdd66be0271da097e7edfbe4ea02145
SHA512 d16b330ccc038b4cc71fbbd25e585c82ceff2a5c40329c008a26dc33deeaffd5c750a6cc87406ec44330b41df740fbe5374742e35f3e12fafc093d8fde6822b0
SSDEEP 384:naXiFJjccCs+Bt0S3lsNV8TUNTUlI4Fn9JoYYu34fEP8ufIeCzk/uoW8XU/AatIY:aSFJccQFewg85JP8gIKs8XabW6d5TP
TLSH
T17AC25C36E898D9BBADE78FD5F3497A039EE001A789885EE4D9CD1E1D00875DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9e352c0c29e936c8f47e009ee69d2691893ccd27935538d33892331a2fb0b834
MD5 2880b0f53e4d108b64d93a989139095d
SHA1 61f9414a1bd5db1f01960f9f4ad320b21d3cb009
SHA512 7d53b80ca821cbcf11bf34589181405194fc4ebaf7932eb7b7ff64487913197d9b5f0529d156383c1c7fd07eada78b9406306ab22a6178eea46295e356bd76d7
SSDEEP 384:nEiFavqM33sNV8TUNTUlI4Y9JoYYu34fEP8ufIeCzk/uoW8yrNlk+5vI+g:fFayI3ewgZJP8gIKs8yU
TLSH
T1FFC22A75E858DAABBDE68FC9F7497A03DEE001A7998C4ED8D5D91D0D009719D130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 227a50904009d09a1beb15a1c6459f21a442513a4d7b30ec0ae3471041d11d5c
MD5 4b0c50a4cf9e863670a1b78b4198bb87
SHA1 627d36922cbca4e32794571e23d09bb6919dc433
SHA512 12b7627613bb7c2fc950325d4d7fddf91e9bed3ecc1fa3abe86a42a86e6adeefba0c702208d358dd85369b36ea930b4b18ac3d694bec229edf45706cd36bbee7
SSDEEP 384:naKiFJjccCs+Bt0S3AhsNV8TUNTUlI4Fn9JoYYu34fEP8ufIeCzk/uoYf8XU/Aan:aBFJccQeewg85JP8gIKGf8XabW6d5TP
TLSH
T148C25C36E898D9BBEDE78FD5F3497A039EE001A789885EE4D9C91E1D00875DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 87f1df6669cfb1f74835edd4902bc8ce7d55df034d0087268a6c22e5c045af50
MD5 e6f9c4e7ff749e4f0afe0bf18d167699
SHA1 cdba23b0dabfdc771174f3ac3b99b4572acb73e6
SHA512 a0894d8b004a4ed29bc159bcc0cd4879964753421629ae03af8f9c301ac2c61d51a9cd4d4407f4f319b9bcabfbac4d49b09724b52b5c86994e089f3e5a7756b4
SSDEEP 384:nyiFavqMg3sN58TUNTUlIm29Jici34fEP8ufIeCzk/uo98dnS4mtmkPPrNlk+5v/:5Fayv3uwg9wP8gIKz8dS4smyDP
TLSH
T1AEC24B75E898D9ABFDE78FC5E7497A07DEE001A7D98C4AD4DAC82D0D009759E130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3a8fbac2f29d335eed77d5beca2b235234c35aefdb2b972a318048e618a9b49b
MD5 d23ecd359b11d3e9ff7fd95b80a16973
SHA1 ea5bd8e9f3a91e0a67b7b01f4d1ecabed82f79e0
SHA512 3719d2982fef3a89566cabc142600f3f143b3d086dd094aa01109c64f849f696a1095853cdafbc39f8606eea65818d929429aa650496e739f6beded071711be2
SSDEEP 384:nxiFavqMg3sNX8TUNTUlIm29JCyv34fEP8ufIeCzkFQdnS4mtmkPPrNlk+5vI+L:YFayv3YwgJTP8gIaQdS4smyDP
TLSH
T1ECC24B35EC98DAABEDE78FC5E7497A07EEE001A7D98C4AD4D6C81D0D009759E170BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 90e5dbc5d0d6d2e099821e29fb7be4d7fc048c58f82905b89403509478079f3a
MD5 4d687a51421370eabfd685fb8977d0fc
SHA1 d096654ecea59ff2d9389fe9f566c46cc371b297
SHA512 bab7c9a42c895bcf333b6e9fd88e43b46ceebb76abb5695043cf87a1aaef34e5688e504047119d0d42b121c211a050700ec521aa324b850b8f873fd6691fda52
SSDEEP 384:nEiFJjccCs+Bt0S3lsNV8TUNTUlI4Fn9JoYYu34fEP8ufIeCzk/uoW8XU/AatIdi:fFJccQFewg85JP8gIKs8XabW6d5TP
TLSH
T19EC25C36E898D9BBADE78FD5F3497A039EE001A789885EE4D9CD1E1D00875DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6ab44500f769baf1aa6ec3497b1f91aca73c9ad9931c0c184ece549e33459273
MD5 22c1037af9a8af7c7349b9d00dbd0f35
SHA1 7031d5a52da4ae8a3afa596f46ec88a7ad7c9ab8
SHA512 6484cb0ba2ad1eca159c6c82bae63524e2916fd5ba0b54facb86bd815ccf22dc1dbb38ec61fda37940c6b9efd5bcaa63c7be78a26e871f721e9fcb94e6ff9753
TLSH
T126412B58A6E9610CB3B76E6A9BF3A86E483FB9772F46D55D00110D4F0726A00CC71733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2784-205-0x0000027F3FAF0000-0x0000027F3FB45000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads