hxxps://www[.]veml02[.]com/tvr/dPPwfYGpzKrE9F8V/8aQY

Analysis

user interaction
yes
max time kernel
34s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.veml02.com/tvr/dPPwfYGpzKrE9F8V/8aQY
Sample260730-kcdqlathjd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298736290923876"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B265A407-F973-4D96-8935-BF42A65658C6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2308	560	msedge.exe	87
PID 560 wrote to memory of 2792	560	msedge.exe	88
PID 560 wrote to memory of 3360	560	msedge.exe	89
PID 560 wrote to memory of 3360	560	msedge.exe	89
PID 560 wrote to memory of 3360	560	msedge.exe	89
PID 560 wrote to memory of 4608	560	msedge.exe	90
PID 560 wrote to memory of 4608	560	msedge.exe	90
PID 560 wrote to memory of 4008	560	msedge.exe	91
PID 560 wrote to memory of 4008	560	msedge.exe	91
PID 560 wrote to memory of 4008	560	msedge.exe	91
PID 560 wrote to memory of 3508	560	msedge.exe	92
PID 560 wrote to memory of 3508	560	msedge.exe	92
PID 560 wrote to memory of 3508	560	msedge.exe	92
PID 560 wrote to memory of 2480	560	msedge.exe	94
PID 560 wrote to memory of 2480	560	msedge.exe	94
PID 560 wrote to memory of 2480	560	msedge.exe	94
PID 560 wrote to memory of 1044	560	msedge.exe	95
PID 560 wrote to memory of 1044	560	msedge.exe	95
PID 560 wrote to memory of 1044	560	msedge.exe	95
PID 560 wrote to memory of 4892	560	msedge.exe	100
PID 560 wrote to memory of 3220	560	msedge.exe	101
PID 560 wrote to memory of 4892	560	msedge.exe	100
PID 560 wrote to memory of 3220	560	msedge.exe	101
PID 560 wrote to memory of 2492	560	msedge.exe	103
PID 560 wrote to memory of 4768	560	msedge.exe	106
PID 560 wrote to memory of 4768	560	msedge.exe	106
PID 560 wrote to memory of 4768	560	msedge.exe	106
PID 560 wrote to memory of 1560	560	msedge.exe	109
PID 560 wrote to memory of 1560	560	msedge.exe	109
PID 560 wrote to memory of 1560	560	msedge.exe	109
PID 560 wrote to memory of 1976	560	msedge.exe	110
PID 560 wrote to memory of 1976	560	msedge.exe	110
PID 560 wrote to memory of 1976	560	msedge.exe	110
PID 560 wrote to memory of 1708	560	msedge.exe	117
PID 560 wrote to memory of 4264	560	msedge.exe	118
PID 560 wrote to memory of 4132	560	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.veml02.com/tvr/dPPwfYGpzKrE9F8V/8aQY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe0d44c188,0x7ffe0d44c194,0x7ffe0d44c1a0
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,17611470927638246593,17884164989989159725,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,17126699092507731059,3697700609888337317,262144 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,11994603325413033210,1261676113832486307,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14632598923890620797,6960375705566148841,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6488064296765508355,6518841791488490879,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,7520075894296561193,11675471046034557922,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,9693374305435719920,11719496809671310458,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,3306836796607342453,6212132118116795771,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10083316596170640495,14540118205723800150,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17814946409196855803,4173871529562206674,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17814946409196855803,4173871529562206674,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4404,i,18329797114916463603,14115572065567135836,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3556,i,10540870899931634660,5561959926094112504,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4996,i,17234188233880462267,13160611643961438529,2097152 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,1058609499755281096,11554148707368135202,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,5786196646466423207,15851213742164164473,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,14314584788228822437,8601431572295729764,524288 --field-trial-handle=2344,i,87376214420509002,18054284133439347885,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ed50cb84aabeeaf35353a5952177ba564b792ee00ada159b79095fda0807b06
MD5 7550a930bb2b2530717d5d802a0ccdf4
SHA1 4eec73a10a3cdb0e8fcc3ac7631f51a0c823969f
SHA512 45703cc4521bfa2b4751bddebe14c043defe5e81cf6cd5faa2030a847f6a141faa2f51d66fd3c48bc73b15b4833b7bcb7e0da85d20d682e13d53e0f27ab90ccb
TLSH
T14A812A38715612C8EB6686BD73D2D24032F0A4E8F8931E02914B59BC3A0A7D143FB4E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cf22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cf22.TMP
Size 3KB
SHA256 7f7dd79d7382609b9011821d29b337be2f8b3872cc250a0582e362b674e97d59
MD5 271a02bee9179d7d73a35ff2ce8a442c
SHA1 32d4234478d0e5965d1f785aa8fd2bb6e2248c7c
SHA512 8add31fd6b93f67ed79df32c155849b94d95ee9b7ddbf51d45e09b142368cbb2cbb810896f8523e164711b6835e1b6935169ae5b609b6ca0116832a5604b54df
TLSH
T1E8811A38719A12D8EB6686BD73D1D24032F0E5E8F8931E06914B59BC3A0A7D143FF4E8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fcd2041bb251a568c5e501d60bfeb807718985b6e0115feb87ba12d56ebaca00
MD5 6d953323e5d245f93d6135adca812d05
SHA1 e90c7f75742a45f84df0f1f3f641bcb4bd37dd08
SHA512 8bac6c86f83091efbe0c2be9801dedbd0efac19c1995d22b6c9806ae90845023a4e5ac4fa6af3fc0d9c23826f0dc1c1905bab3747186a6f01f32d5af5048f830
SSDEEP 192:sxZ+RLyM/jK1Ml8Mkd/fmsTJTQIdpJHW6+WNGYzcvy5/IgrJ:sxZ+jMd/fmsTJ1JHbGK9
TLSH
T13C42D6566B349977CCDBD209BA557F43D6F94472A2900E48A9FCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 96de02fba6a27d2f952d77393e3164aa48237f1e5788cc3abb38a907bc82863e
MD5 8bf759b9bc4419d7811bbc31089ef7c1
SHA1 5e895487e2f438b147c1ce7b9131c67fa36b5ec2
SHA512 8d04f0f7bc500b2f9337daaa766813a364d209c3758788237040f6c700dedd6508c7e1c9c0e5bdb6caf3719c50d1338a61300f6a6f68b91314bd737fbdcf4663
SSDEEP 192:sxZhRLyM/jK1Ml8Mkd/fmsBPrFQIdpzwUIHW6+WNRai/YzgvW5/Ig57pJ:sxZhNMd/fmsBPrDIHb1/2FT
TLSH
T11A52C756AA345A77CCDBD209BA457F53D6F51562D2900E48AAFCCA0C04E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c58c0ecdd70f188acc81d7440beba066c46ac760b7dcdf04f978045f242a8416
MD5 dc042b33df5e3a854d23644dc9ec69b4
SHA1 1c7668d443da9adf7f4cdf6c040e2fa9caebba1e
SHA512 6b58d9a518f88f8285e8e9ba9b995d77ff08d80d7c2f61afb62f0c9e4413a9f23083070d73214c8ac1ab3565227161003842cead9cca22d07c593a4dc59bacb9
SSDEEP 768:XWW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjYroIPi+Ym:XWW7kf0Wvqidau1jaa5LA3jjzm
TLSH
T1B7D20B3B680CCB7E4F841E5CEC266F966ED801CB67988D544BFA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6e6694534cd58a095abb71ce95e71d40cc21cf7c11550d74f05e17d5d5da9e0f
MD5 d381b57e866d00f43e522e97f1755a37
SHA1 140a63ab5b6c8e4471025110a26e50bb1b23e770
SHA512 33f073c89ad7541c597bdd951d96fb6c5c07efb57266eee88957b55c18570d8b48f85c02044fd60c91cf48a0df89b6ab3f1661d07d8eafcd32ca57bfed79cbc1
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTrGIvKLS0nyF1IxK2887ylvIxKAo:KIbCKcrGgKLSum1iK28iOvmKAo
TLSH
T1C7913612313A568239BE6C4995D9852B8FD231A33618A46F7FBC14670F26E12CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 587B
SHA256 676b8b2f1d4aa2e1190b4b54df6d8cf1035885d878a0e972004b13612a4933f7
MD5 36d2bf2c2f7f6becd18a21f4f7465513
SHA1 6ca2a36c182f5cf0e6008aa2b1a4359c5cacc60f
SHA512 7f7e3107e54a6ef85c986bd023144f19c9147a5a37c0b2054d4c5fe0784560077c9fe81efc6d69185aded9a2853c01b284bfa497f139581a97f339f8b04fbad4
TLSH
T19EF0F480B2B930DB5E4DBD42D60D9407E0F179A6630D5871132D4CF95F84C16CE5ED69
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7c73753fb4d28ca9a813884780624bf1b94f6179e54c7775eaa921b4c3b4f2f5
MD5 d2163dbb9889b08db02ead61009c27f1
SHA1 d9ec45d0a6bb6cd0f0a4a24e1d37979ca8da4d33
SHA512 0b54063186fe2fa3d5ca57f0396546ee24e37a965056bd8e31725b0ba61f24948ec83dd881d0643b7e6375e0a6daa605868505669cf87c772278a4c2269dfb9c
SSDEEP 192:uiLsNDELQVfTBbFmQmiU1UkZc4aGBPKulCx9FLvGAdNZCq1vHoDF:LsNDWkNbIBZzoDFDD3vHiF
TLSH
T162423B7A7C785C3B5EA7A141F58A36035FB8416BE7C46F44E6EC6B0C01DB2AC130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 58d4cfa80643d29d882f7749f0bc883758fc7cae37bcbd8ad903ce5f020fed83
MD5 bc53fcd3287b7dfe5f7b40175ad1d34e
SHA1 aa11db987ca2d70d046161205061cf2d583268e8
SHA512 657a08ccd238f7b98df5b8c57d72582ca4212a9bb0dd19bcc8456150dfa3cd471482f8e6af882e6de2b0675fff2084fcd49a652d31c3e57bceba8001d6e96167
SSDEEP 192:MONH64BAQmiUyk1LW5GBPKulCx9FUaDZq0U6:MONH6eAbxW7DFFJU6
TLSH
T196020A356CB96C7B9DB2AE44F48A37176FE8117BE6945F44EAE82B0C00D724C230342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 25ec122b5ef44718cd83aeb5ece6dd4b531f5229c606ce9d17f97c1e9870d78c
MD5 734b92228746de50669c3383d535b5e1
SHA1 d0f2441f111cb2befaf7dc3c475ad771f140083b
SHA512 a2e706c1d710850c6cc637f336093765e4917f8f54fd3eb1b1e0de464283d56ba3b63ae1e09daa761acbf9cec1d15ca6b0c48a3c7ab6760e93b40cd08ce5ad9a
SSDEEP 192:dONO64BOQmiUynLh5GBPKulCx9FLvGgWwZCq1U6:dONO6eK2h7DFDr3U6
TLSH
T1C5120A76BCB96C3F5DA2A541F48632075EA5422BE684AF40B6EC3B1C01EB65C270741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 0204c49d02e5f7e1449f7d8cb9c62f35dbfd4317a75a24f04ef687ab7a3d6eaa
MD5 97655961234f07aadf6454c5384a0c09
SHA1 7a2a9d8f20e5d179e50891215f82481e0663c914
SHA512 f3b85b3fc4cd06934f8f476435833a16b1e1a9e878f68f2758b8605c1306fea9a4579b8bce15d3fd789a3228e885c2c35ec2984d49512bb35ba619816696b7af
SSDEEP 192:uEm+xasuheOwQxMGsNDD96QVfTBbFmQmiU1UkZc4aGBPKulCx9FLvGAdNZCq1vHh:iZcIhsNDJ6kNbIBZzoDFDD3vHii
TLSH
T119726C766C745C3B9EBBE141F58A36135FF88037E3C4AF44A5ECAB0C05EA668131791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c6d6b5ff818ee2e8b12c58c104ff982b9718479a797118f8a81ed3c1602713f6
MD5 dccacee0b47bede7314ab69292f4b4bb
SHA1 de706a0b71181e793c79a5c172c4c3b38f4bafe0
SHA512 f199749c2b6cb34e020f495ad5e2f5d52e4f5c91d563ff76a70bbc0bbde6b6654d2a39344e8186fb95664ca4d2e4a4711b7e16c53c77c369f6441345eae30ba4
TLSH
T12B410658A6EA0148B3B7BE5AABF6646D487EB8722F07D05D00110E4F0722B40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads