hxxp://182[.]116[.]113[.]98[:]38258/bin[.]sh

Analysis

max time kernel
88s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://182.116.113.98:38258/bin.sh
Sample260424-acemsah13p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214627677430490"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{B195B4A4-A49A-4BBF-AD0A-BC3A8102A91A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 3076	4672	msedge.exe	84
PID 4672 wrote to memory of 1300	4672	msedge.exe	85
PID 4672 wrote to memory of 4992	4672	msedge.exe	86
PID 4672 wrote to memory of 4992	4672	msedge.exe	86
PID 4672 wrote to memory of 4992	4672	msedge.exe	86
PID 4672 wrote to memory of 440	4672	msedge.exe	87
PID 4672 wrote to memory of 440	4672	msedge.exe	87
PID 4672 wrote to memory of 2440	4672	msedge.exe	88
PID 4672 wrote to memory of 2440	4672	msedge.exe	88
PID 4672 wrote to memory of 2440	4672	msedge.exe	88
PID 4672 wrote to memory of 3372	4672	msedge.exe	89
PID 4672 wrote to memory of 3372	4672	msedge.exe	89
PID 4672 wrote to memory of 3372	4672	msedge.exe	89
PID 4672 wrote to memory of 6056	4672	msedge.exe	93
PID 4672 wrote to memory of 6056	4672	msedge.exe	93
PID 4672 wrote to memory of 2872	4672	msedge.exe	94
PID 4672 wrote to memory of 2872	4672	msedge.exe	94
PID 4672 wrote to memory of 3572	4672	msedge.exe	96
PID 4672 wrote to memory of 5364	4672	msedge.exe	100
PID 4672 wrote to memory of 5364	4672	msedge.exe	100
PID 4672 wrote to memory of 5364	4672	msedge.exe	100
PID 4672 wrote to memory of 5784	4672	msedge.exe	101
PID 4672 wrote to memory of 5784	4672	msedge.exe	101
PID 4672 wrote to memory of 5784	4672	msedge.exe	101
PID 4672 wrote to memory of 2512	4672	msedge.exe	104
PID 4672 wrote to memory of 4400	4672	msedge.exe	105
PID 4672 wrote to memory of 5328	4672	msedge.exe	106
PID 4672 wrote to memory of 4620	4672	msedge.exe	107
PID 4672 wrote to memory of 4620	4672	msedge.exe	107
PID 4672 wrote to memory of 4620	4672	msedge.exe	107
PID 4672 wrote to memory of 2736	4672	msedge.exe	108
PID 4672 wrote to memory of 2736	4672	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://182.116.113.98:38258/bin.sh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff96dbc188,0x7fff96dbc194,0x7fff96dbc1a0
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,5007011839090520146,6662266037697284834,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,862955493016743055,7092495120924890782,262144 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,5689170042876058963,2672217776270672239,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2136654659304871933,1961047249507724034,2097152 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5399945970502266810,11464045691534035133,2097152 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,15213935553459814400,6421663395518463514,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,4457682242933701523,6219929350531454486,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7838137831122235931,8168421676177943777,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7838137831122235931,8168421676177943777,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5740,i,7492416540016887921,7373377141687520927,2097152 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3640,i,3556392626201136648,16481707857568838141,2097152 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5823311318494942035,833104111893994847,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,2242023007173589167,2583323925177816029,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,17772250540265586062,11821295520861103794,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5892,i,15029884140160834398,12211505711139409901,2097152 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,10931139953937396968,9581708868718029317,524288 --field-trial-handle=2224,i,11910797730261257653,3106373683935400342,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c50738b0ecedc13f37bd35a3dca7ccbf4c7f51ccb76dd2c76dfaaf3adcb1e6aa
MD5 cc37329109fc07c11a66d39c1d50db84
SHA1 63eae0f473ea05f03211a50f9c45ea2080801f47
SHA512 0b4ac3c86d486b61b7be01997585873db73a427fbd2c189a8ed76667ab56ff051b655e491d8d56f6733b57b4c4ad7db7473da1c60bfb05df618282d15710bc8b
TLSH
T11CE02BE5D862AC3B18FD1B1890604642E74413573781494F3A3D830C8FB5A77558AC9C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0a6ae65235aae2c4200bf13c8fc5eff4310fdba62bc299eb514d9e0e0dd0d650
MD5 4e771961801157efbfa0cbbd3ffc4748
SHA1 ec8250a800c6952749227972072fcb8c3994ce89
SHA512 f9a1f1289dd6e4684de8c72950f676479e384ba4889e4834d02241095bbade70a18f1cdc28fa18617af92d4a5c2c3b72f60caa09bcecd7c2c8abb35afc30c904
TLSH
T15A41A0F783F4856E8A1196F0AA18BE2BDE2D0510432C7D9A85E4AF1793E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ab7180b5298ec3ec9484e30cfd16140c545b2f869c061769d8548337a80d3f79
MD5 d4223b65f0e2ca65f825a19710139f2c
SHA1 1b800faa5e172193348ce49d403a8e92ce1f9ed9
SHA512 54f76ce737f2d9a9d27a7c5d05668b9e3491aa7f514f59d496d619d2e5938c6d0129f74bed267f63ff4bad4dc1d4be5bed268121d04099ef7a172f91239760b5
SSDEEP 192:sxZLRhyMqZ/K1Ml8MkR/fvsXPrphqrjJczodpLHW6+WNGYKSM7ms9cIgjrJ:sxZLyMR/fvsXPniZLHbGlmGAj9
TLSH
T14462D7156A38997BCCDBD209F645BB93D7F81563D2904E44AAFCCA0C04E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 14e9c9662b8963fee4eaa8b46c864cc6fb94f6c9bada69e534db4d4139f6a6f9
MD5 95e546d941fa7ff578f23be48871c58c
SHA1 edaad200a1dd58026614f7ebb93946f14e38f8fc
SHA512 3992a5134ffe2003ff2b1896032b65b0a6fa37ebffde6f9e132b7cce3dc8a00f85b897a9b8774fff62a60482636693676d12f6309b0eef1bce695c3a3ebcbad1
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6MKJLlhzCpUroN:DcgLiAUE/aeWvaShqu1javMKJLDOp/N
TLSH
T18AF20C3B2C0CCB7E4F844E9CDC2ABE8E6DE802CB9698895447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d112fa0b018193cd640f72413df3fca90429505182634e7a981381991f20f8ac
MD5 42143a9a8787764e5bb1fc74c459b3fd
SHA1 fe14df5cc96b6bf1153ffc1fd2e6fc1758529ec6
SHA512 74ab2cea945c2e67266f30c8ca950d966b99a8b92032ece9266cb3edc6ac795639303f5cb0d73f8821562c52fc26f9eaffc648c43c88f18e03f41694a6264cdb
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BNjnQ:krN/INhx+kcxKBzxNDQ
TLSH
T128B23911717A42903A7E398E8595B82F66C230633098F53B7BB914A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a1bbc5ab9401f0384607678f5a2b083c011a05ac819d761d579daaba200297a1
MD5 31c5a5a58f699afbf5e910d983b81677
SHA1 17b9d0fb5d1decdd6c74a2f88cb021e78be73340
SHA512 01d60f6b0ea737d77b1b633d204ddb45dd3df2826b912d8266989a62e5249b4596469a34ef430162170bf73cb31d728af3c25849dbf16dd956f0b767c65f4fb5
SSDEEP 384:nGiFavqMg3sN/8TUNTUlIm2ZTPENI6Owf3YQA+I+6iH3Ra43GrN1k+5vI+6J:tFayv3qwgH3yY/+d6S3RaDS
TLSH
T184C24A35ECA8DEABEDE69FD9A7097603EEE01167D58C0AD4DAD81E0D008719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 98caf4fa9afd094d32d39edc00dd3f33aed93ef5ae4a2aa506f97517e06664d7
MD5 3828220a57676be2178e2c6949cf5e76
SHA1 1cd506ff3e675b5f37888a445b28c02173409af4
SHA512 a47d3314081d2cdc928f47cee2b5bf7819343d9409f3cf1268c8da8869e7e1352e53816618860f3e23c7bc357fb2b4fe2bd78763ca73e74f28a279991797d71a
SSDEEP 384:nGiFJjccCs+Bt0S3j3sNj8TUNTUlI4aZTPUV8Owf3YQA+I+xvg+uMwCn7q/JrN1g:tFJccQD3awgFcMY/+dFg+2A7q/tox
TLSH
T17BC24A75E8A4DEBBEDE78ED9B31A7707AFE04263968819D4D9C84E1D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3ef2b47f20cbb2801f9582db52bce60613f937236ecd66c0eb9d04f457072f36
MD5 c6ead45f14c7adcdad2f32b7d8192936
SHA1 f6e5c8c4c51975a9cd6dc7db543442d8e7661437
SHA512 d427df12a93b7c7ac6883f383ad262f405d4d7440d145b55295092e77e8ad7e16f0f0a4610160718f85643febc94f52ad1300bdc0d1cb702e9badfe1e23d585a
SSDEEP 384:nZiFavqMg3sNf8TUNTUlIm2ZTP+s5Owf3YQA+I+xcg3Ra43GrN1k+5vI+6J:wFayv3qwgHrnY/+dag3RaDS
TLSH
T164C25B75ECA8DAABEDE69FD9A70A7603DEE04267D58C0AD4DAD81D0D00871DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 357939b1a2657be6efbc0309e3d164f5544dcd950c6e9c1aafadd577bb7c15c8
MD5 344cd151db5000337c6da7b004a7327f
SHA1 414cb7c88601c87ae78c3e9cc7d5161af0e6f0d9
SHA512 74d1e06638b9e529bf6c9b7b64a60080cf2bdc2c0fa081e46f1e456dcd2c2cb5641edef5ce4244bb5f458ccd7c53e4a6d356aacaed66732f6ba5c7fb60f0e2fb
SSDEEP 384:nGiFavqMH3sNj8TUNTUlI4aZTPVV8Owf3YQA+I+x+gqNVrN1k+5vI+Z2:tFayk3awgFjMY/+dYgqD8
TLSH
T1A9C22975E8A8CEB7EDE79FD9B70A7603DEE0526785880AD4DAD85E0D00872DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 90c2f14cb5f7a2b238c1a8d4a2838d15f548af98f6ec4e31e97fae445bcabc05
MD5 bc91cd473e0fb8b48eb3f15089f5bcfb
SHA1 9b7da4b000fe4616ae8f672ed0e66e68caa1e5bf
SHA512 54b2f548d082a92192f42f7676bfd95109638daf5937d0bf022d79ea74c168b0b57a09bc50c8fd4bcae119ab9b6c8708d610e0dc518d20e0ea551fa0ba8ce2fb
SSDEEP 384:nlqiFJjccCs+Bt0S3j3sNj8TUNTUlI4aZTPUV8Owf3YQA+I+xvg+uMwCn7q/JrNG:fFJccQD3awgFcMY/+dFg+2A7q/tox
TLSH
T1B1C24A75E8A4DEBBEDE78ED9B31A7703AFE04263968819D4D9C84E1D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a6793e317bcabb82c11c2c194e5c3e4f724782ee0203aec4ed9ce94ce341fadb
MD5 ce1d30afb7a2caab8bca52285587639a
SHA1 c2c62cd16373cde451b1a72b6b9df7fd79536744
SHA512 86d2be99dd7addb26892f9088b37aeef4d9c879bdcd58df62017ed863475139cd68b1e437bd0416c26aaa2fc8d3711ec56dbebdb3309cb5172e3dca0b8a96830
SSDEEP 384:nlZiFJjccCs+Bt0S3Nf3sNj8TUNTUlI4aZTPUV8Owf3YQA+I+xNg+uMwCn7q/Jrg:yFJccQp3awgFcMY/+dTg+2A7q/tox
TLSH
T194D24A76E8A4DEB7EDE78ED9B31A7703AEE04263968819D4D9C84E5D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8694c896841900302f9c05c66deb3b8f2b57c3f568b9df281dbd7a3930a52377
MD5 82bb500cdb78fada528d26299ef5ccce
SHA1 2ffeb518c53b844934980e7c6e11f5bea3777412
SHA512 00839cc0aa04db1129b4612aedc18fc89c238d2040f27960d3ca95f38c7151c37323537a4a9b2d28f0383e629948a4dcb3399590b325527bf852688a8a3ca658
TLSH
T1A7411558B6FD1144B3B76F5AAFF2A86E887B79772F0AC45E00110E4F0626A40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads