hxxps://github[.]com/mat1jaczyyy/Keyboard-Inspector/releases

Analysis

user interaction
yes
max time kernel
38s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/mat1jaczyyy/Keyboard-Inspector/releases
Sample260806-v4vtasbc69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305111957441983"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B5C6BC17-8505-49B3-97C1-CEB0F39067A7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	Keyboard Inspector.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4504	4576	msedge.exe	88
PID 4576 wrote to memory of 3724	4576	msedge.exe	90
PID 4576 wrote to memory of 3672	4576	msedge.exe	91
PID 4576 wrote to memory of 3672	4576	msedge.exe	91
PID 4576 wrote to memory of 3672	4576	msedge.exe	91
PID 4576 wrote to memory of 2440	4576	msedge.exe	92
PID 4576 wrote to memory of 2440	4576	msedge.exe	92
PID 4576 wrote to memory of 220	4576	msedge.exe	93
PID 4576 wrote to memory of 220	4576	msedge.exe	93
PID 4576 wrote to memory of 220	4576	msedge.exe	93
PID 4576 wrote to memory of 212	4576	msedge.exe	94
PID 4576 wrote to memory of 212	4576	msedge.exe	94
PID 4576 wrote to memory of 212	4576	msedge.exe	94
PID 4576 wrote to memory of 2968	4576	msedge.exe	95
PID 4576 wrote to memory of 2968	4576	msedge.exe	95
PID 4576 wrote to memory of 3256	4576	msedge.exe	96
PID 4576 wrote to memory of 2968	4576	msedge.exe	95
PID 4576 wrote to memory of 3256	4576	msedge.exe	96
PID 4576 wrote to memory of 3256	4576	msedge.exe	96
PID 4576 wrote to memory of 564	4576	msedge.exe	100
PID 4576 wrote to memory of 4932	4576	msedge.exe	101
PID 4576 wrote to memory of 564	4576	msedge.exe	100
PID 4576 wrote to memory of 4932	4576	msedge.exe	101
PID 4576 wrote to memory of 3908	4576	msedge.exe	103
PID 4576 wrote to memory of 5032	4576	msedge.exe	104
PID 4576 wrote to memory of 5032	4576	msedge.exe	104
PID 4576 wrote to memory of 2104	4576	msedge.exe	105
PID 4576 wrote to memory of 2104	4576	msedge.exe	105
PID 4576 wrote to memory of 2104	4576	msedge.exe	105
PID 4576 wrote to memory of 4592	4576	msedge.exe	106
PID 4576 wrote to memory of 1480	4576	msedge.exe	112
PID 4576 wrote to memory of 3276	4576	msedge.exe	113
PID 4576 wrote to memory of 780	4576	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/mat1jaczyyy/Keyboard-Inspector/releases
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffefc57c188,0x7ffefc57c194,0x7ffefc57c1a0
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,6013516531636955663,8029599700205449352,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,11118189523866466260,8805055826665506880,262144 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,16479426984815955292,9208438277077568460,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9268645976710071912,11596482675772743275,2097152 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,18037878164132264158,14265759045573204411,2097152 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6242471009900231892,17071291494635034604,2097152 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,3106471037576420325,1666571756299607415,2097152 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,1046079342309081888,3068450983435963629,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,781736117123949740,6703662012747610056,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10264568090840894764,4723459479227066853,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10264568090840894764,4723459479227066853,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,12610202749301211246,7471109163287789883,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6428,i,10093062775180817706,13685077702486423471,2097152 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,11192652884054994700,1063181846407193267,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,3700543515786489829,15959528456883899629,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,12462401539912629344,14485399636999282945,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,6856261317055453455,8978396358038428506,524288 --field-trial-handle=2328,i,17649645664083001240,1105031727744145692,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3276

C:\Users\Admin\Downloads\Keyboard.Inspector.1.0.2\Keyboard Inspector.exe
"C:\Users\Admin\Downloads\Keyboard.Inspector.1.0.2\Keyboard Inspector.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d742e9c97e0f08fe852c31accdd4e6d9d573ac0bd8314467d2249a6fed21a46c
MD5 473823eb417fc498fbb889aa6a4b80a0
SHA1 e8c6b3327d5f943c3f5a663fe4d0913c5ec5de06
SHA512 ef4739788f3bc638b72eb5c68dd8fdbad5a89d96748be5c1db466a6c4f552612cdd9fa215f47d1b8f8e830fc464a8db21f14f105de2ef9f1af90b8877a0c12b2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 55f930c21071ed67315620947248eafc766c7da4f9a8101d0ab5613fb302c6a6
MD5 92761fe3137e6914a35ba84d218c2f0e
SHA1 1ce297e7b718c982c5a1a47f0304256345dbbec8
SHA512 331f05a8bf579794c1b414e97b1962fe3db64b6e659294c1c5e34c5603acec23d3a3d5a84cdcfec1d2db3e21d9e340d05cc6af96cba359690871b04185dde0ca
SSDEEP 96:BlRbsxm/eE8yFe+89v5wlCjt6SKZjsbWQjCl:Im2mzquCCZjsb7jY
TLSH
T125A15D1784B10F42EFB22BB2CBDA56DA3D324945CB538FF241945B7DB93A7244BD1908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5916da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5916da.TMP
Size 3KB
SHA256 21b272735bab73b6c3c9ba2ec0def6ca95015c8d1f39de4615cb25d4d1b70778
MD5 538e0d504ea136cd130feb8590162b17
SHA1 cfe72adf65a75d5c3230f54fa2a5cf24d8c80420
SHA512 aefcc237c63d9200bda33c4020cfd83e8835894f047fc31018972a06bd984d67ee2656e173efcfba2c679c5005a2d23d4fec024a0677d0bf05b2cdffd12922f6
TLSH
T181713C1805F10F91E3B26FF2CFE216DA3D734D888AA34D3242D49BBE693772084E5545
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b69df66514fb9d29ac2c6d7468de30d433fa59cc9e379fa132101c51ddd79316
MD5 4fbf1cdd2b341689b3e0cf3055881f18
SHA1 989309ec25452859d6583886fe594e973aacefa5
SHA512 0d5be67179e1fadddbf5fdbecb6449a8a762c84307f628b02aac74df169b948a44b1890e9569db24a3257c084ab5b1e88a5898b8329149ed8375479393195aa9
SSDEEP 192:sxZMRNyM/jK1Ml8M9I/f1sn3K7Idp9m3HW6+WNYNC/YwxcmZIgdJ:sxZMz1I/f1s3KkuHbL/nn
TLSH
T15E52E8526E34AD7BCCCBD20DBA557F53D6F5442295900E58AAFDEA1C00E2AEC231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dc26708edeb0fd28b98e7957f61a4458bd442a2f166f2a031c9901d7760a994d
MD5 7a44e023d4dc65adc72d0370759ab3b0
SHA1 9f5e97f1f543d18fb368080c98433a76629e2eb9
SHA512 2105aa4142054ed261e967fe1e15762258fe6a122c4786c9830743b348fb69426da315c2872f57aaf346e064e988921ba783157d24c921812005067c0a40a9f3
SSDEEP 768:x64jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+durohKGcWaj:x64jeXmWvmKLEu1jacPLZQdl+V
TLSH
T1D4D20A3B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 51f9ee981fdf1a84c626b3e08907000fbe0ab0b339a3695514c411675a5793e7
MD5 1d8aa78d3e4cf48b4b637caf88e9fc0c
SHA1 a862cd7a01de0a249f211cf373aef5e12aa77651
SHA512 153ec4d8e92a3212eb8ac16a2abedb1cda7a39debcf6a30d1e2e4664c003c2a1867d295153473e347ff68317d9233a4305c4863bb4830ce9a1c2a5f89a79edd2
SSDEEP 48:KA7IVKMMAQyFpIxKCkUadeJ9HP/2FPo9Iy92KXT/T2jVm4gDdnyprMvbhdD:KA7aKMMtOpOKCkF6cKjKSf
TLSH
T13C91851771BF12123CBE2509A296BA164B42B5A33018F87B7BAD10E25D67E640DFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4ecd4416388ed46882a8fd19f0e7a8acb9c3e1e032fea5d43e4d67edf6a277b6
MD5 2de0c9a77ed6133b9dccb19ce2888f10
SHA1 77430e29aa0009d2c8402a14735a88917726d7a5
SHA512 8dd956ab989e2ab0f63801cce33098afcfb03f439783874b885d77caa6ac006cff46126da681097d4b820f0ccf1a0eebf185da69b66cd2a3ba739b4c3eac29b9
SSDEEP 192:ufGsNGMb1Q40ZEqqQmiU1RKp4H/+jVSjzorh8F9XMEb5cFT2qEQU8:dsNGupF9y2f+o8hy9XPGFQQU8
TLSH
T1F8421A366C38AC764DE29184F44B32139FE44027AAC97F94D6FD6B1C00CE6AC130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 57791217d5929c3b02ccfea755d1eafe386416fa5713ac75c0d6c588eeeadc50
MD5 7555447b871d613cf6205e853c929595
SHA1 7f14d982440e56b20d5a195a9f8c28f1448692c4
SHA512 168093a7c83dfbcc81719b53b332523949fabada4abc4e72a849dcf1cccf91ec3588746de9e2e687bda4de3170af7a989145fe997780cadd4c824f2dd7fb2915
SSDEEP 192:ufWsNGYDb1Q40ZEqqQmiU1RKp4H/+jVSjzorh8F9XMEb5cFT2qEQU8:PsNGSpF9y2f+o8hy9XPGFQQU8
TLSH
T1534209366C78AC764DE69185F04B32539FE54027AA897F94D6FD6B1C00CA6AC130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f4c7c11eb115b3143c77affa8ed8f58460c652700edbb9730c2ff2d4f26f8c10
MD5 eb01dc089a903ed48b0ea405f77d95e8
SHA1 0f5b23d81247869aa9e87454c8c6760c0f716ed4
SHA512 10d734506bd5e9cd218c3b89e5f654771ad01adb8c893f88bb7e970f9b11457313f9343a7d1d74a95cb42a8e935706c20808ef6ba1fa1701539290de6b25d13c
SSDEEP 192:EONT6hZ0QmiUyAepc/+jVSjzorh8F45wOZajU6:EONT6oqpu+o8hyH2gU6
TLSH
T1DE02E835A8787C778EE2AE49F48727235FE5112BA9956F84DAF85F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 130227e11ee9d66f3c2567f8d3226480d930e51d56fcb53a45bf545f1d33c49a
MD5 293299a98ab16ea8646c790e0b39a370
SHA1 d79679a01a8f0942cbf6bb5ea4f40c88b6069001
SHA512 29ff2385b93d17c3e4693a41bb0c13abc0d8d2bd2662efa938258f815fa18dc8acbb161f6bd2f2bf0619a6bac47ae85b4e52ae1fbf33d3c2110df570b4775b3c
SSDEEP 384:QZcI8sNGRkpF9y2f+o8hy9XPGFQQcDVVZoJHWiM:u8DHm3P4QQcleHW1
TLSH
T18C928E726C346C368DEAE545F45636135EF8802BEBC56B94E6FE6B0D018A66C030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be6dba6c93e0138e7d42c1fe2049d18ba8bb479caf717bd4e1552bc818d58206
MD5 597ad4b1e94422d80afa61bc5d01109c
SHA1 5a9f0b205e90e24883b4ec1ea10693aea6dcd591
SHA512 a100ad4d4c4fdec93d2823245f953b15700d4d24b694e9a1982f6cf820d0f8c5d1f9216fc46cf51e86709badb8fa90e7ceee364ebd04c6abfa74b25df9027caa
SSDEEP 192:rONv6hZmQmiUyYeic/+jVSjzorh8F9XMEI5cOq2qEQU6:rONv6O8iu+o8hy9XPT9QQU6
TLSH
T10512F9366868BC674DE2A585F08736135EE5512BEE897F84D6FD2B1C00DF6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 96b9a4e3fa420bd78659c19bba5feac763ede868c046f6eb359ebfbcb577bbe1
MD5 86c965ac93f1cfdf0e3956a36c398842
SHA1 4653218d1c148cc30b023f34b3f8eeabc5351622
SHA512 4e111e5e53fe008a7a51bd821f09a519a47a095d4e0770d9ab2789d07003a764d0a2343d64e1fa0053ffb3de2d8696b910e291cf3156ff2095de38cb71349b76
TLSH
T143412F58BAE90158B3B76F5AAFF2656D587F7C732E4AD05E10010D4F0A23B41C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Keyboard.Inspector.1.0.2.zip.crdownload

Path C:\Users\Admin\Downloads\Keyboard.Inspector.1.0.2.zip.crdownload
Size 2.2MB
SHA256 e0a85f5e6034c206d2e53eb26766cab4a9aa936f0ee537ce3ea9beea49c00b11
MD5 e0e9a5c9010fdafb798f16b3f8a8bd52
SHA1 24a326275a12ba3d1acec9deb882d44ee881cb96
SHA512 767f7c472c76cd954a473a854eeadb7cc5695f386e2769d1ecc7bf47c04929fb7c19f9073dbbf7a28bb8bf37dce8f38ae688be5a41ed9a291469f161ebfead50
SSDEEP 49152:HgnErqVFXf/nRlIHtEVyVaUIpmoBTVYxS8OoJVLpPRUZPWj96SVA4:Hv+FXHHINE1VUoZdeJVFPRUZP+960A4
TLSH
T13BB533B465E0CCE7C90B4141B2297A617D888DDA28FC979664319FDBF30CAF7173948A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-314-0x0000026063920000-0x00000260639AE000-memory.dmp

Download

memory/2272-315-0x0000026063D40000-0x0000026063D4C000-memory.dmp

Download

memory/2272-316-0x0000026063D80000-0x0000026063DB0000-memory.dmp

Download

memory/2272-319-0x00000260656C0000-0x00000260656CC000-memory.dmp

Download

memory/2272-322-0x000002607EE30000-0x000002607EE52000-memory.dmp

Download

memory/2272-325-0x0000000070680000-0x00000000708C1000-memory.dmp

Download

memory/2272-335-0x0000000070680000-0x00000000708C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads