dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee

Analysis

max time kernel
58s
max time network
44s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Matcha External/Matcha External.exe
Size 146KB
Sample260627-c5ppkahs2k
SHA256 dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee
MD5 301a5357ec4151273a737a57a211c7a5
SHA1 482fe3a0f2e701c69f40134e71faf5c134cd1fae
SHA512 db8bef0960722e0372e1af2eb8057ba7640dc140d5710f301c2896d997fb1222c645e0b3b7a5a138b8a0fd4a1a316cc71f305b9a9170d728a4851f2abfd76d89
SSDEEP 3072:QhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuGEL/:QhK4XycqgpfCup5sVxuZ04uhAD/
TLSH
T194E34A43B2AC00FDE1BBA3788AA21906F7767859477197CF0390C56A1F67BD09E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270017101598604"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3839916939-1319118069-2256772647-1000\{96666BC5-52EE-4B1E-B423-70BC6A0BE8AD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5024	msedge.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 5024	5708	Matcha External.exe	91
PID 5024 wrote to memory of 6404	5024	msedge.exe	92
PID 5024 wrote to memory of 7084	5024	msedge.exe	93
PID 5024 wrote to memory of 2260	5024	msedge.exe	94
PID 5024 wrote to memory of 7084	5024	msedge.exe	93
PID 5024 wrote to memory of 7084	5024	msedge.exe	93
PID 5024 wrote to memory of 4708	5024	msedge.exe	95
PID 5024 wrote to memory of 4708	5024	msedge.exe	95
PID 5024 wrote to memory of 2192	5024	msedge.exe	97
PID 5024 wrote to memory of 3444	5024	msedge.exe	98
PID 5024 wrote to memory of 2192	5024	msedge.exe	97
PID 5024 wrote to memory of 2192	5024	msedge.exe	97
PID 5024 wrote to memory of 3444	5024	msedge.exe	98
PID 5024 wrote to memory of 3444	5024	msedge.exe	98
PID 5024 wrote to memory of 2780	5024	msedge.exe	99
PID 5024 wrote to memory of 2784	5024	msedge.exe	100
PID 5024 wrote to memory of 2780	5024	msedge.exe	99
PID 5024 wrote to memory of 2784	5024	msedge.exe	100
PID 5024 wrote to memory of 4320	5024	msedge.exe	102
PID 5024 wrote to memory of 568	5024	msedge.exe	106
PID 5024 wrote to memory of 4700	5024	msedge.exe	107
PID 5024 wrote to memory of 5520	5024	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\Matcha External\Matcha External.exe
"C:\Users\Admin\AppData\Local\Temp\Matcha External\Matcha External.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependecies
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffec508c188,0x7ffec508c194,0x7ffec508c1a0
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,11149770909111538155,3090165378024962311,262144 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:2
    3⤵
    PID:7084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,429683472156751716,16732591721215417677,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,2058562780367018686,6708402228558132418,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,5559798098280407363,16312103269122507317,2097152 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,12112380294553857705,8743521042806025413,2097152 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,9894446665113684263,15572733133439210957,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,9463582764533250198,15741977922374724937,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,4891632256844760899,3359871678066619054,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,4891632256844760899,3359871678066619054,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,14321088959593552070,10902938699452970171,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16097202361299904944,13241007500468267192,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,569246152596781127,16421957018921239230,524288 --field-trial-handle=3028,i,2153280202446614067,9046950002128713019,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83748c5f59c12f467f96b0d21c3c9653419dfd0271c8efbdeebbd6ba4bd7548e
MD5 96bfca4318642edfa521d002be0f096d
SHA1 447f1b34ddedc860a8f0bd0c6dc12c229624acab
SHA512 b49889400d8441bd0f61eebe0a2489d48e83671a4d77bfdef519545878aebce5aa04d5e498b1e16dc02fc2a5990edce5232840f2805bd3cf047ef33c92fa70f4
TLSH
T112D080277919E851C0561171583DC779561941473EE6C20F79D5F04ED8D645073D7543
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f955c8d6f1a1a3190d5e321035e28ca582fcb76ec2f60d653e90465ff9d1ea00
MD5 0213e77255f07e9c3fc2c451f7a980eb
SHA1 a625e805f5575150fe89058ebdc7b3356ff294ad
SHA512 94f5a80a660d01988274953f2dc96b3f630595c4d1011e0137458475b3b6bda55410996e5d95fff27f7dfa7d3bf4ad111036266eb70344bc4183986e8f524b78
TLSH
T1BBD080277919E851C05611315C39C7795619414B3EE5C20F75D5E04ED8D645063D7547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9cbd17984647e895eb8abfbfeb7e84d0be0de87b17351d22cf776e1dc91e7a8f
MD5 84e136f548f477127380e9b8580e7f2b
SHA1 78071da01bd97267769ae4dbaae8a6daea926539
SHA512 d8a2a4f58577d5396d93aad31ab32e287d174d3124d2fc8c4ae6c142d9a64e9cd6dd1fab1228318586be74b81e6c2631f1cfca9f5ad1a20b4f660005755c52e3
TLSH
T1A0F0F4AAC921AC3708FD4B2824A45B47EB5113672B40894B3E3D860D8FB1B3B869681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1577bf3d6250d945d6e00367bd00895fbc28fbf6794e9ea5fdf0423173ce7c74
MD5 721e6a1c99fe983a05dbc5da2ce419a3
SHA1 06be6d708c3f765923e1d4909c786c8ab5845078
SHA512 a58525efba92705e894de46be8fee0142db5f43e6ce4adf92aaf96623e892a825b78c40c94e231fa6bd167d37ebca2a57fab00b587b781ae5146bde71843a22b
TLSH
T14C71B5751C962D35DB7D93F961E3289A37782C0236CB7DA57095083CABAAFC0944279C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d2db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d2db.TMP
Size 3KB
SHA256 fd4c93e53dcc87853acae5ad6fe0dbf040290408622093575169794e1d58f8eb
MD5 0c70be059b95ff48a38ccc45831b084b
SHA1 1dfcef08da74118553e52ecc1f300c9242fbbd6e
SHA512 818ab1ce0ad4899e7f48dabfea31fdb27e5e75bc9a82151317bc494f8c0ade7add7de84bf2f65b53d5cc07363d2161877651c2ee69bb103d2e4e60e27f984be8
TLSH
T16271B5751C961D35DBBD93F961E3289A37782C0236CB7DA57095083C9BAAFC0944279C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8326c21ed32d355027447c372f499e1ca55375b0b3d758a8c81a03282c36440c
MD5 987e1a64a31ef61bbdfcad7ceddfb6cf
SHA1 3458136f31027f88df45a6ccef15504372469d0e
SHA512 3748c337e1d97e4c55b397c3d6627103111e517faff778f51dd0482c220f405464b597c5fe28cbec20f281c21cb72ca8d6d0da6e3fe14576681447d2c5a593d9
SSDEEP 192:sxRHRJyMqZjK1Ml8wcL/f2sKWd4PZbTUImA9zoA8ptf/g6+WNs5An/Yz9U+jlGJY:sxRHGCL/f2sKWd4RbgIul/5sK/x4Kj0
TLSH
T1DB72DA166934597B8CDBD219FA55BFA3D7F81563F6804E44AAFC8A0C04E7ADD210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d26eee45bcce2d69b372d7f5b7ccbc491c7336eaffaf6ad538cbc70e34d281b7
MD5 c9618a54a7f40ba120e3dc593b124a55
SHA1 d7aac43b8d3ff66c4cecfdedacc1179124d6d319
SHA512 b0552cf2d59bc86bac3d29d3bbf11e53e9e87efcd7b0774d236309c133e400c57f5690caf4ba83034966b88a9de5cf9050a20876f2363233fde6f37507a08e4b
SSDEEP 768:BawEPU7pLuL7IlWgfDfEN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeqYLfaDro68Inj:BawEPYE7IlWgfDfENu1jaVqYbaw68IsU
TLSH
T137E2EC3B680CC77E4F444E9CEC29BE9A6DE801CF96D88D5447EA440C03C6BEB51165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9eb6b832a11f7fcf1e9fd8af0f4aa6f0b95c7b1307734f6fa482cbf3415259c2
MD5 a220dc04a93d4e2536ece363810ba4c6
SHA1 d13d8c7ee2a8c40cbe6fb992555c1ef27580ab90
SHA512 96bb93084acf2613f7c07b7f0a600c4bc617dc36b89e2291e52ef702ff409712c661d438fe3250ded24db619ecfda65a92465e6671def6666be2a5da5b614ddb
SSDEEP 384:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwJbBRrn+gI4XIj++OT48TWe7sePAD8:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwl
TLSH
T1A2B23A15393E234138BE2908E1A5965F674230F3301AA63B3BBD64E60E67E015FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c442f300d69137e25335f5f1d36cd7b4efe7791d292b4b3110ff727c862f6579
MD5 772a13c03d1696ac4b3c96d285c2896d
SHA1 e21fbfffe9a271dc621bfdb8396a2729a83a64ed
SHA512 ff080f9fe89fe3a4f9f9afe7eb1a4436c9c8669469bd72fc9a5f00dc0aee5244437b78a8e668382048f4e67d1a9477333aea6b67125f2229554871b0491c92af
SSDEEP 384:n+iF1tNn/s3n9S18NhA8TUNTUlIRXhESun4kTCfxVzV5YNKyb6YNoXiY+mn15wbi:VF1j+9QrwgHEwXVzY3hyb+mn12bfTm
TLSH
T167D25C32D865CE67ACE78BD9B34E7687EEE011A3858C59D8DAD85E4C01C72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ff40d289657f7ce15857e174b1b13db0b3cbc5cbb225af17da362a2e8ad5f166
MD5 f6e4a3d055c3c4604880f9df9743d5a6
SHA1 e2d036cda972b556e957f40b387ee5fc510ae7ba
SHA512 8be64b67801ba1285cda978f69040b7c2a51379e78bc43736f7ae7f600ce7727168ac2418103852b5b4123dca99269e7388b135590bcdfa8daf3d7b139d2e4b4
SSDEEP 384:niiF1tNn/s3n9SM8NN8TUNTUlIRshESurpxTCfxVzV5YNKyb6YsEITGT0ILu58LQ:pF1j+9lQwgIENqVzY3hsEi+073vf
TLSH
T195C24B32DCA4DA77DDEA8FD5B709764BAEF001A785D859C8DAD81D4C00972DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9093ab5fec0c198ef30aee5fbdf1c6e52c74f27f9c2a8f0b764061d9e6c59936
MD5 85c03e0fe0125970b1dbb183eccfe6f0
SHA1 439e4ea4a3afcda166cdccdbfd65ae12187c1378
SHA512 d49c7443a523dc7eeddb379b5384b91a5b476f5b8806fb224db1a5332679c885ed69f91247afd71734b24d35bc9a7e55217cb6be221ea739ee0104db8cbb8370
SSDEEP 384:nDiF1tNn/s3n9S18NhA8TUNTUlIRXhESup4kTCfxVzV5YNKyb6YNoXiY+mn15wbi:uF1j+9QrwgHECXVzY3hyb+mn12bfTm
TLSH
T130D25C32D865CE67ACE78BD9B34E7687EEE011A3858C59D8DAD85E4C01C72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads