hxxp://www[.]sequoiashuttle[.]com

Resubmissions

09/07/2026, 17:32

260709-v4cmqafv4y3

09/07/2026, 17:09

260709-vpkd1set3q3

Analysis

user interaction
yes
max time kernel
104s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.sequoiashuttle.com
Sample260709-vpkd1set3q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4256	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280906028175918"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2427D1F1-845C-4C28-B047-BFB5968E322D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2296	1132	msedge.exe	86
PID 1132 wrote to memory of 4256	1132	msedge.exe	87
PID 1132 wrote to memory of 4688	1132	msedge.exe	88
PID 1132 wrote to memory of 4688	1132	msedge.exe	88
PID 1132 wrote to memory of 4688	1132	msedge.exe	88
PID 1132 wrote to memory of 4000	1132	msedge.exe	89
PID 1132 wrote to memory of 4000	1132	msedge.exe	89
PID 1132 wrote to memory of 1248	1132	msedge.exe	90
PID 1132 wrote to memory of 3856	1132	msedge.exe	91
PID 1132 wrote to memory of 1248	1132	msedge.exe	90
PID 1132 wrote to memory of 1248	1132	msedge.exe	90
PID 1132 wrote to memory of 3856	1132	msedge.exe	91
PID 1132 wrote to memory of 3856	1132	msedge.exe	91
PID 1132 wrote to memory of 2496	1132	msedge.exe	93
PID 1132 wrote to memory of 2496	1132	msedge.exe	93
PID 1132 wrote to memory of 2496	1132	msedge.exe	93
PID 1132 wrote to memory of 1800	1132	msedge.exe	94
PID 1132 wrote to memory of 1800	1132	msedge.exe	94
PID 1132 wrote to memory of 1800	1132	msedge.exe	94
PID 1132 wrote to memory of 4532	1132	msedge.exe	98
PID 1132 wrote to memory of 4532	1132	msedge.exe	98
PID 1132 wrote to memory of 4532	1132	msedge.exe	98
PID 1132 wrote to memory of 1940	1132	msedge.exe	99
PID 1132 wrote to memory of 2580	1132	msedge.exe	100
PID 1132 wrote to memory of 1940	1132	msedge.exe	99
PID 1132 wrote to memory of 2580	1132	msedge.exe	100
PID 1132 wrote to memory of 2392	1132	msedge.exe	102
PID 1132 wrote to memory of 948	1132	msedge.exe	107
PID 1132 wrote to memory of 948	1132	msedge.exe	107
PID 1132 wrote to memory of 948	1132	msedge.exe	107
PID 1132 wrote to memory of 3668	1132	msedge.exe	114
PID 1132 wrote to memory of 1224	1132	msedge.exe	115
PID 1132 wrote to memory of 3532	1132	msedge.exe	116
PID 1132 wrote to memory of 5012	1132	msedge.exe	122
PID 1132 wrote to memory of 5012	1132	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.sequoiashuttle.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x248,0x7ffa09cac188,0x7ffa09cac194,0x7ffa09cac1a0
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,16145196360622796832,4322257690379552561,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7015466205459877926,13020527336273570230,262144 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,8997816419948119904,11926488439767952156,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4867173025448679833,10828458095485582012,2097152 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14618682411952627167,17506563905562621151,2097152 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,4395703567765632448,13611637305311989636,2097152 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,5560761809380409839,3388343406255325448,2097152 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,7874155315525436081,8153278699080308064,2097152 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15421621955914885791,17261242969877645385,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,335719249851324293,2020005277022005084,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,11297090936694679722,4719134444739404142,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,11297090936694679722,4719134444739404142,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6236,i,6464456798397418261,8734554919373045272,2097152 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,53292666148496685,9938387373973746372,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,6973191875964408465,8832651914046865871,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,4824861657712026759,17279688389720052850,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3016,i,14036914590239926633,11938257400162055132,524288 --field-trial-handle=2288,i,6907572804746860116,324737861183456888,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 89497adf5d904f5228a94bd179caf4f8aa04388e217d3ff5ced13736b5715877
MD5 336f3e6c29839023aa7547876c93f638
SHA1 e206c91a4bb1a758718d121e38c24ee0b73413f1
SHA512 a3561c36351f1495e17fddfe8bfde80bbb1fb0ded48dee912fe96133a993c44cedb5f99e392d14597e7324964651a34dc80a105e4d34fc7aa8f96eb8ab6ced53
TLSH
T18561B6701B6F14E0D71D06F0C4E6CA893B3543C6FB4B4F3201701B3AA626BA58217F08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 083aab6823992747848676a306a8a6e9cd33f6e1006fbf3394b48e792eb84df1
MD5 7a342a16bd234d2a8a0fe58eaf617b4e
SHA1 13ddb16685a4d3edede6ab1752f2ce12cadaaac0
SHA512 e54525b9298d5ad08f2d1bfaee3256ede085b504e1ecd1f2b7c1266985b481edafa37121df9b6e452d3ac5625a98f0a53fcc5177e9350e81c661ac3a6c842cd3
TLSH
T10061B6705B6E14E0D71D02F0C4E6CA893B3543C6FB4B5F3201705F3AA626BA58617F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5920ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5920ec.TMP
Size 2KB
SHA256 ebeb7b3a242643dc6c06ed0ff3afe8c3145f77fc45b87db067791fc4f04050f3
MD5 8d81e922f72fdcf96316ea12139698d7
SHA1 7c32fc80e93a0a301a0029183f3ab4adaa5e828f
SHA512 dbd39ced02efe1c6a07e10a51fdabdc871fa36f22b363f86448e24c9bea4dc85e3db60f4ef380e85002a759aba3613f1ff74cae7c7367a3db851e494c58f5758
TLSH
T1FA51737447AE24E0D32D06F1C8E3C6993B3593C5FB4B5F3201701F36AA267A90666F18
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e5595ef139de5a277eeacc4281e437185a9460b0696ae77ef039ca7e1529bae7
MD5 4c60a53cc52510375b01107fa11a43dc
SHA1 5a817c622f3a30688f7d818befbf6f87032a334c
SHA512 18f3c2e36d98ec0509a6100e2257d50e641e8f5e2097213bf19ca620c925fc2e7c34412f27c6090997f2ddbe84d3078f79522d66100a29cd02c586916e904e51
SSDEEP 192:D1Dtxo+2evx9IzDbWTkj6pJycAmHXrq5QFSqQ1yp:D1Dtxo+2evx9IzDbWTkGpJycAmHXrq5S
TLSH
T140E18BF792F882AE991265F1AA386D57DE1E0524431C3C89C6E8BF8B97F1171D602C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 14f538db4c94b73d327cef0acfe056d9843fbbd5ca74b333275410eb287552e4
MD5 aa642bb03b06defb8ac53c1d6ffbdc83
SHA1 355421f8a30012934792fcf36fe1ba5fd5b8867a
SHA512 3baeb35a4eb300c0dbbb93da25016296650f054354a6a4f5e5bbf53e64081dffbd5abd8fa698b9d56ac9a5ebf89ad9af80d85759370c963fc8d51bedf12ea561
SSDEEP 192:sxZZR/yM/jK1Ml8MkX/fysMXw7FIdpKTHW6+WN+Ak/Y9IUQS3IgrJ:sxZZVMX/fysMgSMHbS/y9
TLSH
T14C52D6126A34997BCCCBD209FA55BF53D6F5057292A41E44AAFC8A0C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 887bab0bda9624860d3533f16d3f30eb22869fafc5f7826458dc87e312e97473
MD5 c7b8501686981fc69cd8aeb4750c68a5
SHA1 e07f66487d39dcb7646c0988cc90800e19b0ff5a
SHA512 9c7f40f150df6de61bc3bc6cc10eadac5b41a03932801f76362165f7616889417d40e52a6b70e1d3320acf7904314130f587535d582a0921dce7e508572ffae6
SSDEEP 768:+Lcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNVroOg6j:+Lcv21wWvu+Z+u1jaeFLeRNuOz
TLSH
T1A7D21A2B280CCB7E0F841E9CED2AAF866DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c28144597173a1efb6bda061e9b92493d70f8bfea2a677dafcc67171d39309f6
MD5 21ac39f9af3b87e3a955ad06872d52e9
SHA1 c23e08a65ead266cf92a139e3d6beb980ed379ae
SHA512 254106156094ac3e2f0563dd80d980d7b7aa0e6e1afc6b9f48a949dc36dfc2ef56c4e10452f21971df19d18e9a7c96b27ca4c30ad36e585c89e5546f318f339c
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygQKVWKsnwVRnlV5WhOUgZ5K4QgX5cfXW9:mTr7snwVRnlV0hOlZzQgXGfXWJVKg
TLSH
T13F916501723A0692387E6D4CA366953A8E8271677414E87F7FB800624F27E129DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\8691391d-1cd4-4578-b0ab-b9756cefac36\index-dir\the-real-index
Size 72B
SHA256 d4e15a811190f7de5a20135cfcb60180c249fd32bd6c6550361791fd669760ab
MD5 99f03b5a711992a7a90f1a314b593d24
SHA1 37cf1b44c3464534d9bd046448964733f34c5ff5
SHA512 e8ea7cdf92747bc9fb66567dc762f36f54a1acc1e6cf89f7c4d62a778b0a20636566f7e9c9e8bf6862eb8866bb5523b8985a0cca3c16e8a619687dc2573eeb95
TLSH
T13CA0023842690652D4100371245711B132754911F9890A4391F071D4D8991B7551717C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\8691391d-1cd4-4578-b0ab-b9756cefac36\index-dir\the-real-index~RFe59bd8a.TMP
Size 48B
SHA256 4602d3951d4c139766f966a2adf6726178959aaf572c9b18d422b9e75ca466fc
MD5 3c274abafe6598afa51e577ecaadcc16
SHA1 a4f0de1e8132715728f5f52fbf1658c27faa312f
SHA512 2b4dc5467dea922db7b746bb2bc25e1e228fbef0cd4245e76f534c34aef83611e36dcc9907749910ccb68126aae9d8e25c02960e325cad3f173ee5bf752e8bfd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 efaa8c456784ba77ba440f4ebd0a91935a522e8e011a2bdb9d2b96fcff062a65
MD5 7d7f09bdcf05abdd517af958bc06e146
SHA1 405ed324da5a9797ec972a0f0cc49272968b991b
SHA512 39c49f10e49a99e6871fa06c9a83db12606023fb237366a2c3f964dfcffd47a90f0daa22d2594b7756cb6c2a882286a04154338bd994370c31989b78274b27c3
TLSH
T19CC08CE31C1089CF8A70E9E82139751CD64B434D8CD8CCE494085002A1B8D23C502A38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 242B
SHA256 44070dc1a1b7914af688bf8ddf49a9bff9800dad3b17bac2e45b59b4a300b77e
MD5 1647c2de562a8c80e0c4326414e1d669
SHA1 22f5a02f3ec5a606b841a01cfabf0116f06ab8eb
SHA512 2a78b41494202c9fa834ce739e0d056ae30d37083be27bc62b8089828d84f813e8d5395f2dadfac9b7e87f1539f04dc955ba26990af125b8d496b19fe870f761
TLSH
T144D0A7EB55319D9F5730ADD42134752C95678E0E98C8DCD548197052A1B8E13D006A39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 158B
SHA256 4ae7a978b1bd94d6c8dcbcb2b0f31882dc129cc167a096acb50bc95050730817
MD5 1aa69883625c68c30e80faa977e48f67
SHA1 cfa95ef3c9f5bcac4be5aab481a2e22855b3ee4c
SHA512 ba10387ff750c47e1d77a32096de2cde22fa0242e674ec6b23597b80598c17706ff26bfb7bf2d9569e093c72e50b75d7ab16a1b177d8e3cfa4130d12dd9c6259
TLSH
T15AC08CE3281089CF8A70A9E82124761CD64B434D88D8CCE894085002A178D23C002A38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe591c68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe591c68.TMP
Size 165B
SHA256 def8e5bd1b73f5fcb818a5159ec051d4dfce961ea91f685b00ea3667416ed4a5
MD5 103e03e1144fe07c55f5d5f431c71bdc
SHA1 7f2c2f81c7cbf489bcf6efc58a3553f4b7df378f
SHA512 eba0dcdc387fa2a72804f05c5800ab966e558a8ceca70e9c666d07c69d67fb084d4fb3e8909156c476e4f4f25d45c6ad650d45cddc300615e06f60bf480e8bde
TLSH
T182C08CE3182049CB8770A8E42134B50CD65B4E4E8CC9CCE8A4097002A178D23C106A38
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5960d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5960d3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6903b3bf428246eb5abb5a8aecb2f45ef5da132e0a90c9f76f9b32a110882fd5
MD5 69cf40a4e7e8170637c684a85bfc97a8
SHA1 42d723b8bcee018b244e0e1bc8cb14a7456c4f8d
SHA512 d8b9685311f66b8ec959d068e98110c16b5e58fe92873b61c5c56897b94ae61a9c3bff683c02ab0f954a065ee81f861ad6526f4a82557a0445af530baa235914
SSDEEP 192:uNLsNOcQ90bOpm+YLeXqQmiU1nr+4e+CGSOImqnSJr9DJiHJqw3vz+:GsNOc3Pzi2hhe+CfOESJr2Ht3vz+
TLSH
T1B9422A3678785C7B5EA39545F44B32139EB8506BDB893FC4D1ED6F0C06CB29C130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c4dfdf75f3008b926efa6db528ceab74f146a98c61df94bfb41f9ca3439e179
MD5 645deb3ed1528e49d1f65a2abd1fe198
SHA1 8411679a060ae923152f4183b78887014586d049
SHA512 9c8c7f9dc91380339252f292e0b0d277ad858a8ec13164987fffcb2615b5439a9de5603176beb4046f87d229c644ebf6650077b826858e24f0f8a82fc9d7a4d6
SSDEEP 192:JONys6v+YLNQmiUyKDZh+CGSOImWusHL4U6:JONys6vz/zZh+CfOuHkU6
TLSH
T19802F935AD682CAB9FB2AE45F48737175FA8213BE6953F80D9D82F1C01D775C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 cfb617384a57446c6ecec22956132bf040b175cdf0d35a10216aa98b19dc7fcc
MD5 fa1237866964130469da89eb92c56ebb
SHA1 de994c02144f299fcfe30d869929f9363921c6bc
SHA512 7ae0f297603fefe4a131322fc6dd619e0f9749014323df76a29bf1fc0529ca57498373fe03a1bb97a356183b6997e1307e3cf60e6a7a3da8c9a7dc829576be26
SSDEEP 384:RtNn/s3n9SfsNOP3Pzi2hhe+CfOESJr2Ht3vzj:Rj+9UBbNYnOESh2Ht3bj
TLSH
T192726C3268791D6B5DA39988F50B36179FB8906B93853FC4C5ED6F0C02CB39C131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 053b0b7b2e3c2781c79ed234315229c2a1f49243526aad345cc72cfa0b11de96
MD5 7e565f52331b45957f3f49db22ddd427
SHA1 8a2c0b7194f893792d1fcc0e3575aae5a5a0988f
SHA512 5900a754b593564dbec98600603302f2b95581c3e9c0d52a679c6c07e3c143aef56eb21762b2d2a4a342d358a64847d24df10a921a7198411e8d701ec6adeed4
SSDEEP 192:rON/6v+YLSQmiUy9DTh+CGSOImqnSJrOCHHJqw3U6:rON/6vzqSTh+CfOESJrPHt3U6
TLSH
T11A121B3279785CAB5EE29954F48736175EA8513BEB4A3FC0D5DC2E1C02DF79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7e5ff851c917d35b0c06df7cd8c604d58f61a695d8780af72fabbd4d53def85e
MD5 d048c65be8d8e8d72bc37f62759d8177
SHA1 c1eec4f20f063ec03c527884075e4b28d668c889
SHA512 01edc8ee134592effdc315d50f7751c631f963948d5893a28759cedf36a951271d729cc0eebdb507ad6c540c0f6b8dddddecd9f041b4a89a274fcb448c51a35e
SSDEEP 384:NiF1tNn/s3n9SIUzsNe8TUNTUlIlP3Pzi2hhe+CfOESJrHHt3vzj:EF1j+9SvwgxbNYnOEShHHt3bj
TLSH
T18E924B3358648D7B9EA39A88F90B32139EB840BBD6857E90D6DD6E0C01DB2DC130AD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9977812026aa7cf27bfdadc3a67ebf03283a47d3f50d4e3da698387a3ac273c0
MD5 a9ba9f68e853eb995c95a3fad84a37b2
SHA1 f63e95a33f4052f0d83c7b9f48598e4065fa20b9
SHA512 aa92c9b2746820983260d4b1c121369e9b011bcce9e643aa5cb80c55ebddb9d8e05a14ce9030fa92e8b2ce37bcd6e74a0129e6ef550a29db0230a2d75dffc8ed
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe598a06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598a06.TMP
Size 392B
SHA256 37792bd360138a2bfee0b3d56a177e24a5e0e785d5ae33db4f8a6f06946046c8
MD5 39b9276d98a4ed32315db2a4ad633969
SHA1 93d92f17ac55f18766621a2b546d1250601b7ad7
SHA512 5e1d37b6379b268beee62f3f1fec0f89e9fb1269f0e4e194b90a2fc87e164f0db112c75d42f3b6a19edad9b889a563957c87c648e354e684d95ebbcafac4a71b
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9445f3914923289dbd32990fd4b9cea29db21a67b52a8491399caa20406920ff
MD5 f76d1d3ba6b93e5e9580fd2b5ac45d83
SHA1 87d684ee53ddf00c89598533daf25effea92435a
SHA512 a77d1c18872d8b38dd17b45918c6839f0759a6e96c2a74a912affc6e53e98a88d13ceeec7313c5b16c1d69e7114b3997cf2e64e533dfe936e24a62c19a230f7c
TLSH
T10C41FA48A6F9205CB3B76E5A9BF6A85D497BB9772E06C05E10110E4F0A22F01CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads