hxxps://64[.]38[.]167[.]72[.]host[.]secureserver[.]net/aXNhYmVsLmRlbGFyb3NhQGp2YWxsZS5jb20ubXg=

Analysis

user interaction
yes
max time kernel
46s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://64.38.167.72.host.secureserver.net/aXNhYmVsLmRlbGFyb3NhQGp2YWxsZS5jb20ubXg=
Sample260723-tlkpyaseng

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292965358318523"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{CCDEA91D-E4DD-480C-BDE0-3D7B5C6D72DA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3480	2064	msedge.exe	87
PID 2064 wrote to memory of 4224	2064	msedge.exe	88
PID 2064 wrote to memory of 1764	2064	msedge.exe	89
PID 2064 wrote to memory of 1764	2064	msedge.exe	89
PID 2064 wrote to memory of 1764	2064	msedge.exe	89
PID 2064 wrote to memory of 5012	2064	msedge.exe	91
PID 2064 wrote to memory of 5012	2064	msedge.exe	91
PID 2064 wrote to memory of 4864	2064	msedge.exe	92
PID 2064 wrote to memory of 3524	2064	msedge.exe	93
PID 2064 wrote to memory of 4864	2064	msedge.exe	92
PID 2064 wrote to memory of 4864	2064	msedge.exe	92
PID 2064 wrote to memory of 3524	2064	msedge.exe	93
PID 2064 wrote to memory of 3524	2064	msedge.exe	93
PID 2064 wrote to memory of 4236	2064	msedge.exe	94
PID 2064 wrote to memory of 1520	2064	msedge.exe	95
PID 2064 wrote to memory of 4236	2064	msedge.exe	94
PID 2064 wrote to memory of 4236	2064	msedge.exe	94
PID 2064 wrote to memory of 1520	2064	msedge.exe	95
PID 2064 wrote to memory of 1520	2064	msedge.exe	95
PID 2064 wrote to memory of 3588	2064	msedge.exe	98
PID 2064 wrote to memory of 3588	2064	msedge.exe	98
PID 2064 wrote to memory of 3588	2064	msedge.exe	98
PID 2064 wrote to memory of 4000	2064	msedge.exe	99
PID 2064 wrote to memory of 4000	2064	msedge.exe	99
PID 2064 wrote to memory of 4200	2064	msedge.exe	100
PID 2064 wrote to memory of 4200	2064	msedge.exe	100
PID 2064 wrote to memory of 2980	2064	msedge.exe	102
PID 2064 wrote to memory of 1660	2064	msedge.exe	111
PID 2064 wrote to memory of 4908	2064	msedge.exe	112
PID 2064 wrote to memory of 980	2064	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://64.38.167.72.host.secureserver.net/aXNhYmVsLmRlbGFyb3NhQGp2YWxsZS5jb20ubXg=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,3653934973135031584,12389693974482540594,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4748500625134931554,1503419269672565931,262144 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,4410970596145329666,4875995981709218178,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,18237777084227478072,8924489816413887299,2097152 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,13196973559162787628,1806355864887042976,2097152 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14920677006044612981,13301961733824733706,2097152 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,12311524333684407735,1947470964967354966,2097152 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,7393104269411973362,13829946350601742115,2097152 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,10036640868265822934,10017262663112596223,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,7592567763952867814,3923384420361007994,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5593714935765093022,14500759481153429867,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5593714935765093022,14500759481153429867,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,628527513196091525,5992199872055761334,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,18001979688064155028,11945562861662876261,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,6933496910359783792,13946042034634424528,524288 --field-trial-handle=2316,i,7868126504769119348,7580282033691265772,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 15c2ec06f3c13450428c1843a8cd98d1f4ce848018da25e7b5dd1447b3cb107e
MD5 88faa4a8da97eebdf48db2e9861ffd69
SHA1 dc0b75148d6535c61044c584dc33d942d80efd81
SHA512 00236cef8d11de247224b1361d914dcacf2c60b44039ce5d709c64dd1c320281dbabbb74b545e75fb6add71ea3e8a699cdd185a6aedea6346873ccc071a57a63
TLSH
T1D6712C1A01F9489DD721A330F1CA1D1E7CF3F19B0E139E49315CD8BDA53A734E4A5454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b9d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b9d5.TMP
Size 3KB
SHA256 b04886497473b0651b99c69c4c82f2505bb84e67c6797da1f198c2954677e692
MD5 d4f765729b2cd1195c9461cfa9e989eb
SHA1 71dbbd7a52b712134a13c371cba02530b6683e49
SHA512 a8be50d5615bee796600d854dda975b23e0e11a1286ed5a1b5e08481971eb2c9d1e27dcc0076f8046bf5ddc7e18a9c0d348d5644e1d2f56b142db9df00fac120
TLSH
T160712C1A12F9489DD721A330F1DA1D1E7CF3E19A0E139E49315CC8BDA53A734E4A6454
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 819e65cfd28aa40f91361e3d7577bef1054714b614a971eb898789d3de0a17e1
MD5 1927bfa9479b22264166bdafcd81c4de
SHA1 99397eaf4e900dd6cd0e49201930043c77e87357
SHA512 ed6c0a2624e8d909a76fc8f0d7f5f8f529ca85203f2eced52e7ef57c7ed8ee28043f06145820c7112d0c08610ad0f17b3a68152fd6f522a532319c1de6ab7f65
SSDEEP 192:sxZmRlyM/jK1Ml8MkJ/fXsZZ4CIdp7bHW6+WNrn0fY4fIy+IgrJ:sxZm3MJ/fXsZZ4r/HbwfS9
TLSH
T15042D9166A349AB7CCDBD209F955BF53D6F50472D2900E44A9FCCA0C04E6ADD231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ca31839aa5e97b5c0f76691602e2c1ad95a6e257f42b02fec2c75a595972476e
MD5 06013a65442112d8f8abd653d6f09a2d
SHA1 2e103c75a240e6ad4f8a78992b0940258d7bd1e4
SHA512 84ad7932ce7af97f212de62920622f2c58819ee4a0462d983f636252fb7392955dc015bc9959cb4843fe687498fad5cfd81f6c472d33cb21472c929939a6f9fe
SSDEEP 768:6A8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdxrolkuUnh:6A8iJPNWvx76ru1jahALocdKLUh
TLSH
T17AD2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f33b983b62bf7171b9cd2122d22e68a2bb6239528f1ac2351a8e515d7bfd2952
MD5 8a0d61bbbf1f0ff680278c060e2c74e6
SHA1 364f00071491f4f75e5905bb69e01dd5a4749a22
SHA512 b4ce8822cb0b4b765b896696db1af6139593b8f389cc3f41f6aa6ce3ff7448ebee3893a2babe929063bb0cbcb488b4ab8f8b2d185562a1117ebf8d9d3e493807
SSDEEP 96:Ksg4KBW2qEgKNCOjsXTd5FkV5eP3bkKPB3lkLzT+dz5Wa7oUiggdVMxm:CXHSH8
TLSH
T124A1621731BB16122C3E2948F25286265782B5A33044F56B7BF904B64E3BF660CFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3471a8a602ea65d32df201e22a9645e3c56c5899a572db7c01bf1e2e438a3bd7
MD5 6e6932cde2f31724dbcc1c5917c72ba1
SHA1 d1e0e2fd46fe7033bf319cabfe4ab123cbcf7a57
SHA512 2f6b7c4ccd9d2505831f5e73c27dacd7dfa74e62abe94bdc64fa36e0b3b117670d68a82c661701d135f1d4978938fbf050c1b4c59d8cd3263eb581bfe36e9e9b
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop545DiBhPwivh50xy0SFYKCAxTeYNB:gONl6kDfQmiUyKiZ903plQi7ctU6
TLSH
T13102F93568786CBB8EA3AE46F44777275FE4112BEA852F84DAE81B1C04D724C170783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 91a91ecb40aa86a8e007db514ae47a3b54c7709bbe0ff0fecc878b92e6c52975
MD5 0aecbe5bacd0c2503c3294ae43cb669d
SHA1 9b13ccc34eef078087d04c3e47c9c3964b06fd34
SHA512 63b7fd9b5eb8a3ae1b2b57ec65bc8eee50520cc9ca6bfb0ee6660373e141d5c9fddd8685da61939bad3fc34ad306b6d1c11b1ada9f153685236150b520949845
SSDEEP 384:LZcIhsNOjdIOxSKQsukkTiSc6OObjI9G6w7mTv:Th7IOqTc629MI
TLSH
T175928D32AC785DB699E39416F08A3A275FF4903BD7C81F84D5ECA70C04DB5AC430AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bc0d29ed72ab12702ff6814c19299f91a05bff3f564ecebdf2d52f2b42c5703f
MD5 b2a8d84b2b129866996683ceb774f0df
SHA1 ac225fda6e9635c3192f68759e5728d8fbae7160
SHA512 5374aaea656d0afc55694e71301d25f8acd48a6637dbc107d773cb48046b046c5ed5f4b5283893e67d427713c8c91b8c6d41cf3c433b03196a9a427561e1e6e7
SSDEEP 384:xZcIhsNOidIOxSKQsukkTiSc6OObjI9G6w7mTv:ZheIOqTc629MI
TLSH
T101928D32AC785DB699E39416F08A3A275FF4903BD7D81F84D5EDA70C05DB5AC4306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c0820427abd89047a1282b7b11041a79f09eff428e911b15be837f21e7ced6e0
MD5 d2ef6d1061743cb27d125a8da3b39bd0
SHA1 0da9981436a98352ee74fe8ac79d0d593f2d0ae8
SHA512 90b3dc05411ababd250d5743995a8c60071aef0e1686dd8c76ff271d45ec17c7197960a8226eaeba3d39dfe3fd96254faeeb54a6bd90e13a5f5368c79c8d7c18
SSDEEP 96:FqONkHQsjpfmUTKK5ih/cIPURHl8h4otop54mpDiBPPwivh50xy0SFYKCAxTeYNy:8ONP6kDQmiUy1iX903pTeF3XcRoq26U6
TLSH
T178122B36A8B8AC7B5DE3A451F44736235EA1412BDB896FD1D9EC2B1C01DF59C130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6b282d5-c6c8-4476-9fbc-43b873201f11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6b282d5-c6c8-4476-9fbc-43b873201f11.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1017f0aacd4b2064fbf6f06932a1da46a79467fb19d903073f9f4a6ada22acd0
MD5 4271f841008ab4e04fcc5c87ab631529
SHA1 2b2d55785c53e71da2f19aca98ee54630982e5b0
SHA512 576fedd4a942094af0cc7996e8780abd86a16650be909d5eadfcaf9e9678e055e739801439aeeba4ea9a1dcd58580a84dd7622288f8af8e7e393a5a81c024bcc
TLSH
T16D412458BAE9114CB3B76F1A9BF6A86D447EB9732F07D49E00010D8F0A63B44C962737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads