hxxps://chamsaccess[.]com/admin/

Analysis

user interaction
yes
max time kernel
42s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chamsaccess.com/admin/
Sample260804-r4e63acd75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4264	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303282878953054"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{21A57809-AE35-4A78-BF24-7D2CE8D27A12}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3692	4384	msedge.exe	86
PID 4384 wrote to memory of 4264	4384	msedge.exe	88
PID 4384 wrote to memory of 2180	4384	msedge.exe	89
PID 4384 wrote to memory of 2180	4384	msedge.exe	89
PID 4384 wrote to memory of 2180	4384	msedge.exe	89
PID 4384 wrote to memory of 1840	4384	msedge.exe	90
PID 4384 wrote to memory of 1840	4384	msedge.exe	90
PID 4384 wrote to memory of 1088	4384	msedge.exe	91
PID 4384 wrote to memory of 1088	4384	msedge.exe	91
PID 4384 wrote to memory of 4192	4384	msedge.exe	92
PID 4384 wrote to memory of 1088	4384	msedge.exe	91
PID 4384 wrote to memory of 4192	4384	msedge.exe	92
PID 4384 wrote to memory of 4192	4384	msedge.exe	92
PID 4384 wrote to memory of 2864	4384	msedge.exe	93
PID 4384 wrote to memory of 2864	4384	msedge.exe	93
PID 4384 wrote to memory of 2864	4384	msedge.exe	93
PID 4384 wrote to memory of 3396	4384	msedge.exe	94
PID 4384 wrote to memory of 3396	4384	msedge.exe	94
PID 4384 wrote to memory of 3396	4384	msedge.exe	94
PID 4384 wrote to memory of 2996	4384	msedge.exe	98
PID 4384 wrote to memory of 1984	4384	msedge.exe	99
PID 4384 wrote to memory of 2996	4384	msedge.exe	98
PID 4384 wrote to memory of 1984	4384	msedge.exe	99
PID 4384 wrote to memory of 2428	4384	msedge.exe	101
PID 4384 wrote to memory of 3884	4384	msedge.exe	111
PID 4384 wrote to memory of 1524	4384	msedge.exe	112
PID 4384 wrote to memory of 4484	4384	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chamsaccess.com/admin/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff9cffac188,0x7ff9cffac194,0x7ff9cffac1a0
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15619297550590207867,10475506432869546506,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16362574112594444778,16570728161366605217,262144 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,6861806689995115852,4013168384708782418,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9710747470572079731,8476206276791583765,2097152 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13211099077922504231,2084793258725688828,2097152 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,669978525449703436,17611727050541685225,2097152 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6614812645411100191,3276197518652674906,2097152 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10354404698993396033,3849655585112616104,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12779683973184410914,17021481244067330576,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9627722968930195883,5407288553738797942,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9627722968930195883,5407288553738797942,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,12891238147720700909,4632117632931916669,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,17424430449493272007,13909305116677301763,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,8300957105247799336,11138801994292924581,524288 --field-trial-handle=2344,i,17395161540637795370,8161814385103731826,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 486KB
SHA256 c3dadb05b3db6df7598f4c3e0e6a44e8a34308a8733f312d0d66b0171ab2a50d
MD5 1f935868bfb8b10918ef07dfd0ad765f
SHA1 6419dd3bf50cfdeb8742522e979e9602ae4dc77d
SHA512 5c3a0196a99e3f6335e5343d7cc2fd2c9db4ef7278028da6b3297360b1504e176ab5cedcef24ca4165fc5897eaa54ad625c89718c515e4e31861855586f99e73
SSDEEP 12288:jN410W+BypBShfGrlWtSoZJzsnuGE/sxREYDih5gF:C+BypsmE1iu5ADos
TLSH
T15FB4F1524EC82FE9CF5C5D1C90FE161EA3B10B8A5463608EEB337D96AFAB64142171CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 970204696a6f7ab67313478f30ef817341db89bf066a74a229a6bedc5922d40e
MD5 a43ce3d7fb5393400e60cb8074197045
SHA1 247cf52cffc89756a618ae05125cf8fea3685c1f
SHA512 5eb138e3b3542fc0fe9b4cae7537066481f476d313a119df3cbd5ea5cef92a2dfb5237605ee6217ff2ed7db4324a4b3d741a1ec8e15beeeee9fce749747e16de
TLSH
T1C071F92B06C31859D7604632E4D102027A3EDC9CCF63BD66537C447EFA0A7E28CD64C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e0a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e0a7.TMP
Size 3KB
SHA256 4f02371fa9bc445addc0659529db008f69ef11a22777b7dfd750f2ea850d4a53
MD5 097a50fbec5cce137898d6c2af0b5416
SHA1 fbeffdac49ebb2b17421c90fbf533da606903660
SHA512 6c572bcc55c567e2db9eb5d1451af8428d1397b55f8c2f7e8dcf9b346addbc87f763f2d07ca1fb0e7fdef84a44ba005aeaa0ce2801d75500a76a1dabccbca29b
TLSH
T13571F92B06C31459D7204632E4D10206793EDC9CCF63BD66537C447EFA0ABE28CD60C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f251d5c8f542e0368f3b2da460d85c965b7d6a366ec15631b0e8e81516d77e9
MD5 d168398be0a790b3b8c6292ff7371f31
SHA1 8ab0802e2f9284d91a98c92e04ca1850d2035dd4
SHA512 c34a01f1f5562075dfe6131b97b88514b521cbc120ce54b41dd1e474322006a6eb783f8b028997c9acefb1d0b47133339693ac5a58be6660f7560c00e9ade139
SSDEEP 192:sxZlRmyM/jK1Ml8MkE/fXXs7q2EtIdp8KHW6+WNblXZp/Yw4slQtIgrJ:sxZlAME/fHs7qJOPHbB/q9
TLSH
T17B420A126A34997BCCDBD309FA557F53D6F9147292900E84A9FCDA1C05E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 40bb297a53b8bf3b43cdd73e045032a4eea80497835b9ff3e905e747b8e7ed56
MD5 1eedc96f6c33f2db8ecb9767a046b915
SHA1 902e890870a81aaf3db08962626e6c56cdad686d
SHA512 f694356ab656cf07715c66bfc3090a885019abcdb1574eaba3e8ef393afa52d3efd35a8f53f36e6e1e5247f97ef4495c51b06085c7e2d0e45d55a59be689cace
SSDEEP 768:qD4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d8rohkcOfal:qD4jeXmWvmKLEu1jacPLZQdnJOu
TLSH
T16ED20A3B244CCF7E4F844E5CED2AAE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7381095e1a41edc31bfe0355e362cc6c475771f6c666e796558931efc2a12c36
MD5 6d491e142bd2fbae9d5e6d9eeb9d5fa3
SHA1 9d988aea9347abaa8677bb9404ebc2aac2505c12
SHA512 c449ff15e0117fea7eef6f0d24beda3f756cdb817390fc67a7407026e1a16fa85908990018583c047eeb2a7e7c3bf2a78c3372b1505fb7d6d91f5b0381b4d26b
SSDEEP 24:KdZ5fZUZ/ZmaZjdZLZHZv4Z/ZD+ZmIjZTZvKiZIhaZNZv1EZZZ/SmZRMZE8ZXZk9:Kk8IXKdOcfyl5IFKagIKIIbKZ68/yG
TLSH
T17A91341576BA82413D7F290C87A487578943B153380DA56BBBAC40B38DBAE105DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 978c5b8aa57e61c89a42d045fbcdf044120ea28c5970bc29ee5edbfff474e126
MD5 f0949e2e253fb9bc7804343342889baa
SHA1 b79616f77ecb648359e1ad2c8570f6a2d881205d
SHA512 b105adbbf13752c62af5544a01a2565cf640a1a7489cfe0c004338cac7432e9a926fe5f47d2bf4e9f4632b62874e9cf252fe48195321d12969f5c64ff0cbd949
SSDEEP 384:aZcIhsNI2nx9hwWf+x82YEX27FMNBeRs9JKgqijU7hOGq:Yh6xoG62pMNTjKgqmU7hOGq
TLSH
T1DE927D715838AC775DE2B681F49A36134FF95027EBC46FD5E2FC6F0C019A59C131A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5588cd49dc7321935b55a5a5c9d12438032a3a03d88e00133367c5f7a70dbeff
MD5 3e14d2ff0dd59b8e91dcc646249fc968
SHA1 b37ba86735148f48bc46b18b6b93b9b82598b20c
SHA512 963759bc3d24943cb2915e0862d8d551fbdaf8ca964470171bd430e33ddb345274690e2a9addd05003d0c750ff091786ae98257f2ff250117c5b853be781e260
SSDEEP 192:EONs6hZ0QmiUyq8pc/+jVLjzor2Yl5wOZMHjU6:EONs6oapu+x82Yk2MDU6
TLSH
T14202D935A8786C778DE2AE46F48737135FE5112BAA956F84DAEC1B1C00C775C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c0256b4e31b5006009e9dcc23aaefa8d7001dff1740c2d034335351c4a656860
MD5 06be3426e1292a354162386a827f5786
SHA1 884940b1052e0762e20d225deae9393593c6be3d
SHA512 4e9eaebfe98dd04a7c0dbc7f02a8915bbcb1929c7f7b1417b36cbe09abc7523e739845ef73263d6bc8a8e0198650b9502def5d66e4342ad39f83467a1a40d3ba
SSDEEP 384:9ZcIhsNI/nx9haWf+x82YEX27FMNBeRs9JKgqijU7hOGq:lhvxiG62pMNTjKgqmU7hOGq
TLSH
T1C8927D715838AC775DE2BA81F49A36134FF95027EBC46FD5E2FC6F0C019A59C131A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 367023c13926b3d23132fc842e4592522540e24a105f075630cb8c7ce0149bdc
MD5 bda57e06497b807f33528afc548bb074
SHA1 3475455d2bdc8b29c34bf0e6d5ed06713009a5cc
SHA512 7651e5a570a9c606653330c1f328b1513a3327bff61d94a2a341db93f84bc9826114bae806f85904156c3baa4101e43ff0b0cb546cbaa13c6c3deb226c217224
SSDEEP 192:eONJ6hZ7QmiUyS8Cc/+jVLjzor2YEXxEUmH5cOqMBrqAU6:eONJ6h6Cu+x82YEX2w9MNU6
TLSH
T1DA12EB326878AC675DD2AA55F48B31135FE55117EE897FC4D6EC2B1C00DE6AC134AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3cd4f98-05f3-43af-9ad3-806abb0ea049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3cd4f98-05f3-43af-9ad3-806abb0ea049.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fb02d76926a08c148b25f338a6c9ef30e515d8b3725117ddaa845ffc830e3ea1
MD5 121658e7ea08b5fe7ed1f64bb355bae1
SHA1 304006cde378a1b91e7040f73d2b9951b02dba49
SHA512 ad8521046ce7bea7bda7163d6078b3a224621611c80bcdc25b0bba8f2cedbd50f236d4bdbb385863651bad1ab566c1891cfd95d2c74fcf0600532b69ba9c4ba9
TLSH
T1CD41C75CB6F90548B3B76F5AAFF6A8AD447FB8772F06915D00110D4F0A66B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads