hxxp://www[.]mmr[.]gov[.]cz/

Analysis

max time kernel
30s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.mmr.gov.cz/
Sample260803-lssecstfrf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302240986532294"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A358B4C4-8815-42D8-880E-916C817BAED7}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 860	4152	msedge.exe	84
PID 4152 wrote to memory of 3944	4152	msedge.exe	85
PID 4152 wrote to memory of 3012	4152	msedge.exe	86
PID 4152 wrote to memory of 3012	4152	msedge.exe	86
PID 4152 wrote to memory of 3012	4152	msedge.exe	86
PID 4152 wrote to memory of 1392	4152	msedge.exe	87
PID 4152 wrote to memory of 1392	4152	msedge.exe	87
PID 4152 wrote to memory of 2000	4152	msedge.exe	88
PID 4152 wrote to memory of 2000	4152	msedge.exe	88
PID 4152 wrote to memory of 2000	4152	msedge.exe	88
PID 4152 wrote to memory of 3204	4152	msedge.exe	89
PID 4152 wrote to memory of 3204	4152	msedge.exe	89
PID 4152 wrote to memory of 3204	4152	msedge.exe	89
PID 4152 wrote to memory of 416	4152	msedge.exe	91
PID 4152 wrote to memory of 416	4152	msedge.exe	91
PID 4152 wrote to memory of 416	4152	msedge.exe	91
PID 4152 wrote to memory of 2348	4152	msedge.exe	92
PID 4152 wrote to memory of 2348	4152	msedge.exe	92
PID 4152 wrote to memory of 2348	4152	msedge.exe	92
PID 4152 wrote to memory of 3164	4152	msedge.exe	95
PID 4152 wrote to memory of 3164	4152	msedge.exe	95
PID 4152 wrote to memory of 3164	4152	msedge.exe	95
PID 4152 wrote to memory of 4980	4152	msedge.exe	97
PID 4152 wrote to memory of 4980	4152	msedge.exe	97
PID 4152 wrote to memory of 4980	4152	msedge.exe	97
PID 4152 wrote to memory of 4228	4152	msedge.exe	98
PID 4152 wrote to memory of 396	4152	msedge.exe	99
PID 4152 wrote to memory of 4228	4152	msedge.exe	98
PID 4152 wrote to memory of 396	4152	msedge.exe	99
PID 4152 wrote to memory of 1056	4152	msedge.exe	100
PID 4152 wrote to memory of 1056	4152	msedge.exe	100
PID 4152 wrote to memory of 1056	4152	msedge.exe	100
PID 4152 wrote to memory of 3488	4152	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.mmr.gov.cz/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbc092c188,0x7ffbc092c194,0x7ffbc092c1a0
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,14553681377217096401,11509933402617001468,524288 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,2239848292317547289,8966276096519867851,262144 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,8916303366989032396,17393903412898823076,524288 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3852674018418950630,16773252154072974319,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9257963496925025541,3407591474511855067,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,9533483197397939312,12281070785456571422,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,9626953708443801622,13372361291734249991,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,1853774192506453034,9234932304673949822,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3660,i,1923401624431223222,3245130556958355640,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,1492339166321418202,4110353119552308440,524288 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,5285625175731468131,18186312364927211305,524288 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5392,i,13695112055612649251,11685838261760508688,2097152 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,5489735188594167672,3826775330838676452,524288 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,5489735188594167672,3826775330838676452,524288 --field-trial-handle=2364,i,13520417849489213828,14651348537270377967,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 86f58006da590b6a6397eb32ecab83559def6e4467e696655355071b7bf2aa4a
MD5 448f19b0779a65b0be650a956fa5df6e
SHA1 3baed8e409ca650111c9646e8bf0dad44ff672b3
SHA512 f7785f7b3b588df9949bb0ddf9ccce50e7ecddfe0d32752bd78b9bf0c7255c65a9c30533b1b6de2eb00570b5d4f393e3d3d59d030c093e0902b082d13b1d4f37
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T1A5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 51017e36a70f82ecffa1ab80ec899cae3d7b9e92ed4a3899c3358d03e16d8567
MD5 060795a18baa73c55705f8da22daf3d9
SHA1 5fa45e558673b5f892a2466f672f8589314f4bef
SHA512 994fe9ec6c32dfab0dd47d028a4b5220f4e3c32baea2a9a308ef808ae7f2b8a407cc4bd6be8274a5d84aed15f98144fbd54af64a2b3ce1f4baa6b1da4d0c10d2
SSDEEP 48:ZL5KNe+jr4BYpnqW6t19d2qyVZsZujhQWOTz7L6cHM4/gsTx1IpwuWUnLpZDmxs:F5KNJrgYplw8qOULTzihs8wuWsL+s
TLSH
T1FE915D304D140090FF201A33D1D90A79BC75ABEFF25F6EAE274D52B4FA0334A129C80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588d18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d18.TMP
Size 3KB
SHA256 c47ee0958670757e1d7c075adb1188d9abdaf5c189590c484a8838973be844ba
MD5 72d393ab0d7154983811e7185c4232f7
SHA1 3d126edda84c2014d494cadf48f8e120dcac292e
SHA512 274d5edcef929949945780a102bd661b5e04cab8ae30a17fbf64867c317a17c800193a6bb22e360e8a406f27ba7f64fa3960941f7fa67f3b3cb9f01abc14191f
TLSH
T10A7127340E0900A1FF200A33D4D50639BC72AAEFF61E2E56234D66B5EA0234A139C65B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d5b81d0a602b3800b3bb7ff10011f0b519a92a92ed7011fd809b52f57235d8a9
MD5 83b9312f759c5504f379937a0784629a
SHA1 10a8f9c47fe21b93a3ea4904d4311afa05d70136
SHA512 f8640019aedfabfa2f8e660b16f137b14352707893138b67af5dba9470c040de71d8a6d43159264ff05c6b7e0a51ba353cf7f7d9d25294a641de68e2a47f30f3
SSDEEP 192:sxZlRjyM/jK1Ml8Mku/fosV7OfVUIdpEkHW6+WNyCQ/Yv/L+pxIgrJ:sxZlZMu/fosV7OHhHbM/dj9
TLSH
T1ED52E7116A74A977CCDBD209BA45BF53D6F5057292900E84AAFCDA1C04E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dac8e47ab17edab1690d4d228b3f2a4d3c3dd951b3c7fd01363a23b7c4dd4297
MD5 4d68cfc2ca8f06bd0eb689129c0866a7
SHA1 a5cdcb8877eff6909c963f1fde6ba93b5447ac80
SHA512 4b15b6bfd754589e78e538c9f3375d2bd903720677f81a9985d735531aea88618ad450a025292eb0c24861bd7f8990b5834814576799d103633903af2fcb3255
SSDEEP 768:7HseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppAro4U:7HseJ3xWvhfynu1jaVcL88pLb
TLSH
T14ED20B2B280CCB7E4F844E6DEC266F966EE801CB67984D5487FA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1ae200ff7a3649fb636c01a7fe21b7649762c6686056b9eec3eb8a425d32637f
MD5 827d2ad21d6ad33ad49e01c7c85a7f2b
SHA1 e8e2b3ee9ae324e3ad477b22de04fc6124b6c4d7
SHA512 362e32f7e2f64ed9e9af45ee3f57dbc61b153d15d6ad5a36067b26d06e4d2cde22abfed472fee64a69641a8fa8880fadc1eee454bd405b1b613de8f2cdae9eb3
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiwk:KYH+KggmiAgK1KyODKKkU2yesKLiT
TLSH
T19BC1C812313F02023C7F355CB2AAA7374E4135A33558A8AF7BB810A55E6AE116DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 55817000d52e56a1f9cf4e4038a3fc08b3c3d109f85c84ab553583d364eb2814
MD5 9b1bf2d64ccc0ddfa828572bf6c26412
SHA1 a5587c9fa43d692a987449fc6ad6bceb923ddf4e
SHA512 2abed898d9b052abf16fd5100fb262e6ef8e086255d25a1d955f1ac51e2390534954270c4a21fe607f8efc6856b9362d91ceb44d155cc4244ef0343981ba3aea
SSDEEP 192:uvm+xasuheOwQxMGsNNxQrbgM7/bfQmiU1h3P4MTW0+FdLuhpFd3EZ68z1jrqVbO:5ZcIhsNNx87Dh7g1dyZdU9qbEj
TLSH
T1E1626B725C74687BA9E7B185F44A32135EF4817BE6C46A90E6FCAF1C01DA6A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3efd87e7ad376a0859c1f429c510f91b90662aedc69e69d98936f0674a909223
MD5 da626af1e1231303476c3159b0b0cb85
SHA1 81f6f7b81f89336c228eac507bca12c5606a0312
SHA512 e0d344831c7a2392ba8f6774189f59d8adea6675464691c0ca841aa78a12162e50b952463d88398a0d435873c49a155a902f850d225dd21d464ac08a85832cee
SSDEEP 192:lON06vMtPQmiUy/sThTW0+FdLuc847HbLU/u:lON06UtRbTudy+7LU/u
TLSH
T114020935AC786CABEAA3AD45F48A27175FE4507BAAD05B50EAEC2F1C00D765C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7ce87e1884a940077f27290afcffd165053b02919db5c103db3e5970bdbfbd57
MD5 1c7fa7852ebe67b6201660ac9a4f522f
SHA1 5f8049a9f0f9a6191b0e926fe5d8d2fdedfa6c65
SHA512 59deaf8547a81c294b04447303d84b56a96838529f717c15d0537072df68f002a7094657f1978ad78139fdea8e4e0f3bafead252b0fdcc8a5ff76cfb7a58fb97
SSDEEP 192:wONI6vMBPQmiUyOsAhTW0+FdLuhpFd3EZh80IjrqVbU/u:wONI6UBRQAudyZdUIqbU/u
TLSH
T1E9122B716C746C6BAE937585F08632175FF4817BDAC46B90EAEC3F1C01DA6AC1307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f77272e24ecd865ddd535fe67623dc83af6cf70f6468ae42a5c8925bcead1106
MD5 1c83699891e238ca781d6c657e430375
SHA1 14aea238bac430713aad784a2c243250eb844e29
SHA512 1fc6bf47c1c1f1d3a6aca7abb27883b7114014d3d70a0ce340f585687ce12d60834f476e03d183b67472e04e55ae25ca30e283b8270936b63552765fc0871ab2
TLSH
T126411858B6EA1154F3B76F56ABF6B46E487BB9372E0AD59E00110D4F0632A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads