2c497770ca9f02bfdf56c050566af640e24c31b214007761683ab5a89f301373

Analysis

user interaction
yes
max time kernel
29s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BestSign.xlsx
Size 26B
Sample260511-s6s2dahs2q
SHA256 2c497770ca9f02bfdf56c050566af640e24c31b214007761683ab5a89f301373
MD5 99b0c3cdbf0bbb670c88531715f2ce86
SHA1 4476f666bd545e89a58f06275a35550dc9e1cd0e
SHA512 b74a8945530654e380bd0c867dec5b5a9e2eefad899f1ea3a37a6e1128293e6d729394bcad7c0178f764bb9c9ae101afd8164b800b7493332488d8838c844e9b
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229879169738880"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-636600838-1632888396-3521553955-1000\{E9F90F6D-8A11-4301-9688-3416D867510F}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3488	EXCEL.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4544	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE
3488	EXCEL.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4544	3488	EXCEL.EXE	90
PID 4544 wrote to memory of 1900	4544	msedge.exe	91
PID 4544 wrote to memory of 4896	4544	msedge.exe	92
PID 4544 wrote to memory of 2668	4544	msedge.exe	93
PID 4544 wrote to memory of 2668	4544	msedge.exe	93
PID 4544 wrote to memory of 2668	4544	msedge.exe	93
PID 4544 wrote to memory of 2232	4544	msedge.exe	95
PID 4544 wrote to memory of 2232	4544	msedge.exe	95
PID 4544 wrote to memory of 5304	4544	msedge.exe	96
PID 4544 wrote to memory of 5304	4544	msedge.exe	96
PID 4544 wrote to memory of 5304	4544	msedge.exe	96
PID 4544 wrote to memory of 1884	4544	msedge.exe	97
PID 4544 wrote to memory of 1884	4544	msedge.exe	97
PID 4544 wrote to memory of 1884	4544	msedge.exe	97
PID 4544 wrote to memory of 836	4544	msedge.exe	101
PID 4544 wrote to memory of 836	4544	msedge.exe	101
PID 4544 wrote to memory of 836	4544	msedge.exe	101
PID 4544 wrote to memory of 3168	4544	msedge.exe	102
PID 4544 wrote to memory of 3168	4544	msedge.exe	102
PID 4544 wrote to memory of 3852	4544	msedge.exe	103
PID 4544 wrote to memory of 3852	4544	msedge.exe	103
PID 4544 wrote to memory of 4432	4544	msedge.exe	106
PID 4544 wrote to memory of 5628	4544	msedge.exe	107
PID 4544 wrote to memory of 5628	4544	msedge.exe	107

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BestSign.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://officeredir.microsoft.com/r/rlidUNLGenuine?LCID=1033&MSG=2&PID=00414-50000-00000-AA267
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ff91340f208,0x7ff91340f214,0x7ff91340f220
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2360,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4936,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5228,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5200,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5680,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5680,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6028,i,7683081651152347653,9509437111739350251,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6847da93c0e8ba021039564b54e5b8340cfaebcc9903f353104c8db5eacedd99
MD5 57f6bebc822399bdddb50e79e5e43cce
SHA1 26bba59f93dcea4a564377885d4b44e85026706a
SHA512 c8f32f6c3d308532cb7953bfb3f9c63c9aee15eb26fd3f5104b23bbd976262872dd5f21342f2cd6757548b0e93d5779445f26edd82a2234a9f3c9577091b6330
TLSH
T12FD0A7D16B98C902F4415C31467AA5623F06E660A40A9361655005483815BDD6DD91BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 61416443bb2670514b24162383a5e939e62c336fe129778dd62f92e247061f4c
MD5 a6a0f0bc60d66fd1ec5145383f72ea91
SHA1 1da88b944a212374a51f5de9258f4237fd8d141e
SHA512 236028f652decc847b8eeb8ee5c51539102b33f318f5c1bc4b441bd751c1d775f36252bd40c462b73571edfeea689b532f0967c6696a428091a0c5288b8b9d83
TLSH
T18571190C4381A261CB4879FD9FD53D02FEBD6ED8832FCF260F9981786E263AA4207505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe57b779.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57b779.TMP
Size 3KB
SHA256 3b384265fa19515326f1c452d0f49073dcaa7135bf3ca9bf8152eba1dfc8b709
MD5 c1b8ac8565d4cfc31946e18162ff556f
SHA1 bb094a1329ffd094f698abda64f7f820f01a562c
SHA512 ebb142bcf650e1a4893b6481c8ddc2c77ab27005903ce6bcc27a691c2b5812d920a3e49be19f7e071e49384212095ce0d20bc65eafd9dd29cf1f4165f0957d4e
TLSH
T16861090D03068266C75978FDEFD53D02FE7D6ED8836FDE260F988570AE2632A8607401
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ee1b6b415c3cd22866f2764374fcbc71b311b0c6ec4eef9f0faee098e5ca7ac3
MD5 843381d1fec2f1f1c731a9a632504ec8
SHA1 4dc10a92459e3d9e6c4c98663fd53018a156c9e7
SHA512 504ee8e249f5007454972f4e8c8e5d02104133cf8fabb01ff622f382346fd3e9bc973e8c674917f926d8731ad3544d2f63f430cce45e95f19d0d72f9355f3bd5
SSDEEP 192:sViRryMqv/Ky0hl8MEQ1sRnq90ILWn5zszToZ8pYKzHY+WNnuxIAvrwYxrzr7tg2:sViW+sQ1sRnno1HS/UwUHSA7
TLSH
T10372DA196968897B8CD7D119FA957F53D7F81163D2409E48AAFCCA0C04E7AED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f6fc3904e2b6d0f4a10b84d381abcb9d6734b39806d37e5076255d048d183596
MD5 d7a9ef90a20a737543c466722203b501
SHA1 deed5cbab7f7a6b2085d7d3feeff355f5aa82f39
SHA512 1aacc35cdddd5ac4bad69ed5c4fa5006ab74afa1ed2deb4f281f3c7bcfcd80dd553598358dcb2700cfa32fde3e194d546af46ec312ade42f3fa3e2edb17f4d9e
SSDEEP 192:sViRryMqv/Ky0hl8MgQ1sRnq90ILWn5zszToZ8pYKzHY+WNnuxIAvrwYxvzr7tgP:sViW+IQ1sRnno1HS/UwkHSAC
TLSH
T17B72C919B968497B8CD7D119F991BF53D7F81163D2509E48AAFCCA1C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 6bd5cd7435858bd7fa3535475e25db1c4aabee7b2c36c706b71dbd8bbf5ce14d
MD5 091c272df80b48272ce97447ad902c7e
SHA1 fe4e6f14ffb72a224b331aa342c6f538ce391d02
SHA512 8c87754e862af949c6adc644283c657c47af2521685f13b8a1e7d3e7bab92369c3ec6ff9dc9f676b280ead5d72a89ffa37d3dcb7fb64fd8310fcd1948cfb2151
SSDEEP 768:i+ZzfS17pLuLzdXWFC6SS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDyZBLlcSqI9ro9:i+ZzfSDEzdXWFC6SSu1jaMyZBLa9I2OU
TLSH
T1B5F2FA3B6C4CCB7E4F844E9CEC2EBE9A6DD8028F9698895447F9841C02C66EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 42485845d4b9cdd8ad892b17fce149a6a4424a907fcfacef2bc123bfa497e34a
MD5 652c3afaf20d6836994ebccef13627b8
SHA1 a2db950d02cca07048169422a7b6b0f00dc6cbbf
SHA512 845de83f88a9948eb5587a55cee3132a8aa1b6001f083e41ec9a1134688ae96ea759dc40d9724837c262939d05f788775510d2bbe2d0a524704871a422308bf4
SSDEEP 192:rgUjO6cGG3y9GiQa88lSbkG0bEkcT/gjfpJZ+xyvvndVnK9KfbwD0PD1NdqtGjD/:D
TLSH
T1C6A26C25717B664478BD695E21B8926EC24220B32011F57F3AE874E68F67E302DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 072a838b95eede13e4c2d338dd9673eb64636034e4e55fc6cbf05f15c45349a1
MD5 b6f9c15eefccf3733fe56beea96c480a
SHA1 38c399e71c3a9d46da87e991900ae7dc6ad571bf
SHA512 4cc8bd57c695cfbe507545735b7b3eec10c9d1afa4a420da75578bd10fa9e1b678bd8166a00e795961934a6ecd7ec09930736584ee26401bed3581333c33a568
SSDEEP 768:oFPE6esE8lDldUGi3uCgQERViLcj1HwYC0R1jRdE18l44:ieB85dq3LEblRL5dE1e
TLSH
T16B03AE36E898C9B39CDB8A55E70A3A576EF45263D64C47C4EAC85E0F10CB0AD730BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7f3fa668d44ca177d3994b06778338785dd07614379a3b494a02fe0b2340086c
MD5 ddf15f29a46aa8afdb1d138c9aee0e24
SHA1 e5202187871d839d787d9d1472b54bb539406dae
SHA512 db414f065f6b6530d3e13396b056d43b5b88e2fb3e6f8727fa753305a5f9d27d8dfae94cd27d22e83d8427464a8b8eaedecd32f97c99ec0eaf651c6e8bd9a4db
SSDEEP 768:oFiE6esE8lDldUGz3uCgQER7iLcj1HwYC0R1jRdE18l44:ZeB85d73LEBlRL5dE1e
TLSH
T13803AF36E894C9B39CDB8A55E70A3A576EE45263D64C47C4DAC85E0F20CF0AD734BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9250a6ddc40e3dbe51ad595eeffaf44b8f63dec5b3cf95d047f4fc9ac8ab51ad
MD5 80f89e874edf970453866b85706b786f
SHA1 fc57f1764da5d26210597ac58d1d5d574eb36a51
SHA512 56edb456400ee806137bb6df82968f7e501875fe81c8f6e49560e7b5a379711422cce3bf909ef6bbf74d94737a42788fa84247d952f0a2788eb5a242eaaffbcc
SSDEEP 768:iFiE6esE8lDldUGz3rCgOvHmcj1HwYC0R1jRdE1M44:DeB85d73S/RL5dE1I
TLSH
T12A03AE36E898C8B79C8B8E55E70A3A176EE44263D64C47C4DAC85E0F20CF0AD734BC59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac32e468-c368-4e5a-aa07-c811477289aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac32e468-c368-4e5a-aa07-c811477289aa.tmp
Size 38KB
SHA256 b48d2b0450ecf920b28179c8341bff4a3f46d25eaae73e3589e7e36feb143c73
MD5 1abd39a3c3459de8825b8540dafdf164
SHA1 5805315fb402058f254a1d439afa06e9a5a6b4f9
SHA512 8becf39b76ac009e5ead5f392545a27b872399097c5024d07d2ab4ec55305ecb5a8a7adf9c92c2594184e7115bae4e9d04affc70234bfb00b718589c4f42bab4
SSDEEP 768:nFiE6esE8lDldUGz3rCgOcHZcj1Hw7UNKA+E7QJ1jRdE1M44:2eB85d73tGwfEcxdE1I
TLSH
T14F037D35D898CCE74C9ACAC4930AB9276DE04277D64C5BC8D6E86D2E308F1BD634B859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 5947d9d6de7f79f59df5f52329710071b912f07fdc167ab18d4f79e980308248
MD5 fad819ca9f8159d33e2ff1d785853904
SHA1 8f0b16091b6fc818966260220c4341af77e7424b
SHA512 464f86698c7c0dd20a155ffa34685d901eb3e22025622d8995a965ee14b880e0ca9d2dc7d6836528483df044b0accf7f8afc6645268860b59f4b6d6d3adce04d
TLSH
T12C413B58B7ED1048B3B76F5AABF2A86E457ABD772F06D54E10110D4E4A62B00C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 8f53fcb9dccbb2f02f5477413953aa92156931ed7e8fba3fbdffe1b7c7c9f44b
MD5 e322945ab79b3385ba6a09b82e70847c
SHA1 52c9ca804c234265ce7f8eaa70348cc5c7c4cb52
SHA512 fe5995621f8a4e213f25bcb03892dc9f56329f1464c80bff97e764e4deeff7ce671e4a9f32f6ab3d637716c3b674fe23447d34577270c1dcfd7922f8c9ffa3e1
TLSH
T178516C6C76E91048B3B37E19AFF6A9AE987B78333A06D45E10110E4F0633A40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 474049fc382846a735c8ba09d3f842413c48bc6d741b8caa9146dc213e673d53
MD5 d4750028566a48d4ffc4281b39d4d496
SHA1 15c1a0139b96953ae0ccef6cd99ef8615aa31def
SHA512 17269ddd82f6b31fdd6dcecaf04c9881695b0dcb6d2a06023dfff56e085d2bd95441c288bed001bb821fdf30ba11aac417e6d5b731dc260934064ce88eacfaca
TLSH
T14841095CABE91108B3B76E5AABF7A96D487BB8772F07D45E00110E4F0632A40D8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2068-51-0x00000275C7C00000-0x00000275C7DA1000-memory.dmp

Download

memory/3488-0-0x00007FF8F7770000-0x00007FF8F7780000-memory.dmp

Download

memory/3488-114-0x00007FF9376F0000-0x00007FF9378E5000-memory.dmp

Download

memory/3488-115-0x000001B865060000-0x000001B865201000-memory.dmp

Download

memory/3488-11-0x00007FF8F4EC0000-0x00007FF8F4ED0000-memory.dmp

Download

memory/3488-10-0x00007FF8F4EC0000-0x00007FF8F4ED0000-memory.dmp

Download

memory/3488-7-0x00007FF8F7770000-0x00007FF8F7780000-memory.dmp

Download

memory/3488-8-0x00007FF9376F0000-0x00007FF9378E5000-memory.dmp

Download

memory/3488-144-0x000001B865060000-0x000001B865201000-memory.dmp

Download

memory/3488-9-0x00007FF9376F0000-0x00007FF9378E5000-memory.dmp

Download

memory/3488-5-0x00007FF9376F0000-0x00007FF9378E5000-memory.dmp

Download

memory/3488-6-0x00007FF9376F0000-0x00007FF9378E5000-memory.dmp

Download

memory/3488-4-0x00007FF8F7770000-0x00007FF8F7780000-memory.dmp

Download

memory/3488-3-0x00007FF93778D000-0x00007FF93778E000-memory.dmp

Download

memory/3488-2-0x00007FF8F7770000-0x00007FF8F7780000-memory.dmp

Download

memory/3488-1-0x00007FF8F7770000-0x00007FF8F7780000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads