adeda364de888d3be6ccf0b159a3e13f95960998c8d88ab77bb73d0eb329e2ac

Analysis

user interaction
yes
max time kernel
52s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy Swapper v2.html
Size 147KB
Sample260723-c83etsfe49
SHA256 adeda364de888d3be6ccf0b159a3e13f95960998c8d88ab77bb73d0eb329e2ac
MD5 43f658ac0600bfaaa6e74c8245d41bf1
SHA1 d1045aaf3bb882b7d5b98ab9efe1b2785b57e81e
SHA512 79641ae14ae85ef60eac9ca65a729ce9d3dcd93c5e7e1efca07c6bb997f2134f8d510a8a235e032e4a8f21e156994504bc98d442752296045f2aad97d0c603b8
SSDEEP 1536:ozrPfKauhtllcV0yHz4Drvi+HP230vD9v2l3O4DfP:iruHll0+vb8jb
TLSH
T18FE3E86A47E2132D0407C15A8AFE6B49AFB68847CF4884D87EFD0AB09F9DD905C4FD46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292483843578146"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{849687A7-F783-432F-B6A9-2D366CC56D54}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4264	4640	msedge.exe	85
PID 4640 wrote to memory of 5092	4640	msedge.exe	86
PID 4640 wrote to memory of 3728	4640	msedge.exe	87
PID 4640 wrote to memory of 3728	4640	msedge.exe	87
PID 4640 wrote to memory of 3728	4640	msedge.exe	87
PID 4640 wrote to memory of 736	4640	msedge.exe	88
PID 4640 wrote to memory of 736	4640	msedge.exe	88
PID 4640 wrote to memory of 3880	4640	msedge.exe	90
PID 4640 wrote to memory of 2336	4640	msedge.exe	91
PID 4640 wrote to memory of 3880	4640	msedge.exe	90
PID 4640 wrote to memory of 3880	4640	msedge.exe	90
PID 4640 wrote to memory of 2336	4640	msedge.exe	91
PID 4640 wrote to memory of 2336	4640	msedge.exe	91
PID 4640 wrote to memory of 1204	4640	msedge.exe	92
PID 4640 wrote to memory of 4908	4640	msedge.exe	93
PID 4640 wrote to memory of 1204	4640	msedge.exe	92
PID 4640 wrote to memory of 1204	4640	msedge.exe	92
PID 4640 wrote to memory of 4908	4640	msedge.exe	93
PID 4640 wrote to memory of 4908	4640	msedge.exe	93
PID 4640 wrote to memory of 1432	4640	msedge.exe	99
PID 4640 wrote to memory of 1432	4640	msedge.exe	99
PID 4640 wrote to memory of 2512	4640	msedge.exe	100
PID 4640 wrote to memory of 2512	4640	msedge.exe	100
PID 4640 wrote to memory of 3408	4640	msedge.exe	102
PID 4640 wrote to memory of 4224	4640	msedge.exe	114
PID 4640 wrote to memory of 1936	4640	msedge.exe	115
PID 4640 wrote to memory of 1720	4640	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8ea0ac188,0x7ff8ea0ac194,0x7ff8ea0ac1a0
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,15800561745914584653,16741475968648871446,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11226519181593177735,1770444408202013326,262144 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,2115350404040469121,4674276309013655910,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9336097509629799637,17361621729752476257,2097152 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14572732931784852621,697968584258819459,2097152 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12531010495525410514,9126728101599952901,2097152 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,9885313890641062933,10579765843099818554,2097152 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,11180328024955014192,4261474882167938444,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,11725051631186987086,5883385820145251762,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15988806906865894099,2065092709283823074,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15988806906865894099,2065092709283823074,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,18245142291937680647,8113350991370396704,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,9653046763527079610,10604148960085077872,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,11000674143589908105,9315771977323862656,524288 --field-trial-handle=2140,i,4456970535782174624,2173522193759401841,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 66d5ed1a3e2c9c67b3517f63822b1ee0c1b255a4b628d0a926710eec201d891f
MD5 bdef60a6e8db55b796e85261e8e033ad
SHA1 12c8cfa708602fb2e03a3db93bd3f026fe58aafd
SHA512 13c673845f62c9d17eff90a4953ed0f26cd37ae9620944cc1dfc5e7c3fdbaee2bc6c6fed93a6c4c7dcd2d8c5792e2b04c0cc20f206de3fd5ebd656cd3eee5a34
TLSH
T17D611B380B5E0482E3A156B1B4E20105717182F9FB9FDE4DEF149DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58baee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58baee.TMP
Size 3KB
SHA256 b654579149715a128e0a9813451d96739ff6a5156f26c7eee31641e87c51532c
MD5 07061ff5943b82d0ba05f1f0fe719d1c
SHA1 5de4940e38887f24ae74a346a02efed42d61892f
SHA512 0cdfbb7b10751f4346e0b9369b7f7f7a4fabb0252ee98904dbca9dff0b7405c444961261ef0299ef18d33b8b8ce753f0f098bc857602bd75cc9392c9ce4baf2d
TLSH
T122613B380B5E0482E36116B1B4E20104707083F9FB9FDE4DEF148DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7ad1d0c361db0aa2f61550280ad9d7f822381010b7bf7a5e978e6f018035bf44
MD5 2f06eb2470f8e0c3acd435c2b02dc8ff
SHA1 250fe1340fd585f78ad569224e5845f46c627b0d
SHA512 cd2ec2845a0f3447c65707bd39612367d4b7fd1b0f72a16dabb99d340d1664e90036583098e0c90f3c90bef8c7154ab68c5d0d1e4298517dbee2437b68ae9d5a
SSDEEP 192:sxZqR7yM/jK1Ml8Mkf/fysgrG9IdpdIHW6+WNGY9IKdH+vIgrJ:sxZqjMf/fysgrlqHbGuE9
TLSH
T12742C616AB349977CCCBD209FA557F53D6F50572A2940E84A9FCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 945513541d838f22a71ea1559759c6cbb275256245fd606b7e373361153fa832
MD5 783e34baa070c9beca96a88a05b56f07
SHA1 02d4a12fea7823af435d1600f54f6241d43187df
SHA512 a1711decba3c8317deaf7b5d397dc6be332bd4da658432a1fd6bf57d81bc7368d5e334ee8392bfdbaf414b343283cfb5373a7bfd9aff714388eedab3cd72da96
SSDEEP 192:sxZqR7yM/jK1Ml8Myf/fys6oj9IdpdIHW6+WNGY9I+7H+vIg50J:sxZqNaf/fys6oyqHbGiEe
TLSH
T14C52D716AB349977CCDBD209FA557F53D6F5047292940E84AAFCCA0C01E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 56f80d9c2e879e90b38bc00d045f5f98405ded7efa8d265729497ddfd61dbe52
MD5 34500e759574ad6cd7533236a084fc95
SHA1 a643f222de2696f20a48737d9dfc2d0cc70ce599
SHA512 b1febde818bb25691217eb6bb4faad0e9cbf93465c318f7d192cc9fcb817b7215b5bbafcb0e905ed5bb81efef2562ffca576c78a85da2f09e87ebbac5a42f154
SSDEEP 768:Etcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNjroLg6L:Etcv21wWvu+Z+u1jaeFLeRNQL7
TLSH
T145D20B2B280CCB7E4F841E9CED2A6F866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be5fe0f1bbf6d77e7f181bfa84185690836abce4e471d37f764ea9aea1ab9e43
MD5 4dd4fb20a04293480f817915afdff50e
SHA1 410d2825c023b2b22b2e7dfa6591ff7896ff9c10
SHA512 3f1d26fa42e5b11fe3196afe4fcd7001edccd0ea9dbaf84b83270ae99286f8a0cd29f4b0fc14f174ee79166607d8647ce68b5f68e64c4aef7b58c257ac57910a
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWqIoKRauSIQK1O1:mT0brC
TLSH
T14E91780972BE0641283D681CA3668A76CEC375763818A96F7B7C00624F6BE535DFC9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e5423d6c40e16f1678c1ccaebd646ff44c4cd1aa55051fa1b60a3c15fc769db5
MD5 82100833010a7f08de4b9f439a71926f
SHA1 a64c736fe96cdcf2c707e130f709016fcf991e4f
SHA512 6f3757c344907bd86acf1026ab7fa4a8f07c42e46cd1c7ec6c60062f59652156a25852df4a4613e1e5377c0bf87a307ddf440d8ef2260cc9c01f75126572bc06
SSDEEP 384:UZcIhsNBU2DinzithYe+CBd0esADIOObjI9G6w7mNAh:ShaizErJxsADI29MEY
TLSH
T1D9927C35AC785C769AE7A511F48735234EF89177EBD92F84A4EDAF0C01EB9AC1302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 96c48a2b1c3f39bbed8336aeb653721791ec219bbb8ff9e00d3341e76991cae7
MD5 0fd2968575cb65640675c32232da556b
SHA1 96e02621f65fc0fb09022132c628c438cdee80e0
SHA512 2406e6742d0985a1846d75465558bb53f36eac3e111bd9bdf29832cc8ae883f61a0af01471c7f396e0c634f248780ca478f3cae2bc02d9073e900ac50a738736
SSDEEP 384:9ZcIksNBU/DinzithYe+CBd0esADIOObjI9G6w7mNAh:lk5izErJxsADI29MEY
TLSH
T110928C35AC785C769AE7A511F48635234EF88177EBD92F84A5ECAF0C01DB9EC1302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 759c8210974322c3a0b8f2aed475503887069402a3354ec4f12247f4251f98ef
MD5 d6c1f9f82a9fca9b8e47de8fe4c83670
SHA1 28eb8c2451cf6860c37752c631212b8ce8b04d66
SHA512 a00737c52ff02ffc39f616340b9dc6cd8d72c055ef23b8d360b7c4555b4955c1cb633aaa8c4ebaf3d25715ab5d1e5bee23db70b3c0d46048e16ca69347b13621
SSDEEP 192:JONa6v+YLNQmiUyo9Zh+CGD+FdeP9ospusD32AU6:JONa6vz/bZh+CBd0esJDmAU6
TLSH
T1FE02E939AD381C7B9FF2AE45F4873A175FA82177EA912F85D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1add09ebc85d1627b8c069cb41f26744a3883aa4b072b6e57fb1b881adb11c45
MD5 7bb0478ff266f5861992557f0e781a48
SHA1 cbc9436742c806a1f1424d08617f34bf16d96778
SHA512 906c1653cae6783d49f1a0a0b51a04e0092e54847accdb0f2b17183fadabb31d7a2c6e20dda7a581154aecaa49bce674f1cd4cb94038d94982749f2ba48dad8c
SSDEEP 192:4ON76v+YLxQmiUym9oh+CGD+FdeP9osNOeBWCHDWqEU6:4ON76vzrroh+CBd0es5DIU6
TLSH
T1D8121A36A8785C6B5EE3A555F48735135EA49137EE8A3F90E5EC2F0C01EF69C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

345459c6-d039-428f-8dd6-f2ce8d7d5164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\345459c6-d039-428f-8dd6-f2ce8d7d5164.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7cbbb425f85af1e37e2c486f5bbc5d6f27c6c179cc0b4336f3f29435eed84d44
MD5 52de3115d9924f2ec9a62994db5d7633
SHA1 31612e30c1198c855d6b9d2c0dceffdffa235735
SHA512 cf79c8036a3c32fd792d1a177a944a9557808167d3ee88fcf409a8a3d6abe43dee8627d6619728b68f091478a29c00f926a940357c03607a66aa822761a8d2b8
TLSH
T19E412C98BAEE1148B3B36F169FF6A86E447F7D772E06C49E00110E4F0A22A00C861773
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads