88308a6bcc8f76fffd1c18c28213cd568fb0d63f2920ffb30f7504d5d89e7ee9

Analysis

user interaction
yes
max time kernel
58s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dexter_dk_release/CasinoLoader/master.html
Size 1KB
Sample260727-se3fqsgp4y
SHA256 88308a6bcc8f76fffd1c18c28213cd568fb0d63f2920ffb30f7504d5d89e7ee9
MD5 2b50c51fce89ddcfb769effdeab7080c
SHA1 c027bff71bf051731f2a1e0eefdd750d33f832f3
SHA512 79b2d8e0b6d6b0e687bb32a5d8a382b202e60f2c7bdc3c762e95f5c6bdb2ba6abfcf78917ee9783914e304ed6b961db52bbcf9e0fcb0cab87e9d51bd9771b9f5
TLSH
T11F3142B3A4FF0D3A93E67C75D2A51142ADDA0700A101934B7DBA79C2669D3E447BB3C8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296382339339110"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7C3B8F63-7108-4DE9-8340-079059D9FF5A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1416	740	msedge.exe	85
PID 740 wrote to memory of 2400	740	msedge.exe	86
PID 740 wrote to memory of 5036	740	msedge.exe	87
PID 740 wrote to memory of 5036	740	msedge.exe	87
PID 740 wrote to memory of 5036	740	msedge.exe	87
PID 740 wrote to memory of 2128	740	msedge.exe	89
PID 740 wrote to memory of 2128	740	msedge.exe	89
PID 740 wrote to memory of 3992	740	msedge.exe	90
PID 740 wrote to memory of 3992	740	msedge.exe	90
PID 740 wrote to memory of 3992	740	msedge.exe	90
PID 740 wrote to memory of 3780	740	msedge.exe	91
PID 740 wrote to memory of 3780	740	msedge.exe	91
PID 740 wrote to memory of 3780	740	msedge.exe	91
PID 740 wrote to memory of 816	740	msedge.exe	92
PID 740 wrote to memory of 4956	740	msedge.exe	93
PID 740 wrote to memory of 816	740	msedge.exe	92
PID 740 wrote to memory of 816	740	msedge.exe	92
PID 740 wrote to memory of 4956	740	msedge.exe	93
PID 740 wrote to memory of 4956	740	msedge.exe	93
PID 740 wrote to memory of 400	740	msedge.exe	97
PID 740 wrote to memory of 400	740	msedge.exe	97
PID 740 wrote to memory of 3348	740	msedge.exe	98
PID 740 wrote to memory of 3348	740	msedge.exe	98
PID 740 wrote to memory of 4612	740	msedge.exe	102
PID 740 wrote to memory of 2328	740	msedge.exe	112
PID 740 wrote to memory of 5104	740	msedge.exe	113
PID 740 wrote to memory of 3700	740	msedge.exe	114
PID 740 wrote to memory of 3992	740	msedge.exe	116
PID 740 wrote to memory of 3992	740	msedge.exe	116
PID 740 wrote to memory of 4236	740	msedge.exe	117
PID 740 wrote to memory of 4236	740	msedge.exe	117
PID 740 wrote to memory of 4236	740	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\dexter_dk_release\CasinoLoader\master.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9095ac188,0x7ff9095ac194,0x7ff9095ac1a0
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13179409393772186282,16698785006285400947,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9947681515498731190,16201806363572889863,262144 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,14459661448976026898,6810245935576276369,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7381337211628763164,8837595232647536072,2097152 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14095946107199223080,1503602014121326118,2097152 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10843800088247443160,12265641412033118055,2097152 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10869974755597880595,5124788547933873046,2097152 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,2805382409224050335,2846463033049820369,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,7918500691717654800,17594596301071449947,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9302309309172187023,2736046101861975214,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9302309309172187023,2736046101861975214,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,18359185443661824903,11673718399311366193,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,17482770028950888038,1388319745722991827,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,1470318577899239299,11347215857057868005,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,3473489936796397731,3466440127172301296,524288 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6416,i,2987994990314731761,573700396846384455,2097152 --field-trial-handle=2192,i,125651455366362564,14950938925546596552,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2d1e0a52038762220b6f727fbad269af722a0b78a96ecadff8460ce7f53b355
MD5 f04ae80f403e549e2c831a85e11e0094
SHA1 9f66e2cb9b3fd0ab816dcbdb3c97b4f5784a661d
SHA512 a9a321e4f2fc4b3674fbf9b69df3d4936cb216e02dedd85d4801218760131faadb339a1898f5a3dd3d1fbd1c83cc949822fe2115b424846fca85403fdd086c4d
TLSH
T1B7714C364087DCAEE71D00706CC181F334718DEAF9471E9B91BC2EB41A17B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589fb6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589fb6.TMP
Size 3KB
SHA256 1d41f1c024e9edfb60818b84acc1143a5c2496dba2ecbc17774bdd45bc7cc30a
MD5 86cbfe3ab45d84e105504303cc381e94
SHA1 cb0860590e3b99006632694eb46780ac84a838d1
SHA512 a446635e18b4ed5f3fd0cb88d167628fe2334ef74d3b223a1eaa33286fe180fcbe503172003d8fa8258093c92ec792793f9198a51cb76ee312c441f9050d7213
TLSH
T193714D360087DCADE71D00706CD141F334718DE9FD475E9B91BC2E741A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8edab032b3a89015e488a66af34068ce2236198dfcb6bf9b04aed12a717606a8
MD5 b27737fdb3940c2dbe9febb69f0e1193
SHA1 a3e5377723265ecc6213b36670c55f0ccf54bba5
SHA512 e70411d9c781cb5bfc56f887e2f3e8ab3a0ca71001a280a7bfa064bbde19d8766aaf8ae55736f15e41e4c79e8bb33ddba5dcaeac6824912922c1c4b991d111a7
SSDEEP 192:sxZuRXkR/fZsMGupzkIdpdrHW6+WNGYzQIszIgrJ:sxZuOR/fZsGpZJHbGj9
TLSH
T1A922B7566E38A47B8CC7D219BA25BF53E6F9503291941E58FAFC861C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 78d13ae8885ba227b1cad4296d902a3c7ba7f2877ed771791d5e22e5300ae650
MD5 c4974d0af18375f7b956e69276d8016a
SHA1 ca0fdfeda7beb6ed26c77ded818880ea0af6dadb
SHA512 473aeead90fb7714928c71b310488d46c32bb946c318484d77e791537c42ce0af7927c8577ae7b6878b7f481ceaab9d3237467b7eb807bc776d79a842ec65e8c
SSDEEP 192:sxZuRXkR/fZstGuwzkIdpdrHW6+WNGYzbAszIg5AJ:sxZuOR/fZslwZJHbGOy
TLSH
T13C22C6566E28987B8CCBE219BB15BF43E6F9503291901E58A6FCC71C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0b05310cd66a2b6271e7a944c03224521cf8bc4eb1c5b92ede9cc6291284a593
MD5 462017f2c13a8a5f97a6ebb267eb9aa6
SHA1 2d828a31a12ca1d1508bd3dba2f16ba82ad5122f
SHA512 9621c4fc26c6b7e37925e12afd844cc93cb4fcb0a4cafc148b2cc801b5f3fb30ca1c51305e89503a52e1f82e11aa867d2bbb2040fe53d5bb8721bb16230bbbb5
SSDEEP 192:sxZuRO9R/fZstGuwzkIdpd6HW6+WNGYzbAszIg5AJ:sxZuSR/fZslwZYHbGOy
TLSH
T17922C6566E28997B8CCBE219BA15BF43E6F9503291911E58F6FC871C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fb470db32fccdea877911c8b2557b48d9fda45fb3d6bbec5bd2556a9ad1bc585
MD5 9749864d0632f386f89d735c145e120e
SHA1 974c8f67b34b8e177ee7264175ddd243f392ef62
SHA512 07c1f8497c76b2d13c2f2c4f4a30b5ba664ccd172572fd24d88b9366ef2194861118ad03fe2c337e0078b2663c7e730c350985ecd3eacf7d1a41a9520841ce8a
SSDEEP 192:sxZuRXkR/fZstGupzkIdpdrHW6+WNGYzQIszIg5qJ:sxZuOR/fZslpZJHbGjI
TLSH
T1FC22C7566E38A87B8CC7D21ABB15BF43E6F9503291941E58B6FC861C05E7ACD231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 86a991ee17ea1e09866bf3c8ebcb1ec71f231f3959448e45cd5d05f1770a13bd
MD5 9d7937958711217c960c10b38e1b6eaa
SHA1 a664dbcd3de0d4e468abc0b72e7e1c3d0ff5cf39
SHA512 1f9cb4b87edcea3bc56c2040236201179f5d8add0f5183ded00d0cde5a9c168908d9c45f989e51e76234623fac68d4113a5d5fb25fe37291d524423937d7648b
SSDEEP 768:oak7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBHroybY52:oak7u70WvqiEau1jai5LA3BUH52
TLSH
T13FC2E93B744CCB7E4F801E9DAC566F973E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0f9bc26753234716a96a780bd953b5b8e3d883f5af1c1a65784f2f927316272c
MD5 43b03a35379955df3400405dab654277
SHA1 93737d67792ce2f9b3fa66a8939273263857cc00
SHA512 997bcf55f06f0eaadd6e47e8147ee743c38a59416f7de3440af319b38539f3b7eb158f571f27dcffc1e291f035c760648c7cb598848e14bb4c570ca8bff6691b
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcMO5IxKKMsjy5AIDKJj:KIbCKcvNSKWc55iKKMSKAoKJj
TLSH
T10191AA06327B120138BE2D4C92D5D53B8E823D66715CA56F3FB404AA4EA7E124EFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 65a821e1e8bdc4e8ac6cfa54a5423f879ca1aaccf7573ad69c74e304b83a2a76
MD5 e8f162a1f03f20123f9e43d9c84f44cf
SHA1 41c2c74e4c94e567bdc8faa71c43f6c2ae6cbfca
SHA512 24210a2e26bb9679ce012b06069ce353209778de4eaca5fc3eec37ec8413c65609ddcd020f63c5f3c9634d0e23c7e98e41c9b0a453ae307df7c7ba53368487ef
SSDEEP 192:MONx64BAQmiUyp1rW5GBPKIOCHruaDTjU6:MONx6eAqdW8LLvU6
TLSH
T1CD020C39AC796C7B9EA2AE45F48637175FE4113BF6945F44EAE45B1C00D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8ee2a1282cec9e513da256c51892be0df32cceaaf2e36a0d3f31ac416a08cf2a
MD5 a1364d8a1a1f464e100c19704418d9e2
SHA1 c8736e856fd80b4555904c780ed946bedf0d09a5
SHA512 56490159e99883a314750bdc31edf6a65286ae482f7a6fc0b14e8f96f323e90a254c1e45167099bbd7cf9d98079beb2ac769c5431d1352567f8511fd879daefa
SSDEEP 384:LZcIhsNmTyvhkbGPn7LClg3OObjI9G6w7eX:ThqGM72E29MeX
TLSH
T1F7929E36AC345D369AA7A112F4CA3A175FF8913BE3C45F40B1ECEB0C05AB99C531781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cd1200cc904b17e0647ce68b2c9306547006ae754c08e3f2d549038909bb764a
MD5 8ffacf12343b123a12027754c25fdba2
SHA1 1761e1132e1f81d1f2c10213b0f51a92b8d5289d
SHA512 9286eb687dde2f5d00dade8a7f3a78c9b1755b7650230dc2ee4bd8604055f99b6703d175c7c179ea610aa55772fb7c4f0ea940abbf31f896e9a4f230e0f5b9e3
SSDEEP 384:JZcIhsNmmyvhkbGPn7LClg3OObjI9G6w7eX:BhzGM72E29MeX
TLSH
T174929E36AC345D369AA7A112F4CA3A175FF8913BE3C45F40F1ECE70C05AB5AC531681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5274d1247d876ab3f8c6b179eefab70d886bc277121947087fee29d5e030d708
MD5 dfe99b049632457db2e8bc1da4ebaa0d
SHA1 57eff463c7c18e4f791bdf88f7da871f50384bae
SHA512 4a04646c0bc5a846f8ed2bee1c8d9aa9d79fef489992b23c0e6704c10198c4418aab0ee84652c2460f8cceaee471b48b2b2a7fd6565bc423294a70cb7a512009
SSDEEP 192:uON364BVQmiUyBrV5GBPKIOCHrWTPNWWwgbqUU6:uON36ezoV8LC0g3U6
TLSH
T1FA122B36AC75AC3B5E92A541F4C632075EA8422BF7846F40F6DC2B1C01EF69C631781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c32e9e80-7835-4fdc-b88b-c8696ec77c7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c32e9e80-7835-4fdc-b88b-c8696ec77c7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a47b742fc7540ff580108aa4ac1466fa861d6d74063a842da20f2a860d94b2c3
MD5 faeeb7188f114b9966b6985bbca7374b
SHA1 64e92c055e94a1af9201b25cbb6b53a7147b5d22
SHA512 6de717e6fb08b7b89c25a4f578cc6d7048d763aa40c807a483bdb9be8ee555ab1b7d71151787e306b35d22c019da5f7d4f0356fac2482d5c018698b988e39c3e
TLSH
T133411A9CB6ED1148B3767F5AAFF7A46D887BBD372E06945E10110D4F0623A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads