4f849e374fdbcf5e6f5be5b1b16cccd614049eb085e4ea8eac604ae4a6c8ef29

Analysis

max time kernel
148s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 57KB
Sample260518-2gpgbsdw41
SHA256 4f849e374fdbcf5e6f5be5b1b16cccd614049eb085e4ea8eac604ae4a6c8ef29
MD5 9c42619ad47c7bcf4a1990695c268a65
SHA1 e0d5cca72f0cb39ee482da8b9960ff424d20ce5a
SHA512 be770f0073df4f7c9b0dea9913721d8099d5a1c38d1e907eeca6ab9ee79577df176e6bc7cf7a045fcaee28b08457cf080367f604b7b971c8f1f9e8ff0cfddb99
SSDEEP 768:a/yvV72MqMZRfmzOt26Ws/g36Or9v96AgtWGyvV72MqgZRfZtWL/g36Or9v96AGk:a/akfxOeHfx0e
TLSH
T15643CC6CA62C1EC44E698EE11DA162B16A1E036F8749F70CC3A7C774B52C0EDED51D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237183737329332"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{F023C5C1-7B88-482A-A0F3-1C5BB1751837}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2416	4500	msedge.exe	79
PID 4500 wrote to memory of 5968	4500	msedge.exe	80
PID 4500 wrote to memory of 3756	4500	msedge.exe	81
PID 4500 wrote to memory of 3756	4500	msedge.exe	81
PID 4500 wrote to memory of 3756	4500	msedge.exe	81
PID 4500 wrote to memory of 3200	4500	msedge.exe	82
PID 4500 wrote to memory of 3200	4500	msedge.exe	82
PID 4500 wrote to memory of 5588	4500	msedge.exe	83
PID 4500 wrote to memory of 5588	4500	msedge.exe	83
PID 4500 wrote to memory of 5588	4500	msedge.exe	83
PID 4500 wrote to memory of 4468	4500	msedge.exe	84
PID 4500 wrote to memory of 4468	4500	msedge.exe	84
PID 4500 wrote to memory of 4468	4500	msedge.exe	84
PID 4500 wrote to memory of 1244	4500	msedge.exe	87
PID 4500 wrote to memory of 1368	4500	msedge.exe	88
PID 4500 wrote to memory of 1244	4500	msedge.exe	87
PID 4500 wrote to memory of 1368	4500	msedge.exe	88
PID 4500 wrote to memory of 4164	4500	msedge.exe	89
PID 4500 wrote to memory of 5664	4500	msedge.exe	91
PID 4164 wrote to memory of 5584	4164	msedge.exe	92
PID 4500 wrote to memory of 2640	4500	msedge.exe	95
PID 4500 wrote to memory of 5392	4500	msedge.exe	96
PID 4500 wrote to memory of 1200	4500	msedge.exe	97
PID 4500 wrote to memory of 3408	4500	msedge.exe	98
PID 4500 wrote to memory of 3408	4500	msedge.exe	98
PID 4500 wrote to memory of 3220	4500	msedge.exe	101
PID 4500 wrote to memory of 3220	4500	msedge.exe	101
PID 4500 wrote to memory of 4876	4500	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffe1f85c188,0x7ffe1f85c194,0x7ffe1f85c1a0
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4743157416697025922,9528604328258695681,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16969275745040686002,3728011662067915374,262144 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,17447788646505512814,5478786320434507676,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,7671239395905234963,11874787540145490984,2097152 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,2499746990655128857,7425779438279982038,2097152 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11082275850679723805,7663858600761777578,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16666515745252327779,9201640698914795639,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,14063336897663150048,5015827019442896382,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7463023914679275585,12342171901026004348,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7463023914679275585,12342171901026004348,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,14744739853530864163,13183016099887633943,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,14533758917187101950,10774605862323222278,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,11600851027199759052,7741073747746813453,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4395436428100573103,1189696778230680000,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,16965294989956230791,6720631382164555816,524288 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5872,i,2886093388578987596,14905607030640395608,262144 --field-trial-handle=2148,i,16364307576269181645,9384203589537809216,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:10
  2⤵
  PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e8e058512af3f759dce83c833a66dd3f53f31ce898eb0ce8158d59155a3b7e35
MD5 ae9a07966bcddbaf727d2582dc20d302
SHA1 e83b59b1a453277338ddad6e4a26855fa8876034
SHA512 8bba1c4a8a1eebb6fff27a34127fdbd91a8979a5d8f56856dd06466a03cc753dbf26dd470a8abc3f665fd35ab6b277b5192e0b310f98bd18a27013a3035522e9
TLSH
T13A41C0F783E4866E8A0195F0AB19AF2FCE2D0515432C3D5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 241bf0251d8afc966d47558188334251d764bc4189226bb03db6214e4e209508
MD5 cc3d49a83d23d350246aca2dbdf93b4d
SHA1 976d6c732adddd34b6fdf9996c6c99c8101d4bea
SHA512 8343dcb9b12bb2ba352a220f8f8a6e46cac0f5701b533a32b117a8d85b5e980283c1ce7de798cff75f6018fd0ad91da8202ea35ee698d1afb2d0623b4abb9a44
SSDEEP 192:sxZeR8yMqZjK1Ml8UQCF+/fZs96nFKQ7PgYssa0czodpE9/W6+WNGY0Z66F8Ig5E:sxZetqI+/fZsEFV7orsa0/E/bG53myLv
TLSH
T191620716A63849778CDBD219FA957B93D7F9157391804E44AAFCCB1C04E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b71c88a225949e4f457d9db1a39dedd7d18ca1172d0e400b95232ef2ae31e8c7
MD5 9bf44d0bac00f9a214c73e5d096dbd6f
SHA1 440989047ac6e337c3fab82c6e86880fbc9de2d5
SHA512 a3ce15368788323d5e7c6435ebf69facb37118ef26d2a4767084b20d8a2d40f54788c14c93ba2e92c99038b5f7ac72edcc4e08609390225f39dba616c36eed38
SSDEEP 192:sxZeR8yMqZjK1Ml8MF+/fZs/6nyKQ7PgYssa0czodpE9/W6+WNGY0Zk6F8IgjJLe:sxZetd+/fZsyyV7orsa0/E/bG55mjJLe
TLSH
T18662F806663859778CCBD319FA457B93D7F9167392904E04AAFCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 eaa746be908afb17591ce1d6a7726a6ec3792547b305038ed6a9cdd92cfc44bc
MD5 eb0e903feaac8b25aef1748c431a1a5f
SHA1 1105cc0b16371c1270af5a95492bafc8492d2f8e
SHA512 5993e842c037da08f8c4637c4d711f672fedea0d96e44a1bfa0baea1a075d15703a98e8f664cefb03f8e3c26d09e1ce58c08cda54d5653ec4dd3acfcb27912b8
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3gGq9LlT:XwZh38Dv2SkEnZFWRm6GQFmu1jaKgGqz
TLSH
T159030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a04e098265c717c1f815eb74a2b6f69d1e8a9caad374d505f948ab85611a60c7
MD5 bda161896fc1a58876e568a33e6fe3ea
SHA1 e61e7d9488609cb6daa773b6352ee22752c85a46
SHA512 cd2802f622fe85945cdc6176489fbe6c5185f82239cd73b6de3299efbf2761f08b033e993c60f497bd3e3974b90be92ab0ff4059e6b94b3377148b846e18f9ae
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlxhqVExFzH7m36J9pZZo:ctGj+BCNC5qFVpKxxp6
TLSH
T150B28C1632BA02023C3DB91D87A597375A42B1A33418E93B7FE854B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0dddd3260c3a4867d14bfdf681eb0adf7f58abcf3622d063e5d0b9879150a37d
MD5 40969fe1e04e0d5edcf0cf9ad5b19b92
SHA1 01cba25bd4e5978a8ee3ec5c8ba481ec46223ca1
SHA512 c6b136fcd85c7fbde7d3c15b91b2f49ae8a6813b47a37ea783dde3ba77097ea7bc7f3601db3fc9913b80b900d0483a6adb6183ae379843b99532cedfa641a037
SSDEEP 384:n6iFzCcmyWCq38Nq58TUNTUlIR3Drk6h9j1zCfbLokITX05tz772PCdnlIx3bty6:xFGcpq3T5wg++1OoR70f772adnlyWjWn
TLSH
T1F7F2A3F198DB9A73E89E4B97A77D2D029AFCD15375884984FB940D0CCC4A1BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 49939e9f3d44219ed6a81c12d545109377eda06750007bb3166c9f70c9b4c2d7
MD5 c5c5382a56c2e4cbb825534946a9bf6b
SHA1 2fcdae52fca9f202bb82477c2daa86798db7893e
SHA512 576d537cedde4ce62a40761c6d71b82b2e6c515b1f57ea4641ede0b98e7201f1360e374b0ea2a21befadedf352848000178a3dbb2e4fff71a35860f14e57a4c1
SSDEEP 384:npiF9CcmyWCs38NB8TUNTUlIx0HOrk6oLrF1zCfbLokI4Sle4KV8p0kVty/7IgU:AFccps3CwgqHFfrzOoR4SlI8p0kt
TLSH
T1BDC25B36EC68DAB7EDE74FA8F74E7603DED0116785889AD8DAD81D0D008B19D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ae1677ff35b1d327b4460d2a732aadf309ac0fbf288ccc64d12a3457dfd9d534
MD5 74e9fa674a48daec807a7c9357f27105
SHA1 1ca1a03c8ada087803bb90bbbd23a6a596754245
SHA512 911385031067f7588e8579d9e1d58c28d7fda73113bbeb16110feda57e7703499656f72838a01e4cd1cc4aa4ddbbd14e892f31386e8a5f4779c9cb5c1ef963d1
SSDEEP 384:nOiFzCcmyWCj38Nq58TUNTUlIR3Drk6hrj1zCfbLokITX05tH7P2PCdnlIx3bty6:lFGcpj3T5wg+U1OoR7077P2adnlyWjWn
TLSH
T140D25B76D868DEA7ECE74F99E75E3643DEE0516786888AD4DED80D1C008B1DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c8733a734037608a8c7f9e147dba40a4faf3fbdaf8a9a93708f2d0108066d0f3
MD5 10047de889c10797ee1a9feaa2f1b0b0
SHA1 8454984f3afca238ff8a4d273f0b00a87bc90cdf
SHA512 c0341c70171ff6ae8f359e4812d4ff1274a994fba401495d684967219b2c056af86e492eab317b266594f9926a5d4426bdba9002eb769d8bed6f762e97be44f5
SSDEEP 384:nOiF9CcmyWCz38Nq58TUNTUlIRLrk6krj1zCfbLokITX05tH7P2tzBty/7Igl:lFccpz3T5wgSD1OoR7077P2t+
TLSH
T104C24936EC68DEA7EDE74FD9F64E7643DEE011A785889AD4DAD80D1C008B19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 af4eee08b9ddf7a3bccda4abf3037b911493802249492492b9e56187b7b9a5d1
MD5 5d8b44a678a0d219a4260fa0d50ab6c6
SHA1 3816d8b35b10bc1a95285bda2a7a2aed0515d0c9
SHA512 6090a4190284bbc478560cf091adacb0047dc26377ccc64f402c4279aaa76803f6a835d716e7c72a641e3d688bc3b92caf9b278f72622d89c5acb70548a4a61d
SSDEEP 384:npiFzCcmyWCj38Nq58TUNTUlIR3Drk6hrj1zCfbLokITX05tH7P2PCdnlIx3bty6:AFGcpj3T5wg+U1OoR7077P2adnlyWjWn
TLSH
T186D24B76D868DAA7ECE74F99E75E3643DEE0516786888AD4DED80D1C008B1DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c9764740e2f4c33b84cda5aaaaab62ed7592c41584b9eeacbfe8221e5f3e31b
MD5 50f9f73222fe38fc2d58ffa519fdb3f5
SHA1 6a036891fa9874dc297593786e8990a442209f45
SHA512 83eb35725b04bebee4bd90ab6fb3f840a46a9a8dcc749f211b5f66b321defd5ebfddd7ab4894fbbd5a76b1123ee1cef87057c5c69d2b18f59270572547624baa
TLSH
T13E516FE04C7D6AC1D4BD0E6F60CB34FC82E8D625F5A0347D2868EA950A7962C74C583F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5664-166-0x000001B800000000-0x000001B801000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads