5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9

Analysis

max time kernel
38s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 11.7MB
Sample260720-rdkc4act7n
SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
MD5 0b24e08f0d1dac2ee54364e50fef0b41
SHA1 a4f3ea66556cdcc2e92bc924965e225488ccd94b
SHA512 2beb14f31a87f0df953af26945288f35e916159b114ec1c205c3a58125fa6911b888c2a0b17b593c5b2bcd8e51012d8f2cbe4629f1968335ee3866a19712dfb9
SSDEEP 24576:S9dQL6poq6jBCjK6D3UwRmETlmfTKjZ6ojK6QjZ6UjK6ajK64jK6cjZ6ijK6b6ck:SvPeGAyWPbX8meu
TLSH
T1CBC6A52F7B48037306C642A26B8B65CAF31F903F3B561654345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290301014429214"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{C439FA2E-DC08-413C-9617-F2706B2FA324}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3816	1600	msedge.exe	86
PID 1600 wrote to memory of 1668	1600	msedge.exe	88
PID 1600 wrote to memory of 3688	1600	msedge.exe	87
PID 1600 wrote to memory of 1668	1600	msedge.exe	88
PID 1600 wrote to memory of 1668	1600	msedge.exe	88
PID 1600 wrote to memory of 3180	1600	msedge.exe	89
PID 1600 wrote to memory of 3180	1600	msedge.exe	89
PID 1600 wrote to memory of 1252	1600	msedge.exe	91
PID 1600 wrote to memory of 1252	1600	msedge.exe	91
PID 1600 wrote to memory of 4352	1600	msedge.exe	92
PID 1600 wrote to memory of 1252	1600	msedge.exe	91
PID 1600 wrote to memory of 4352	1600	msedge.exe	92
PID 1600 wrote to memory of 4352	1600	msedge.exe	92
PID 1600 wrote to memory of 1184	1600	msedge.exe	93
PID 1600 wrote to memory of 1184	1600	msedge.exe	93
PID 1600 wrote to memory of 1184	1600	msedge.exe	93
PID 1600 wrote to memory of 2184	1600	msedge.exe	94
PID 1600 wrote to memory of 2184	1600	msedge.exe	94
PID 1600 wrote to memory of 2184	1600	msedge.exe	94
PID 1600 wrote to memory of 4884	1600	msedge.exe	97
PID 1600 wrote to memory of 3376	1600	msedge.exe	98
PID 1600 wrote to memory of 4884	1600	msedge.exe	97
PID 1600 wrote to memory of 3376	1600	msedge.exe	98
PID 1600 wrote to memory of 4688	1600	msedge.exe	101
PID 1600 wrote to memory of 5032	1600	msedge.exe	104
PID 1600 wrote to memory of 2644	1600	msedge.exe	105
PID 1600 wrote to memory of 3152	1600	msedge.exe	106
PID 1600 wrote to memory of 4408	1600	msedge.exe	107
PID 1600 wrote to memory of 4408	1600	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbe303c188,0x7ffbe303c194,0x7ffbe303c1a0
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5837058395896709598,8384244595760209119,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1152760423638390051,11011659204793285131,262144 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10358810223032153268,2665921406342214395,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15602657137655889474,12038057677044071398,2097152 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,6780116280412399059,12580332859318881884,2097152 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,3986315217588373981,14852415447555123486,2097152 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,14550772276157148232,11422901519743882587,2097152 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,525807726551367601,16911944696243092807,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12702479206920325800,8240987480688694765,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,2659567114827114371,707046997353356008,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,2659567114827114371,707046997353356008,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,11817642301609862852,10050920863022273896,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,1489846163433719857,6031244383633394511,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,458532491162445568,840812213874356128,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3040,i,18219876297792108786,4287948454045914318,524288 --field-trial-handle=2304,i,3270535815995274811,1177367109700372058,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

5edc0223-8893-428e-8889-2bf6290f3942.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5edc0223-8893-428e-8889-2bf6290f3942.tmp
Size 30KB
SHA256 3dd2ea6726e0f5f5466c0ccd1d2f422a63915430aa3f2e3bb28e3556ed89088b
MD5 a9646f953a751ef10a19b3c5cabb6025
SHA1 72f6047a41b52d0ee1b4a47fcda57e55c86df947
SHA512 01f9ff8c6bca9c2ccc48234ff50da0c64319d6c5a5d5be27c2afc3d9cb6b13e95325415fec634b0feba093d660ee46ece43f4d2c9b5e33e908f05eff895679ec
SSDEEP 768:6k8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdzroGkSUnE:6k8iJPNWvx76ru1jahALocdAMUE
TLSH
T171D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c502d6291748135945e770d7330df0142e57567fc603ae552661771bb776858
MD5 0485fe3359e60a5206863ae32e587741
SHA1 47e5698b0ebe1649e2ddb58301231a30011d5b97
SHA512 cd075097d0a6cbdd575b17d13ca7ececdbfad0112dd13ee3682f43b2c5c93cca0d8cf52428141f97fe27c4df39546011843df190e5aa2c1fbacbf70e87bb8b3d
TLSH
T1E561D62886B2C985F7967431F2E1B20474FD88993A5F3F4E584059BFFA0EB147025E38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c4d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c4d2.TMP
Size 3KB
SHA256 932c876242b668595b6b1fc25d3161118c0216c89abc27e11517cce1a6833e95
MD5 52478ebbbf78a577eb286ae38884ebc1
SHA1 f710ab8e8a40e649782f173f9947b9d171e8aa98
SHA512 2c40ed8f920caa59c27f82a0bb8beec50742aa3093313efad557471b7d06ac99a05289e30c122e030d9e860462c395b221c7dd707e6848fd29e20049ee9a9cc9
TLSH
T1F161C52886B1C985F79A7431F2E1B20474FD88993A5F3F4E584059BFFA1EB147025E38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3942186c075d4bf477ec32b1cd31d2b727953a47daef2d6b115f55c7dd0fb853
MD5 3fb2ac1510ca5eaf3185d15f949245c9
SHA1 25f0b075350309ed4dc787ed867dbce54704e077
SHA512 1e91a5639dab08b2e118410d625dbc922950d394417f978e5cee98e28bd907a39760bb1edb7931495e277681f6f67f3422d629f8ab7029f03cd09fae24be06da
SSDEEP 192:sxZwRAyM/jK1Ml8MkD/fqsEFqfIdpdPHW6+WNGY4wEYHIgrJ:sxZwGMD/fqsEFqQ1HbGu9
TLSH
T1F242E816AA349977CCDBD209FA51BF53E6F91472D2900D44AAFCCA0C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3fac3c81d468208d91be51ca2cdfb5748e66a5337c8ebe6729199d8052147e95
MD5 5c7c31a45c691a1addd43fc936bc2b47
SHA1 24c7d33bd8ddfe30050c71aa12bec589a046d7e6
SHA512 9ac8d964f38b84500ffdf807750abb0ee4a196fc5a9d1c6449ea3c39a4639fb7c198aebcf6254ba4d8988bb45410c43352577a3a173fdf282ee6a1defbac0351
SSDEEP 24:Kd56f5t525na58d5Q5s5o45Y5E+57Ij5S5oKi5rha5E5o1E5y54Sm5GM5v85a5lP:KYBIJKCEkTypEIbKxqUtpIpKqskryv
TLSH
T1A591921236BB16417DFF290C9190A61B4782B1A77554B82B3BE845B20F2FE292CFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ea61375a73b2642b7479bd9db4743efe72084f9981f852438f2ffa84e88abe97
MD5 91db949f438fe5c7e921314cf1048edf
SHA1 af105b9258ff6508ffa96b82b7c837916bf2ac67
SHA512 3d081619e1a6c791df528b3348588ff68ac43545ad041b30dee503dc465954ed7ec7a8cba45ef290962d97726d6cb84c0900252ebe52aa1b8fb8e6544eced0f3
SSDEEP 384:8tNn/s3n9SfsNq/NRl5rkqdhdptOObjI9G6w74:8j+9ULhtdpt29M4
TLSH
T1DD929D35A8286E7A4EA39165F0473A1B6FF491BBD3C92F84D4DCAF0C06DB5EC4306919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 09b8155487f3cab85af328371189ee27826a2ed314014ac37027fb312ddec3ab
MD5 1a915fa797b7d053c6534a48f1f53a18
SHA1 f01f2102a2603d75bcf88839d7791086bc11a340
SHA512 8e3784c84d45de8a1ab2f1ae1dcc8a55c9f4238408206ffbb9df4e943b9c0967fdf07e580aec3605423b32d7dfcd2fb43349a222e2d487c86b05719df2d8d270
SSDEEP 96:ZqONk6QsjpfmUTmDK5ih/cIPURHl8h4otop5W5DABhPwivh50xy0SFYKIAxteYk6:gONO6kDfQmiUywkZ903vZQirqU6
TLSH
T14B02FA39A8786C7B8EA3AE05F58677275FA5103BEAD42FC1D9E41B1C00D764C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4a2821b6f0f8c6418e6ea176ab000f9fbac4b44920674df3fa531b581ac5cd01
MD5 665e51f6c80415e58bd3e0304a38b591
SHA1 65e32fc4dbbf6807d99de911c40236ef1488f1f9
SHA512 4fc352c8299b672af84f8261ec75904147a4348fb2ecf740b895e33671939189d48509611f24e00ac832f187af3352b9849adfd59d95914e2e25a96260d1662c
SSDEEP 96:+qONkDQsjpfmUTkK5ih/cIPURHl8h4otop5WuDABRPwivh50xy0SFYKIAxteYkMN:FONL6kRQmiUyjkp903vdhd3cRfqiU6
TLSH
T18D123935A8B8AC7B4EE3A855F48336175F65412BEBC86F80D5DC2B1C01DF59C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d96d76e60d1ca7cfd1f9bcd24fc013c62f17a1dc7dad29d8cea29e983fe1ecf
MD5 41d9ffda191ff7c3fd4caf49c956644a
SHA1 04dd91c97f4ad9f04daf02d0f046d1937c2324e2
SHA512 884453af27ff975317d523b8ca7c93284250b3bbd07dfb6e10fd5740eaa3b7c69ba778fe963ce1cf8e809b2fe02414b0a37f60abcd0d32706a7dd9d1b40554c5
TLSH
T1EF41E958AAEA1148B3B76F5A9BF7A46E487B7D772F06D49D00010E4E0A23B44C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads