00ceba3cca57b7ae140f077d6aebb88e172f69b4cc0c8879c5be7f2734a989f8

Analysis

max time kernel
58s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CdiResource/dialog/Graph.html
Size 8KB
Sample260628-e7a1asfs6q
SHA256 00ceba3cca57b7ae140f077d6aebb88e172f69b4cc0c8879c5be7f2734a989f8
MD5 1f2f281f50cdefb6794c9c87133b89fb
SHA1 6aaf495b5eba156f3b6d69395a022251f54e8460
SHA512 c1d8d99104f0dfc0f3417c6c0a2519ab9508aadecc573b6c338614237d6d91ce03825b4b978a3a9a03272759d7d566d1bc7c60b7742b4f83a8ad1b9d943e906b
SSDEEP 96:7KkOs1PJEpKltJtAZ29wi7/3j/Rj5LNscioCIq9Xr9MDoevklwew+K:7CMEpKltJw29wi7t1LNsBojvklwew+K
TLSH
T100024861E4EE0A2E2775274C7DE4AB2AE833909F930AAF41745D187B6F357008C6365F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270950461627930"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{904EE141-6389-4C28-ADA0-B78C24E9F565}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1856	1676	msedge.exe	83
PID 1676 wrote to memory of 1540	1676	msedge.exe	84
PID 1676 wrote to memory of 3324	1676	msedge.exe	85
PID 1676 wrote to memory of 3324	1676	msedge.exe	85
PID 1676 wrote to memory of 3324	1676	msedge.exe	85
PID 1676 wrote to memory of 740	1676	msedge.exe	86
PID 1676 wrote to memory of 740	1676	msedge.exe	86
PID 1676 wrote to memory of 2172	1676	msedge.exe	87
PID 1676 wrote to memory of 2172	1676	msedge.exe	87
PID 1676 wrote to memory of 2172	1676	msedge.exe	87
PID 1676 wrote to memory of 2428	1676	msedge.exe	88
PID 1676 wrote to memory of 2428	1676	msedge.exe	88
PID 1676 wrote to memory of 2428	1676	msedge.exe	88
PID 1676 wrote to memory of 648	1676	msedge.exe	89
PID 1676 wrote to memory of 648	1676	msedge.exe	89
PID 1676 wrote to memory of 3872	1676	msedge.exe	90
PID 1676 wrote to memory of 648	1676	msedge.exe	89
PID 1676 wrote to memory of 3872	1676	msedge.exe	90
PID 1676 wrote to memory of 3872	1676	msedge.exe	90
PID 1676 wrote to memory of 2776	1676	msedge.exe	97
PID 1676 wrote to memory of 1088	1676	msedge.exe	98
PID 1676 wrote to memory of 2776	1676	msedge.exe	97
PID 1676 wrote to memory of 1088	1676	msedge.exe	98
PID 1676 wrote to memory of 4704	1676	msedge.exe	100
PID 1676 wrote to memory of 3516	1676	msedge.exe	112
PID 1676 wrote to memory of 5104	1676	msedge.exe	113
PID 1676 wrote to memory of 2116	1676	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CdiResource\dialog\Graph.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7ffef4a8c188,0x7ffef4a8c194,0x7ffef4a8c1a0
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,3948174568617483237,13591812007823056516,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,11049224757581701528,3180516274510927493,262144 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,4578794357925570045,5469262633776694872,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,15701001692823904019,16288120347500363031,2097152 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16002144152026027739,15444372463549028516,2097152 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,13098421407074138861,17471557160919979015,2097152 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,17123949290842737477,8546893800957454117,2097152 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,13008894713984049258,17669277923441299144,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,5332095992491822827,11049796174724263413,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15516339141694610790,8506435978727363160,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15516339141694610790,8506435978727363160,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,11073204119858067271,15559353457439796725,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,16456542048003734076,16929625669663725141,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,12317411683435833346,18370575924120627291,524288 --field-trial-handle=2348,i,37889262581883828,4099930625647262475,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b7fc5147516a3ce9f22acf48e35b2a2e28e006d77e037ac2db0e73ca7946a7b5
MD5 af9a2a0b63d3ec54d3b478d0a12620bc
SHA1 a4d0970c1ffa396147cea1cd0a3f258b9941dd95
SHA512 5c7f5e9c1b266488e2a333178c88b2dedc4570251e74bada74878d02b5f4296ea5a2fb8c8a778b1832db31c4fa4fce004bcb9e02c6b04c743f2a9965393255be
TLSH
T1E471F659334288B6EFD6013DCCE206C17AB1B299895B0EAA15B09F7E37CC72F0C2048C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb7b.TMP
Size 3KB
SHA256 d008d67a9f02cae0608b0d8b6eb65c94dfba0a94aefa04ef6157126f6a9c99d9
MD5 d4da30581dedc0366d4128babc10f3a4
SHA1 981d985fff5f2ff2b73a010544f9c7538af389d8
SHA512 cbef64b5500c2595014e3c943e26df1840d21962e0b58977d28e9feb16a79d2613011588b6f853c9e5365a6942d715a228a9620b9715e7dd2de67d0163a33698
TLSH
T1FC71D655334248B6EFD6013DCCE206C57AB1B199491B0E6A15B05F7E37CC72F0C2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1cfa18d0e3e3b293ffd06ff3b9468e508372ab265b00ee23c98e2c53ab710ff5
MD5 14193f49e71e5bdd04ac3c8f52da2036
SHA1 ab135340aba4cbb21c9619695f0f58bcfb7f53c9
SHA512 48a14a4a1c4e41a99bf58dd2256d34193f82f2d4f103c58e810f75c8ea7418cd2f89207ccf5569b5cc14646d20d8de306072bf21b04d095e269730ceaa1943ba
SSDEEP 192:sxZRNRnyM/jK1Ml8Mk0/fKsluTbIdpdPHW6+WNGY4whiWIgrJ:sxZRNJM0/fKsl2EdHbGS9
TLSH
T10F42E8126A346977CCDBD209FA557F93D6F80472A2900E44AAFCCA1C05F7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 046db65c9b8f78d1c339e0e560bab298b727505321d92fc622f8fa8b280d6825
MD5 43cd6fab91f42b25810e312c5ff25b2d
SHA1 16c1d26db10f6e0ef7a4a38798b5d798461dd424
SHA512 86fcb84a80a1d40363ccd2c7727bdea7df15764e520a2c6f6226ea5fe1525f0b1bf0818c761297ac809a457b97a5f63060c8da30c38d7d84afa261f3d91dc9e9
SSDEEP 768:pd8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opderoxkpUnQ:pd8iJPNWvx76ru1jahALocd1UUQ
TLSH
T116D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0ad1a467aadba4e5f7a202d440aee56e366f57b011514653dfd910f2b7786851
MD5 4bac40f6e213cca15df65998d118254c
SHA1 1e91ba3a56f0410a66d40aa0226a15283819052d
SHA512 db1c73c6f3a7ec9c08472ea29905eaf4283e878060ab7bba1ac7c10ad6596c0beb45566363b9663f4144260325e1e9cbf3256849d07f48d28bf0cb9dbcd6503b
SSDEEP 384:ctNn/s3n9SfsN6fZtNBJkM8YyEXW+Tpmn15wbAjEO83yR:cj+9UjBiMBpmn12bfZiR
TLSH
T1A5928D326C381C6B1DD39989B10A36279FB8856BE7C82F54D5FC4F1D42EB39C131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3deb9155bd5b515d9a15b713f0114af9f849fc542cab05ef8bf20c6bbd5b27f
MD5 751d3a7fbe847ad941a3d100b046cdf1
SHA1 56516dd8d2aaf2567fef78842aac44c1bfb731d1
SHA512 05519ad2e9a0f8bf7e9d650a63d16be041b454e9bcbd7bea2c54621060a4359330eb434aebe8a034a21ff1bc33c1e4adfa236abce7c9e1766cf971cec067530c
SSDEEP 192:gONS6kDfQmiUyJFZ903tjzorYbracQitzU6:gONS6ghqZ9M8YyKZU6
TLSH
T10902DA3568782CBB8EF3AE49B44B27275FE5112BEAD52F84DAE81B1C40D764C1346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 87bcc1ba07af2bbc9c7fdb5fec600cb597c2fb3ca6585e9c49e4573b208d2d6b
MD5 4c2a58e75da65c1dbffc3d45a8863d28
SHA1 181724b0853396af9801fa1136cc9ade59cefe09
SHA512 335531f9f6f1dd8bff03a91d71b0250bb30a70861bfe65e7f1fdf4514998088ff81f066f8a75b3edbb99a4d570c38202231bfc6db82a2dde695e5b4bdcd87fe3
SSDEEP 384:2tNn/s3n9SfsN6eZtNBJkM8YyEXW+Tpmn15wbAjEO83yR:2j+9UoBiMBpmn12bfZiR
TLSH
T12B927D326C381C6B1DD39989B10A36279FB8856BE7C82F54D5EC4F1C42EB39C131991A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b48435f2323f5f92bf4f06d98d642fb991bdd02facfb2590e4b1347432d157c2
MD5 9b959a5b3ff7ab32dd25fcdc3f07634f
SHA1 0a163243d32c9b0ea631c4212ec5ab3e34456306
SHA512 89e4487d95382549709d34ad63603dda1f430dfea8d50872813bc59b4015e3e91cb40b7f4bad3ff9a273f00ca026bb617a2db6226af66b0d6f0e93e8a93fa8d1
SSDEEP 192:jON76knQmiUy/Fr903tjzorYbraEXH6FGcR0qHU6:jON7642r9M8YyEXWTpU6
TLSH
T1DB121B3268786C7B4DE3A955B44B36339EA5412BEBC93F90D9EC1B1C05EF25C134A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1900b165b0eb603e57d623e0b439f58c510116fd3f39255d849af254380f646a
MD5 b2abc235e2992549245ef2058470014a
SHA1 4be7f68f9328816e6d928d45b91d7df3800cb1cd
SHA512 22bd8cf7c1ded9413821dcef94d2ee70baf852e829f889494c990910acbc386e3c3a4ba072cabcf9c733bfed4dda60bef113ec40a475c01cafd64f6213c1f269
TLSH
T1B041EB59AAFA1158B3B77F56ABF6A86D487B7C372E06D46E00110D4F0A63B40C972733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads