hxxps://www[.]google[.]com/complete/s?q=cnn-news18%20is%20cnn%3F&cp=18&client=gws-wiz-serp&xssi=t&gs_pcrt=undefined&hl=en&authuser=0&pq=cnn-news18&psi=rohxaseCMubH0PEPjqiz2AY[.]1785825455136&dpr=1[.]25&gs_mss=cnn-news18%20

Analysis

user interaction
yes
max time kernel
42s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/complete/s?q=cnn-news18%20is%20cnn%3F&cp=18&client=gws-wiz-serp&xssi=t&gs_pcrt=undefined&hl=en&authuser=0&pq=cnn-news18&psi=rohxaseCMubH0PEPjqiz2AY.1785825455136&dpr=1.25&gs_mss=cnn-news18%20
Sample260804-tk74vavaja

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303333037347211"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{DAE4A4DB-25D9-4766-80AB-DF5EB19EF822}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3132	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5100	3240	msedge.exe	87
PID 3240 wrote to memory of 4860	3240	msedge.exe	88
PID 3240 wrote to memory of 3740	3240	msedge.exe	89
PID 3240 wrote to memory of 4860	3240	msedge.exe	88
PID 3240 wrote to memory of 4860	3240	msedge.exe	88
PID 3240 wrote to memory of 3276	3240	msedge.exe	91
PID 3240 wrote to memory of 3276	3240	msedge.exe	91
PID 3240 wrote to memory of 3316	3240	msedge.exe	93
PID 3240 wrote to memory of 3316	3240	msedge.exe	93
PID 3240 wrote to memory of 3316	3240	msedge.exe	93
PID 3240 wrote to memory of 3352	3240	msedge.exe	92
PID 3240 wrote to memory of 3352	3240	msedge.exe	92
PID 3240 wrote to memory of 3352	3240	msedge.exe	92
PID 3240 wrote to memory of 5004	3240	msedge.exe	94
PID 3240 wrote to memory of 2960	3240	msedge.exe	95
PID 3240 wrote to memory of 5004	3240	msedge.exe	94
PID 3240 wrote to memory of 5004	3240	msedge.exe	94
PID 3240 wrote to memory of 2960	3240	msedge.exe	95
PID 3240 wrote to memory of 2960	3240	msedge.exe	95
PID 3240 wrote to memory of 3032	3240	msedge.exe	97
PID 3240 wrote to memory of 3032	3240	msedge.exe	97
PID 3240 wrote to memory of 4848	3240	msedge.exe	98
PID 3240 wrote to memory of 4848	3240	msedge.exe	98
PID 3240 wrote to memory of 3200	3240	msedge.exe	100
PID 3240 wrote to memory of 2864	3240	msedge.exe	101
PID 3240 wrote to memory of 3200	3240	msedge.exe	100
PID 3240 wrote to memory of 2864	3240	msedge.exe	101
PID 3240 wrote to memory of 2864	3240	msedge.exe	101
PID 3240 wrote to memory of 1004	3240	msedge.exe	102
PID 3240 wrote to memory of 4348	3240	msedge.exe	104
PID 3240 wrote to memory of 3132	3240	msedge.exe	105
PID 3240 wrote to memory of 4440	3240	msedge.exe	114
PID 3240 wrote to memory of 3732	3240	msedge.exe	115
PID 3240 wrote to memory of 464	3240	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/complete/s?q=cnn-news18%20is%20cnn%3F&cp=18&client=gws-wiz-serp&xssi=t&gs_pcrt=undefined&hl=en&authuser=0&pq=cnn-news18&psi=rohxaseCMubH0PEPjqiz2AY.1785825455136&dpr=1.25&gs_mss=cnn-news18%20
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10973786195742998597,16104873587033794510,262144 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,15810511742292213901,11303204416209737304,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,4960433031351420021,11890828681001517080,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7909105036052029266,11700933154673280444,2097152 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14627521034180424124,17545126118826601484,2097152 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,11741843255943004365,5270837334860083040,2097152 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,16795908832699580275,14474342437521262655,2097152 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,11158095866698734131,1455395670393392365,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,6228369540250974298,16692804451131436892,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,16548581617146599181,6475173920175827301,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5732,i,5674449832685332257,10927779958983107524,2097152 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,7144384355907060714,12705767394307635470,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5089991109705173120,5274588324357300199,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5089991109705173120,5274588324357300199,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4348
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\f.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,17748690384909820480,9930398182950284684,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,5563245395378791251,13977145984998932591,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,8194100213827816640,10571854056984076012,524288 --field-trial-handle=1804,i,8071616529354250132,18005338360101959533,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88fcc60f6fe9ecabdc509b79d6787c4d719f015e1c2349fe18f18ac65f943822
MD5 50be0010104880cea4a67a3e8f46b515
SHA1 7c1d9d508116424567ac043211359dd049aa19d0
SHA512 a63e025bbe81f90512ac7291cafb152bf6c174953fdb7a97600e452222dd3f21443c4143bd5c714e40fd8533122abc486d3c3128290624085e662ea72670fde6
TLSH
T1B471900E09D20492F3E51E31F8D336D7793280B94A470E760680ABBDAE16F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588901.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588901.TMP
Size 3KB
SHA256 92f1911ef6b6b50f9b276f33eaa671f6017e9cc4a175ff67ec6c032fae024d07
MD5 a296ad8b8595deac64bbd347c4681cb6
SHA1 d579cdc5589c5088a6d6410641aed9e7ff735e08
SHA512 67e8b7eb7de32bbdda8841c7b75512629d803b10556a36c1d46258467ee89e0bdb5899262c5983a98ee78b3d4bc19e0aac24af14fe51c152fe91634ac03d6649
TLSH
T15471800D09D20492F7E51E31F8D236D7753280B95A470E7206809BBDAE16F2D0CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a3cbc36-ce67-415f-ad47-996cf883ec60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a3cbc36-ce67-415f-ad47-996cf883ec60.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ef717aeaab2a008b3919ac9e060023d9cad5b220e010d5890eb7baa03c90ef14
MD5 d0569a3d036357d67c41199454da4db8
SHA1 d6bb67b4922f0d1beb4b337f1da1f67699037133
SHA512 50db39ffec832a258ca4b10c32bc4fbe9479292527110d5a19aa05c6443bef1de764db52bcf550433b62b34a0a54881115157caf1636f6f406b09f970a77d966
SSDEEP 192:sxZNRfyM/jK1Ml8M9//fnsW4cIdpJHW6+WNGYw8XLVteIgrJ:sxZNL1//fnsW4FJHbGB9
TLSH
T16F420A15AB34697BCCDBD209FA517F93D6F91472A2900E4899FCDA0C05E6EEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a2c6b8b3a34f09c05d30a8b70967741514205d7d3977ff3238138f27fb187c9f
MD5 eb86cc164fa77c9fb50a0c9fb26b4181
SHA1 464dd74da9fbdbba9848d3ca7bc8dcc70b7f5cdb
SHA512 04ded735a39fe0250ccc51568bdc5ce5f633aea3b021dbb71970ed62da60393a93f59badcb69647f3d90edb3b43a0ccfccb9e76c710fa18a9a859216e123354f
SSDEEP 768:0N4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dXrohYcba8:0N4jeXmWvmKLEu1jacPLZQdEFv
TLSH
T14CD20A3B280CCF7E4F844E5CED26AE976ED801CB6A588D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4d2282572267c39e18d857adc12a66270e8083fda80a65a2403f4ba195870136
MD5 a0941a11553134ec09713a28b61b2503
SHA1 a601ff5531fb79b206923f89bac67d340c04c54c
SHA512 6c98425bc9d0bd8114bdd17936a3d2b3785b849dd06837a8c8b8abeecac907bd7274f854109a2192c9f4fa1850b8ec6477e9ce8d28a8a28892779427cce54f94
SSDEEP 48:KsiIfKnKQDyN1IRK+0MmUIvK1G8PykChGyc4D:KsiUKnKW+1mK+0RUQK1G+q
TLSH
T1DF91605571BF06023E7F2D4C9654971B5642F0A3346CB82A77E884B68E6AF220CFD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4ed512b9f510aac352b9d1475d6696598acda52281d57b588f7ef223d65a9698
MD5 07c6a9a1c934baadea284ace3b6b75a6
SHA1 c3728d73ddf57031d5bd3c935930267c9f90339d
SHA512 e189a57e4dbb010d30a92bef8f9aa8a5fd478041fc0bc8a26e85fbdea7cab3fd9b18a3b6d56e1115681eb6767bb4ef9da62aa5ee6774d57709b5558c5a74b1ca
SSDEEP 384:/ZcIOsNPi8ZAmyf+xOE1hpxJrVFrBeRs9JKgqijUhb:XOmFaYOshLhPrTjKgqmUhb
TLSH
T11A927C3058385D369DE6AA81F48636538FF89127E6C06FD4E1EC7F1D009AA9C231BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d74c6a2455700d9eb5d305a9267fc97ee63bde91f7dce60dd16377aab97d5df
MD5 9ec12246bfef6a982bb027af20cf397b
SHA1 fc8ae8f5e48a37260bf4e342bdb66f160e757763
SHA512 1bc0b9fb8173f93d4fc303d0e78d12b290d72cadc1dab24e8f401d12880956ce1a7087b304b838dda60e2e6b88a7ac18b6bf4e1d2582eafb6193555ce26dfdaf
SSDEEP 192:EONa6hZ0QmiUybPpc/+jVnO1u1m5wOZt5fvU6:EONa6ogpu+xOE1F2vfvU6
TLSH
T1DE02E935687C6C778EE2AE45F48727235FE5212BE9956F84E6E82B1C00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e2329ce1aa9a27949805a575d31d9836737f65166b1db86dbad7755a1076b30d
MD5 33135414418f73c9e755cee5794cea5b
SHA1 4f5f4da61a40d96ee7ccbc95d54b59982b49df29
SHA512 863297e0bb937b26a593aee2c2779856a995bcd0fe0c98f2640194c753d8f21434cbf545c1e66389c9b4aafb8c3fe5ef80a261eda8a575f17671d3e45d752ce3
SSDEEP 384:MZcIOsNPD8ZAmyf+xOE1hpxJrVFrBeRs9JKgqijUhb:aOPFaYOshLhPrTjKgqmUhb
TLSH
T128927D3058285D379DE6AA85F48636538FF89027E6C06FD4E1EC7F1D009AA9C231BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba93f05276b3a03554aba88b0ebd948ce2c4c204d2e7cbbbac03f9f8aaefc1f9
MD5 1088b34201e91b9aa5782bbd9fc2c05d
SHA1 9d3387d212cbc9a1b913653b729707adcef48fef
SHA512 5fcc5e9b942563410537619c87c9d782a0b38ea0af647b0ec694848b2eded1134ebc353a9b3c58850f26ca19df0a23fc6567b7ba39f9de93fc68e25f29602d56
SSDEEP 192:sONi6hZXQmiUy5Puc/+jVnO1u1hjFuSJrB5cOqhq2U6:sONi61Iuu+xOE1hpxJrE9rU6
TLSH
T19012E93568689C375DE2A691F48736539EE51127EE85BFD4E1DC3F1C00DBAAC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640fe6de-e182-4f38-b71d-63396d14a8c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\640fe6de-e182-4f38-b71d-63396d14a8c9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e8ea16e01d72c19c4530f76626263186a5d075eeb3da1639828a800011c76374
MD5 00dcaea8b1916b9f825d114572015a10
SHA1 58065331a5fce07e8182b9b4c95123ef424b9ede
SHA512 52c5b6457db0d5f56da1a2be6a26cc6c0b2c35189eee90f1a73038f25c2066733c1c5a39e009e9e20cf43c0a2cfecb9cd13fc825fb1b16611760af960ab941cd
TLSH
T11C412858A6E91148B3B76F4AABF6A86D447BBC773F06D45D10110E4F0A27B44C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

f.txt

Path C:\Users\Admin\Downloads\f.txt
Size 680B
SHA256 e61df09aa2f41a54eee1a4548fb7dbbb4049c4a0df0251ddc3a2457a02a49fdb
MD5 8f1890a8b1bedf8632ca390e243407a2
SHA1 b6c14a9bff6690a45e2d86c840202856b9f6d913
SHA512 3c5800d533df50cc32bb851e18dd66696fd977909b9383741dea03635fc7e67938040e8135ac4b00d80808d33abfd25a6315cdb2460d5d404de794bf559704ed
TLSH
T1DC0128F819F88EEA3B0B7826CEB2D19D345D72D436E91853CFF1D09AC3191744609300
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads