hxxp://url7086[.]salezsharkinc[.]com/wf/open?upn=u001[.]Yt-2FGvB7h9XHnwpgpfFoFnxjaF4NfkSPWwXa-2BYNNoXc9EfzrPViyUxIEpU2ZT-2BtUjTAFzW4XRz1-2BVCIUc2f9Wl7otsHEgHilKhdeIEq2Thh4Z-2F9xqFuWoYlcLDNHLen-2Fi5obyqbIo4ZX2GJi0kf9Xgcs5r-2FjVtP31-2Fm0oFC1EKYhEVS6GK098reqojotm7mMWVuwX3iLH3uT4EksYaRIYJZNlZ-2Bn44hgHVgEbfmAIb5xBtTkaUCSwAZdbbjVj4QOHskpcn-2FoTGLU-2BqfqRXiRbbGDYbwyEg4-2FHHWjaXucqVlIMfHGkaUBAeEBdWpNnfHDTMqzEJdcD33MLim81THlCE21gelNHKrhc-2BVqT-2F3OPpnOrhtccvlxpZKyzlr7vOc6TfsqFZD4CkKla83dwVuAaEvJ-2BZ6aRfMC23FnEG88TnZlT9G5cdLuAUyencNGRWyu-2FfwgkovNKx9MEqRfZnW0Um8-2FARBkKv8K-2FCCFuMuphgugnrCKfmUOh4-2F6eZ2i3vbGt56uvDh1ss7RvC0zMSeBBCrr2mJ-2BZfwbjNx5vyJJ9Jjg-3D

Resubmissions

03/08/2026, 04:23

260803-ezy26abr9t3

03/08/2026, 03:53

260803-efw4fsyalc3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
18s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url7086.salezsharkinc.com/wf/open?upn=u001.Yt-2FGvB7h9XHnwpgpfFoFnxjaF4NfkSPWwXa-2BYNNoXc9EfzrPViyUxIEpU2ZT-2BtUjTAFzW4XRz1-2BVCIUc2f9Wl7otsHEgHilKhdeIEq2Thh4Z-2F9xqFuWoYlcLDNHLen-2Fi5obyqbIo4ZX2GJi0kf9Xgcs5r-2FjVtP31-2Fm0oFC1EKYhEVS6GK098reqojotm7mMWVuwX3iLH3uT4EksYaRIYJZNlZ-2Bn44hgHVgEbfmAIb5xBtTkaUCSwAZdbbjVj4QOHskpcn-2FoTGLU-2BqfqRXiRbbGDYbwyEg4-2FHHWjaXucqVlIMfHGkaUBAeEBdWpNnfHDTMqzEJdcD33MLim81THlCE21gelNHKrhc-2BVqT-2F3OPpnOrhtccvlxpZKyzlr7vOc6TfsqFZD4CkKla83dwVuAaEvJ-2BZ6aRfMC23FnEG88TnZlT9G5cdLuAUyencNGRWyu-2FfwgkovNKx9MEqRfZnW0Um8-2FARBkKv8K-2FCCFuMuphgugnrCKfmUOh4-2F6eZ2i3vbGt56uvDh1ss7RvC0zMSeBBCrr2mJ-2BZfwbjNx5vyJJ9Jjg-3D
Sample260803-ezy26abr9t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3336	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302046138385065"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{1B79B697-317A-4051-BE98-9155579982F1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3700	4572	msedge.exe	85
PID 4572 wrote to memory of 3336	4572	msedge.exe	86
PID 4572 wrote to memory of 4844	4572	msedge.exe	87
PID 4572 wrote to memory of 4844	4572	msedge.exe	87
PID 4572 wrote to memory of 4844	4572	msedge.exe	87
PID 4572 wrote to memory of 3532	4572	msedge.exe	88
PID 4572 wrote to memory of 3532	4572	msedge.exe	88
PID 4572 wrote to memory of 3996	4572	msedge.exe	89
PID 4572 wrote to memory of 4404	4572	msedge.exe	90
PID 4572 wrote to memory of 3996	4572	msedge.exe	89
PID 4572 wrote to memory of 3996	4572	msedge.exe	89
PID 4572 wrote to memory of 4404	4572	msedge.exe	90
PID 4572 wrote to memory of 4404	4572	msedge.exe	90
PID 4572 wrote to memory of 4296	4572	msedge.exe	92
PID 4572 wrote to memory of 4296	4572	msedge.exe	92
PID 4572 wrote to memory of 4296	4572	msedge.exe	92
PID 4572 wrote to memory of 1696	4572	msedge.exe	93
PID 4572 wrote to memory of 1696	4572	msedge.exe	93
PID 4572 wrote to memory of 1696	4572	msedge.exe	93
PID 4572 wrote to memory of 648	4572	msedge.exe	97
PID 4572 wrote to memory of 988	4572	msedge.exe	98
PID 4572 wrote to memory of 648	4572	msedge.exe	97
PID 4572 wrote to memory of 988	4572	msedge.exe	98
PID 4572 wrote to memory of 3956	4572	msedge.exe	100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url7086.salezsharkinc.com/wf/open?upn=u001.Yt-2FGvB7h9XHnwpgpfFoFnxjaF4NfkSPWwXa-2BYNNoXc9EfzrPViyUxIEpU2ZT-2BtUjTAFzW4XRz1-2BVCIUc2f9Wl7otsHEgHilKhdeIEq2Thh4Z-2F9xqFuWoYlcLDNHLen-2Fi5obyqbIo4ZX2GJi0kf9Xgcs5r-2FjVtP31-2Fm0oFC1EKYhEVS6GK098reqojotm7mMWVuwX3iLH3uT4EksYaRIYJZNlZ-2Bn44hgHVgEbfmAIb5xBtTkaUCSwAZdbbjVj4QOHskpcn-2FoTGLU-2BqfqRXiRbbGDYbwyEg4-2FHHWjaXucqVlIMfHGkaUBAeEBdWpNnfHDTMqzEJdcD33MLim81THlCE21gelNHKrhc-2BVqT-2F3OPpnOrhtccvlxpZKyzlr7vOc6TfsqFZD4CkKla83dwVuAaEvJ-2BZ6aRfMC23FnEG88TnZlT9G5cdLuAUyencNGRWyu-2FfwgkovNKx9MEqRfZnW0Um8-2FARBkKv8K-2FCCFuMuphgugnrCKfmUOh4-2F6eZ2i3vbGt56uvDh1ss7RvC0zMSeBBCrr2mJ-2BZfwbjNx5vyJJ9Jjg-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5992443003612815433,9979686812321901590,524288 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,12637644056731377798,17886084924018256420,262144 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,11377704291017156301,14418732365941225895,524288 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2971259189771167445,2685125817643058860,2097152 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1647142162296142037,11070216091525491021,2097152 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9545901888973516783,3125870751403501617,2097152 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,12924952386504194110,1424098283859135122,2097152 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7971639598286694157,16859854426086020698,524288 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9357019966870863731,14582143242133868527,524288 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2216066318007982721,298888625644337108,524288 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2216066318007982721,298888625644337108,524288 --field-trial-handle=2324,i,3305396567140472742,12039402968222047753,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f2a42cec1401eae786f0108539b11eec1d35ea69dc36ca35a0b3e2965007e5f0
MD5 236e66bf1ea4d4f7a84641a819cf8690
SHA1 2c9fbc101db8563481a46b5973764faf1cb49447
SHA512 52631e4fb62da6b12dcae5b9e6876c2e71c5218455ed6ce19ccb1d5e31594d8895e899cfae78a6fe5a31866325e3e4f0eeddc5cb530a5d5b4c6520532d5c7a4e
SSDEEP 192:sxZ9RxyM/jK1Ml8Mkh/fvseCYGIdpHQHpf6+WNP9C/YLcz29IgrJ:sxZ9jMh/fvseCYnwHOM/49
TLSH
T161520811AA346977CCDBD209B951BF53D6F80472A2944E44AAFCDA1C04F6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ff77b18c3140d4788b0fa0fbc02db2a7a7ddc2e9bd07c38a9f4fc179630ed61e
MD5 3887d629cba3443f0f044d2f711ec5ce
SHA1 e0c65d0f8b97980dc8607fb1b4b38563961d5b8f
SHA512 30d4dd8737bd0af710f05e0e8f910a5539bca16d674da8a64605580126b2d30c764c7eb09f4ee244dd9b9fa5c97aa4ee38bd5e6c28178ab9649286d63d978def
SSDEEP 768:ews6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNhroqE4:ews6pD1WvxzWju1jahILIsNaqE4
TLSH
T182D2FB3B680CCB7E4F841E5CEC2A6F967DD801CBAB94899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a68eca7da73284d9663130ccb3695c2caa36558af205f6e603fe0dd58894b2e8
MD5 5c2b5a50033aa9ddb4598a023d196355
SHA1 73d483efe5766b7900f20b6d99c9e3087cd4b1e4
SHA512 65025df0792d18dfa4d1d61e22e20b27247dd2c53572b3ef4ea7500e3541f49aa9413393d1a020bd31753dd7225f80b521c8035c9c924ba1804ff85dcb36165c
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFy5IZKakkzyzZ4NJ7nzkDn6PI6BkK1BU:KUAAKteP+y52KakSa2oKDiWwV+Cwq
TLSH
T121A1F30632BB12433C3E295CA294D727974671A33058B82B7BA851724EE7E344DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f731fb21f85814533560c643656745c23ae380827685bd0a87389b9f35b7be2c
MD5 054a61ca1d88099ac72f3446d59d40b6
SHA1 feed185d612dba72fabc2eb5012de0fdf0e839a3
SHA512 040d019088f84e1f5c2be18619d7caa2280a33fa259b733fea3854a80a78cac8f70047bbe5ed1c8f65c88d09b9522a4ea9745106df2f172ac27262ecf2acc4a6
SSDEEP 192:qON86O7+3hQmiUyI0Gttb0oO2bKh2hgGw+RU6:qON861UGt91ONMBLRU6
TLSH
T1E502F9356C686CB78EF2AE05FA8737235FA5103BE9952F80D6E81F1C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 92f5c1c70ec58f45fa13c22693505c50a384b7180590aba29c54a067a9716afc
MD5 80bd010314b0aa7fa5c7c923bdb59a36
SHA1 7cc98a1209c5bf2ce8124e32da9cb09693aedd58
SHA512 cbaf82ce81de86269748c2946ed3fc2d8ea82b14490afdf26660d955a643ba8c0082329ea8b2e3b6b5f177a3e565caaf4d96b72330533ea9edc5ebe583f19776
SSDEEP 384:hZcIhsN3lAteT4a91ONMGgzJr+DrXK9Li6Uq58bhP+wVrUBu3:ph4ThPO5Eh+DrwLwjVQBu3
TLSH
T1E8928CB158786C725DF2E142F94736178EF88077AAC96E80D5ED6F1D01EE6BC134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2d01a467a770d3d2d2e2cd0987faa18edc8bd561ccf03bb4fcd0e2d71be0833
MD5 15a1e2ca669ad2ac4b8cf0ec39072cb6
SHA1 6dcefcf9eb19b5388077fbd713aa76bb523e0518
SHA512 84d6f164fd03d8a577945ce128ccda8812b12d2ddf9d23527700d18fb765d0e4acaa9756f683c89f621f78cb28f49925e2d991c50ece8290a35469bef8342fbe
SSDEEP 192:EONK6O7+30QmiUyN08ttb0oO2bKh2GkF0SJr+UcNgq7RU6:EONK6ar8t91ONMGgzJr+9rU6
TLSH
T11F123A35B868AC775DF2A141F98735238EA54137EE8A6F80D5DC2E1C01EF6AC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bec4679627bf39379a1c6dbb27910d1aec426fbb5f35410406fc9a4a77cda273
MD5 ea398bfba6e58b6282c33344a8fa2ec5
SHA1 440cc759b2c7ec74db2d4ae44b03f726a2ddc140
SHA512 9347ef960daa0142ca05dcb21e6915a1988cd9b48923f6b29d670bd0968f0d77601523795112320aceb42d462badba2915ae0168aedcd5f23058642a4e5eedc1
TLSH
T195412A58A6FE1148B3B32F169BF7A56D487BB8332E0A945D00110E4F4662B40CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads