hxxp://bacon-rumors[.]xyz

Analysis

user interaction
yes
max time kernel
40s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 13:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bacon-rumors.xyz
Sample260727-qz3acstdqf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296333733965918"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{5B67CBF7-1740-4A03-B5F8-C415609C00D9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4636	1684	msedge.exe	87
PID 1684 wrote to memory of 2044	1684	msedge.exe	88
PID 1684 wrote to memory of 1952	1684	msedge.exe	89
PID 1684 wrote to memory of 1952	1684	msedge.exe	89
PID 1684 wrote to memory of 1952	1684	msedge.exe	89
PID 1684 wrote to memory of 2104	1684	msedge.exe	90
PID 1684 wrote to memory of 2104	1684	msedge.exe	90
PID 1684 wrote to memory of 3992	1684	msedge.exe	91
PID 1684 wrote to memory of 3800	1684	msedge.exe	92
PID 1684 wrote to memory of 3992	1684	msedge.exe	91
PID 1684 wrote to memory of 3992	1684	msedge.exe	91
PID 1684 wrote to memory of 3800	1684	msedge.exe	92
PID 1684 wrote to memory of 3800	1684	msedge.exe	92
PID 1684 wrote to memory of 3296	1684	msedge.exe	93
PID 1684 wrote to memory of 3296	1684	msedge.exe	93
PID 1684 wrote to memory of 3296	1684	msedge.exe	93
PID 1684 wrote to memory of 204	1684	msedge.exe	94
PID 1684 wrote to memory of 204	1684	msedge.exe	94
PID 1684 wrote to memory of 204	1684	msedge.exe	94
PID 1684 wrote to memory of 4432	1684	msedge.exe	99
PID 1684 wrote to memory of 4432	1684	msedge.exe	99
PID 1684 wrote to memory of 4432	1684	msedge.exe	99
PID 1684 wrote to memory of 944	1684	msedge.exe	100
PID 1684 wrote to memory of 4164	1684	msedge.exe	101
PID 1684 wrote to memory of 944	1684	msedge.exe	100
PID 1684 wrote to memory of 4164	1684	msedge.exe	101
PID 1684 wrote to memory of 4212	1684	msedge.exe	103
PID 1684 wrote to memory of 3212	1684	msedge.exe	111
PID 1684 wrote to memory of 60	1684	msedge.exe	112
PID 1684 wrote to memory of 3468	1684	msedge.exe	113
PID 1684 wrote to memory of 1420	1684	msedge.exe	116
PID 1684 wrote to memory of 1420	1684	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bacon-rumors.xyz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe171dc188,0x7ffe171dc194,0x7ffe171dc1a0
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15733851743380468364,9452932975012003829,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,612613647198992724,1411327280680751691,262144 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11979402338763045212,8872244610074749173,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17953037885147904156,7473283887071677059,2097152 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1760367922119111700,14928740619044252165,2097152 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12770249148882331210,605100493632491010,2097152 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10078093713439083772,7110768321919202758,2097152 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,10054053587073292466,15535073187234364219,2097152 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,10233062314806597245,503925924836105855,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,15515452438169653197,13964833275600182647,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,1194480596047720148,4297920958958003680,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,1194480596047720148,4297920958958003680,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,16095847240100978268,10045229547160677961,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,2054320393645071265,9534337384663478908,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,5809428750772772604,13533882451636052433,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,440051686368374965,14727114693773773827,524288 --field-trial-handle=2320,i,6473164020696168476,1246289998617122219,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

22edc3df-d567-4553-8681-a30bdedbe698.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22edc3df-d567-4553-8681-a30bdedbe698.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a57eee5644245d1e96f1d28a2f696940995b4fcca9c07cb0a4294715f9c79191
MD5 48acc099cefcc2c98825825b64d742a7
SHA1 790d955ab31d6e3529ab2fb8c7d8f71e71a46dde
SHA512 f895b3032734ddaa279e13f8cfe56b0ea0b3571854041ae68964dceff7db12b8be91ba007560fd788559fc61d08d9e601eb85a896c76d98cf443e8d80971894b
TLSH
T167816EB8024312AEE77D52319ED21E3C747382E8F9235F5B61A4D8B1ED957A3D236484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5891ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5891ea.TMP
Size 3KB
SHA256 0c00f5bf99be0f46e4b31d25518ee16eabdc31ecde34d6917471b9c51c1c1485
MD5 ec5c0953d2cbb45be2493487f828c7e0
SHA1 bcc84296faae81bf023898e1e7f8d66b5214044f
SHA512 8f20491c00b87fb4387821cf54bfe009eaf2b432c1138fae6d7646bc55b29876f010485191eca8420f31873e9db70d00970f9ea3b25c046ad56eae37380746b3
TLSH
T10B8160B9024312AEE77D52319ED21E3C747382E8F8235F6B61A4D8B1ED95793C236484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 476907893a4a0206a5e86a194fd58f0c8d59e3f60d95ddcc3183eaa1627c1e61
MD5 926f6ef10456b35dc2f878c0433b2b5b
SHA1 4f0db006a3176115627fe1dbc076123f0640a886
SHA512 ca69a8147c819afa25f885cbebf9749094c32075e2b2eec1b6272a8b309d72174f0668fef049b1c08d4ff39ad75ec47663288f98a47430cf99f7197e562c4dbf
SSDEEP 192:sxZkRfkN/fQsYYvIdp6AHW6+WN58U/YCIclwmIgrJ:sxZkKN/fQsYYAnHbN/7/9
TLSH
T15822C8166E3899778CC7D209BA15BF13E6F96432A5D45E48E6FC861C04E6ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 580d5e201ff72fc9b03e938086c7bd616c188a83ce76465490c8c6cc19e121f7
MD5 a00f7cf2cb1164813eab7fb5440c3a47
SHA1 c8e1f4fc402d8916f842853bed2a1bd0145421ea
SHA512 aeb24d3b2ff244ec512cf55ee8ec0cf619afe1f821b6f5245146de7f7ba0f81bbd714e9ce3daab2ab311f03a695af2c8a8f7f74f2631b084dfac33fd58088f07
SSDEEP 192:sxZkRfkN/fQstYvIdp6AHW6+WN58U/YCIclwmIg5WJ:sxZkKN/fQstYAnHbN/7/Q
TLSH
T13B22D8166E3899778CCBD209BA15FF13E6F96432E1945E48E6FC861C04E6ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 926842df0b7b0fb45c941a728c7606ba76fc1ef427394d45c8ba8a3de73f1e55
MD5 39c32e25baa3390f53c2dc1e9b770e3d
SHA1 48d558f8de9e887aed8340254d844ef5f9b53fb1
SHA512 7f3d83d84286f03f960e63e84aade1b9293b7987730de28d931a138966d11a03136773beab1a0aa630b7950fa3ea8d96f3cea061c586620f0020a698c06ef1e0
SSDEEP 192:sxZkRfkN/fQsthvIdp6AHW6+WN58U/YCK6lwmIg58J:sxZkKN/fQsthAnHbN/x/q
TLSH
T17C32E8566E2899778CC7E209BA15FF13E6F96432E5945E48E6FC8B1C04E6ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0538e88860e8c75c23a9c74f6ddc12632f855de6985b9b88304bf5ac84d1cbfc
MD5 3cc60d6e3273f8ecda950bfb9b7f43b3
SHA1 0d45cdf794dc36a92c5cd54120005a54e4e4b6de
SHA512 6e6ececbbf10433c6eebcceece9bbeef39d5dfbaf6feaed92ce4eb2e37db59676b105a2a76680218bd1d68440e1007ba65ccdeb4c4ca045e9dfc5901fc8854ee
SSDEEP 768:v5qbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrcroh:v5qbUj+WvSCs6u1jaaZLbWrHh
TLSH
T1CAC2D83F340CCA7E4F801E9DDD5A6F972E9802C7AB588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e5cb51d4e7da00c566bd0bccc7061717c6ac1cb761397199a4804ccf884a0ef1
MD5 fcb678c364a7eddc6e9d62ed4ac47f53
SHA1 d596119b4717f7a5bef888b59efe4644eb0375b8
SHA512 c327287ccd5a56498c53fb041a7f26b9a9f5d0cf28faa98e87cfe6b1cc8d8c10aa8385ab9d2918ac888d74dd0fc7bea9d040aad7fd1dbc5b89b622d72e7e78d5
SSDEEP 96:KlkdQ0uS+gyKHzssgK01s2gA8s3WEtGZiKCoIv+dhvtd5kxsUuZ5K2Quf5yXfkJA:2kdQ0uS+DKHQsI1s2r8s3WEtVhv+dhvM
TLSH
T1B491545530BF0A053C7E7908925595369E82B1AB395AA4BF3BB800F11F67E121DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e9b1562beb97f8364bfa44b5a84813a0932749d6f609d9cb0f050cbd69d857e2
MD5 21258447713e79311bbecb603dafeab1
SHA1 9646945b03f1c39688665d6442a93906503a7ed3
SHA512 e703c7f0de1cfa3432645b92c60bffb70ea00c56c6b6c3c1caa57a2ffe180ad16341ab9b1d9275d952699a07c8ddf7850460ee652694d21625f4de5d7f93ec49
SSDEEP 384:VsNQ2a+FOEa+mOByuv++jLHOObjI9G6w7Ea:VkNabOAqxjLH29MR
TLSH
T1A7725B3AA8388D775EA29555F08B3A17AEF8A17BC78D6F84E6DC5F0C01CB59C130B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 811c82dbd7eb66c4390be18fca5590f21920c02c7a700533ccf16aa22ca33c0c
MD5 469652524f7b1ce2a1f0733b2892cd85
SHA1 0b11671b1635bdc19b4ef4e9c520ee9c65271263
SHA512 51a053ded18a6ee400f5b70cdccdef2fbf98122f125646c2c5c0422583011d816f1bc14654b5633535ed77d1ab8a107d9579a2f94f75cc3624e25eefdc15389b
SSDEEP 192:mONh6DbdQmiUy4YDqBa+jqOmWtmtuv++JNz3q8U6:mONh6z6qBa+mOByuv++/HU6
TLSH
T11D121A36647C9C775EE26544F487361B9EA8512BDA8ABF91D6DC1F0C00DF65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7de67d6d10d9e739da3e1374ae7d9411fd10547d9798420049aceca5ca0a7756
MD5 f3e286a04704980d995672e258abce51
SHA1 cf9d62e6d2c876c9a3761e43456aee8ead0e34df
SHA512 b87cc8b8935d7c3c699646e9bdba8923dedc8f635c1b742bc4fd5d2877e657cefd9f8efb534374fc8f94eff073c6cbbf8109657e181523b9ac784e0705f32a7c
SSDEEP 192:vONx6Db6QmiUyrDHBa+jqOmWtm7RgQIU6:vONx6uiHBa+mOBHhU6
TLSH
T19102E93969786CB79EB2AE49F48B37275FD4207BD9562F84DAD81F0C00D764C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2476a072f535eb6cc353e9015ebb4b88149089654e144118b09a099a743e87ed
MD5 e1394145782c0be06d1817c1aebbb809
SHA1 3fc4d17760c393f55f163eb2be93f00321e1cc21
SHA512 7c0c0f6ef97757c1e4ca2e6bbfa5637c3bf589c44e715403efa5690b934707b5d43030dd17375fb9a43db22781a2470b2eb52fb39005772908e5b4136dbdd41b
SSDEEP 384:WsNQTa+FOEa+mOByuv++jLHOObjI9G6w7Ea:WlNabOAqxjLH29MR
TLSH
T1E3725B3AA8388D775EA29555F08B3A17AEE4A16FC78D6F84E6DC5F0C01CB5AC130A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c568591-4a12-4e13-a2a9-3e718e862d96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c568591-4a12-4e13-a2a9-3e718e862d96.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 81bc28286ed72388144019053ca3896a703d90ea116885c81d62bef174602683
MD5 abfe9577c8628577d58a38bee1dea0a3
SHA1 7072138b59e739e814d18d0f883050602e2ed87d
SHA512 5a305dc2dc14cdc4283f29ee96d7a541fbd7a0b581b9df0f640986866d270ce16b8340bd86efd6116f207acc6c85fb44df667994752c5a0470b2085dab768468
TLSH
T1F841D958A6E91148B3B76E1AABF7AC6D487FB8772F1AD55D00010D4E0B62B40CDA2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads