6dbed299a969a0497829064e4e112419af48293b8b469ed7f03e6c395a587f83

Analysis

user interaction
yes
max time kernel
28s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CCS Universal EXT.rar
Size 763KB
Sample260729-js4raafa87
SHA256 6dbed299a969a0497829064e4e112419af48293b8b469ed7f03e6c395a587f83
MD5 aca6446b4eb0caac73d7dc162981bda4
SHA1 5c9319ba14fdf15062258b5b3ea41cdb8e351afb
SHA512 3bfba557310034812988d17beb0b263dea574e2d8f5b8a070d34f5be6e3751c043d3b9a53e9ef760b5795c1f3daf5112c28197909f67c25375d5b03f772b00b8
SSDEEP 12288:rgXB4Kt4ICtQtV7dW8bz6z8KC3nBYHCDXsL2a/Hrjnu9w1r:rKqQtC8bz1JYiD8Sa/Hro4
TLSH
T1E1F4233D5A485F8CDC6AA206D5B814CE6B5B549DBE567E2B0A3DFEE3C0320AD1B53103
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2016	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297854357490781"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C29EE56F-A558-4393-A340-E7BA04CFC8D4}	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1804	7zFM.exe
Token: 35	1804	7zFM.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1804	7zFM.exe
1804	7zFM.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4520	4652	msedge.exe	88
PID 4520 wrote to memory of 3732	4520	msedge.exe	89
PID 4520 wrote to memory of 2016	4520	msedge.exe	90
PID 4520 wrote to memory of 4696	4520	msedge.exe	91
PID 4520 wrote to memory of 4696	4520	msedge.exe	91
PID 4520 wrote to memory of 4696	4520	msedge.exe	91
PID 4520 wrote to memory of 1772	4520	msedge.exe	92
PID 4520 wrote to memory of 1772	4520	msedge.exe	92
PID 4520 wrote to memory of 3456	4520	msedge.exe	95
PID 4520 wrote to memory of 3456	4520	msedge.exe	95
PID 4520 wrote to memory of 3456	4520	msedge.exe	95
PID 4520 wrote to memory of 780	4520	msedge.exe	96
PID 4520 wrote to memory of 780	4520	msedge.exe	96
PID 4520 wrote to memory of 780	4520	msedge.exe	96
PID 4520 wrote to memory of 784	4520	msedge.exe	97
PID 4520 wrote to memory of 784	4520	msedge.exe	97
PID 4520 wrote to memory of 784	4520	msedge.exe	97
PID 4520 wrote to memory of 3992	4520	msedge.exe	98
PID 4520 wrote to memory of 3992	4520	msedge.exe	98
PID 4520 wrote to memory of 3992	4520	msedge.exe	98
PID 4520 wrote to memory of 4152	4520	msedge.exe	100
PID 4520 wrote to memory of 4152	4520	msedge.exe	100
PID 4520 wrote to memory of 3560	4520	msedge.exe	102
PID 4520 wrote to memory of 3560	4520	msedge.exe	102
PID 4520 wrote to memory of 2776	4520	msedge.exe	104
PID 4520 wrote to memory of 1520	4520	msedge.exe	103
PID 4520 wrote to memory of 2776	4520	msedge.exe	104
PID 4520 wrote to memory of 1520	4520	msedge.exe	103
PID 4520 wrote to memory of 448	4520	msedge.exe	106

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CCS Universal EXT.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7fffcf96c188,0x7fffcf96c194,0x7fffcf96c1a0
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,985934379261566451,2673292172956991408,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10426356813832177697,5474248138229621945,262144 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10560006489875544435,14164469782886288979,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:8
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,13364734440535429209,7535813270893248153,2097152 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,6745386608809477719,5100114831078921990,2097152 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,4008193928579224466,17894944121389454462,2097152 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,18333980174727993015,84235583203950879,2097152 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:2
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,17609641848246148975,17604155310751575273,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,1366049479961728176,13936806779558260328,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,9730989421429073377,12467925553583979366,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12237521060957037623,9523854169337437746,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,5502290973141424019,13812556068871729130,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,5502290973141424019,13812556068871729130,524288 --field-trial-handle=2236,i,5128262271589874301,10528555888612937106,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 708e876707839da9f639c204692b3c7a035a923d8480bfb6c7765a2198bb38e6
MD5 71fae70e2f75e14b7fc750c2504962a8
SHA1 dca44375c034bad5f03d4e7ff5bd98f142aeddb7
SHA512 0bac6462d77f39f1e98fa8981fba5b3b17f08e4847d969397284b28faa95d662242739bcc7a1f9ad6a62dd9fdeaad5c0e4263a0673b24d45eecbbbb99c0fd5db
TLSH
T15AD0A722791D7495E32F42359522D21056691073A6625305B314CC1D99784C456D1BD6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 17073a6195da1e22a3e4feea78dbe417968f1e23918e595ae4afe7def6fcb7d0
MD5 080b2bd25f870ee6d9a6e06c3dacd6ab
SHA1 24cba406c797d3f5863820c40af925faf16471d8
SHA512 aa3cf3b6028708f86daf2199378791203b7f6798fbf25856ad75215dd594d38214e52393349ceb4b48b95055f773703f9dbdee03e29200d3916745b46a48ee30
SSDEEP 96:KJIb9ELvKmVbtAcq+58POUbmPV0vHhiZRLVrQ82L:KJk4vK0RVq+58P7bw0vHhi+82L
TLSH
T16BC1616C44891963CB6C1632D2B74C886E3CFC564FCA2E93E431573CA98FB85CBE0064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588122.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588122.TMP
Size 3KB
SHA256 06f8f76526d63b5c37e2f4c8dc0e72cbe92de8323dddf6f4a10157aecc8acf4b
MD5 7da7592026e1dc795cb48da6f2f1d5c3
SHA1 94a7048dcedf8499f2e51153e78405ec1f54ead2
SHA512 598d2374e4161f6b558a3affe71e82018af8e7648b9134f7f1b89a450eeb38089a06c5129b3c7c4a2047940183946d127fcb0bcb2c774f5f160bab1e824d5d5b
TLSH
T1D371E92D084E49A3E31C2732E0E3098EB274CD994FD74EA35438993D568EB56CFE546C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 557fdf35ba83a4c2cfbbbe88603295042e00c346bead531d7edbedb66b9de3fe
MD5 320d9030a767cbb36aa46683fdf14860
SHA1 02d9cbefd74ed28470744d7bf15555e3ede0d72f
SHA512 ed6989ab0fd3c7ac351b94ecfeeca7e6eaa7eb99380da12f1278c799807003c39f3c803007779f347a7eb3c2c36e3d5190921c518f77049200e8d48ab4da0653
TLSH
T1A751ABF7C7E6816ECD1192F0AA14AF1BCE2D0552436C7C5A85D4AF0BA3F2471E151A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5e5d8b692b371e8243a6edda676694f73434c11233b53106985ba80f99e197a6
MD5 7c7fab58f47337482103362e4d3f51f4
SHA1 7903f54d8cb3fc6351f757ef616f89f5f88e94e7
SHA512 9101ecc829cc599b9911f7227beebc4216bb90b8201bafe296a397fe25be7a98d7f2872f215690d0afcaa9598f412bd075ac6b0658610c94e8cc3b82072898ad
SSDEEP 192:sxZNQUnJRyyM/jK1Ml81j7/fUsqWpVsBRbPIQdpmGHW6+WNql0S/YH1eWpiIgyJ:sxZlnJ887/fUsqWvsBRpNHbW/eoO
TLSH
T1D772F8166A24597BCDDBD219F9067F63D6F91422E6904E4899FCCA0C04F6BED2313C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9fa55702fd74054a97b88a6b4c88f224e1f363b0f9837d7f6362071f3aa46b9c
MD5 08a9374bafa623c2dc962cfd7bacc105
SHA1 e58f2de9f59fb7144a002332c540c89ba6e99a73
SHA512 3ac908106b638cda09127ee514406e64b9880e178566789c369bc87b2152ad42d5b9f043bc6a105a0b20a60c9fb9c1b8f6ceb27de51c167960db841d6acb6456
SSDEEP 768:ovUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R3roV80N:ovUZYTMWvg0Pou1ja7eLZmRk5N
TLSH
T102D20A2F284CCB7E4F844E5DEC2A6F863DD801CB9A984D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 b772900fd1abf61e12a8b394af2ffcdb17340306f32ad2d9f41f5eb2c827851c
MD5 54da4becbf9dacf61114e2a022a10be0
SHA1 2846913932543b47cc1cbd13a028bfbd2ee7b01e
SHA512 76c3cc2fbe1ec051c46ecc9b3747f76f7b0966249fdcaf38b9755a75ce8dd017035ae75d6f15a1b6766be366dfeba070fc5225b5259bd8e0ed4797df0b578707
TLSH
T1FEA00220CF801405C22252B5155313411310C9B41244330B40A380ACCD505404E8114C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 eb4595d799f0a534bde41f93c60f58b4a6f35fca4600095eb6e927e0e04fab29
MD5 eec2a39238ea83c8edf567f1758cfc2a
SHA1 e4c53c33cff2741636655e2ffde69cb81be812fe
SHA512 80f8d762f9c43ce7393e4c657007f76eecbcf8693104a40926e120500cd90344dd2bb83335ce560beda41c7d7aa34eabb5a10e8ee164771c588ccfbff683c5bf
TLSH
T127A0022512843040C05211F615D655635BC4499105001725C2D0009CC8E474D6B6210C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 340bc8297d677a916303f471dcf4da6ad26208dab8ca5f312e10519cb47ec7c0
MD5 35d277ff757ab03fdebef57d65542271
SHA1 b8da90dff046c49da3fb049f472955f4a3246c6d
SHA512 6a5c032e53bc8e996ef47301e472e47d95fcb7ba9a1d5858332fa7c9e94f54c97182cf0bccf224f4f6b3f6727a25d0c583ea094abdfff3b1ce8a24f842089211
TLSH
T16561A60A4DD59E9FECA800B314BBA5D47730E4DE4F52E713A81C31346DD73292E9A5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 8215a294b746ad3d5c9f25f8f378d16d67a268394e982a448da08a131bd461b8
MD5 129f5b7b84e8d5f39defaff8261151be
SHA1 3c4e62b53e258b9583506d4c6785df7fb90d1fe7
SHA512 261b34b23b5e26f670f854d8e9c13edcb5a377d1e15657751deec7ac78502d5771fd1d1b1d077f9162da4dd7933df9b1c45668f1315e45c170c0fbce74d28443
TLSH
T1983121499E60C9DFF8A441F210B6A1A47370D8CC5B12A3138C2C21327E277192A5B1ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe586a3e.TMP
Size 1KB
SHA256 6164f9f12e17f4e9f287e29995f32b9571715687a114a291a488938289ebe85b
MD5 f50f225e8e5951d27423ad02e59cfaa4
SHA1 62456d08dfd974d9ce47f67e57a92387d553a662
SHA512 5022af557b9c94af471cc197822715bb012e244a97d546b6ca12c39f38bf64b7e4d18aab235aaef8d292236dd73efdb1c0617f37df2dbe8937db5dc87a11383f
TLSH
T17931464B4A808E1AF8C4507709A7A4BC7376C9408321B793987C6239AD31BAE1F5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4dbcc32c50c1598b4b9d95b48c7466914890556206df11a5b032346eb0b6e1fd
MD5 fe8952fca82a9909190cca2a9c3447bb
SHA1 2d81fb2473bce839c0a6829af121bf6cb7023970
SHA512 2c57124c256e764551695796a85ca0b88dce18f24531da6d4d0c37a06dc934fa9d30e06180fc99f0b0b16b747e1939d57e58c1d958ee6fc8ed261d2a24e9333d
TLSH
T17CE068F33EFB1814AC6BC3D64471A4A4050238A8C64CAE8E00AAA2A310B2310280AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 023e384322321f70d77db626292448456d46c4a4ccbc168d1df7b55ff1e06526
MD5 6bdab189c66719efe6d556cd52799782
SHA1 f2fbe77c1415fabd6666500bf0f4d748a39cc91d
SHA512 a9156928737f7998cb168cc90dfc471fbfe8009251caa7ef02951ea0752959eb75cb455f27b6efc2466f76bb30a8fc2e9c30b0b290cd8257bb555e669e10c732
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5880f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880f3.TMP
Size 48B
SHA256 cf679584522c15de350f6cb1cc5a4fc28221d49901f2176e6df4cdc8f4fd7b52
MD5 9d280a183139818bfc28e3ffff8c0663
SHA1 af7bcaf3a3fc2aa9ccd8d3773c4ec7ce029e0837
SHA512 4d5f6cd64b920b9e3a4b55e3070c5cf47c661b48e7e715a05c2d062d613b4164f0543ee701452579ee1cb8ad096373ffab9274a3f0b7ce5750104b2ef09be1e2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 04ca87f3fcbe0d22fe5ad7badf1a9151a9c212b91338c52104698576c52b55aa
MD5 c61dff0f5d505c05e87563599c695f6c
SHA1 5631dc053a3654078dd7bb4cb5a00b57feb51f30
SHA512 419db94d73e433d9fe50c2629f446e5cf0a9e17604715f04fc792151aa1254c6827c61ff4cf8e7c4990dddbb19892410452973e2e197f41b5ef55825651cedf1
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEgUyRWSZ:EurfyVlJyRWSZ
TLSH
T1DDD1E24272BB02033D3D2918A39987764F86F5A33418A42B7FA840B55E67E345DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fb699738b07503bf49e687403b940d43d6005cfa2490e2dfa4cf0d8205f90ebb
MD5 f2369e2e7d86597af264c9abac175420
SHA1 52103478a66e00882367b15e7919a73382909300
SHA512 2f40f60eff97d752f681969e3aa9ed2bc738638a2dd8d8d317c7d4e48f1c1996f55f3764a10e21c555997eb0bbea27a3e8561d19c7b6ad4277eb3ad4216aab9d
SSDEEP 192:yONR61VWQmiUymfgGX5Obd+j1jzory0aoX/am31IU6:yONR6WjgGX5od+d8y0VC4IU6
TLSH
T16002D93969686CBB8EE2BE4AB48737135FD51067EA942F84D6F81B1C009769C2347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90e63779c4a3e41cc405bf12d7420d2c2453335322a258d1ca222a3f74417f9d
MD5 b14453dc97f1c0ab7cf27902651b53d9
SHA1 25e792e425bce8dd7b6cbcf9d2d3976458ec2ad3
SHA512 a8b19b201973d5f2c85d7e31eda2160c35aba31fe693f63c771b47eaf118f835f378df08ca4a60b42f07cf899f9b3beebd9876ddf02613bfc017e1cf4e76b5bb
SSDEEP 192:eEONw61HcWQmiUykf8GX5Obd+j1jzory0aouX6EUjJQqDU6:1ONw6xf8GX5od+d8y0VuXRMhU6
TLSH
T1AD120936A468AC675ED3B555B48732139EE55167EB887F80D2FC1B1C01EB6AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2e74fb14757b540760e97e56a22ee8505a9ac047df49dc4ce12591d25a8d342e
MD5 86a2f9467f4e634e51e194260cdc62ed
SHA1 7d04177b3654e8057fcbdc64f63ac8715d31658f
SHA512 7b4aa087b6fd843a14bfd425c954a7b222b4966d48b10559ee081e19788c158d2d53838b7cf51dc62e14662e1a9ebdfe3e58f2983e0522d9ac6735a8333af4b2
SSDEEP 384:n0sNyUITVmfMgszX5od+d8y0VuXRRXQA3tv+awLoHkK4i41aUScjmwaq:0OBEO7+RRH3nEK4i41aU1jZ
TLSH
T169A249B2D4A96CE748E2E0C9A646F5126DB40173CA8C5B4CD2FCB73C309F5F86316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

3260a779-4fbf-4afe-9bee-40986dfcd85c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3260a779-4fbf-4afe-9bee-40986dfcd85c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0ee06a2ca75367f0867c581096519e2d955b9522117feb88abada40fbcc95d79
MD5 eb73838fc657a81fa03e6b2c292def20
SHA1 02399e35725b7286f93e4fa7b8a98368b0e2d899
SHA512 aac3997ed26a7c2e130f9633f3745ceca4e580621e0f40e9d176c973c064e003c3fa31f853b949e12683a906a6017c5a8b227df47a93fdd2bf9200dda2123951
TLSH
T11E411A58B6FA1148B3B77E5A9BF6A46E487EB9772E07D49E00110E4F0562B00C971737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads