fe9cfbed225d086637c534537ce0542946ef649e910524fc0de5fd53f36d8a15

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
is-webrtc-supported.html
Size 155B
Sample260807-13c5ravbmd
SHA256 fe9cfbed225d086637c534537ce0542946ef649e910524fc0de5fd53f36d8a15
MD5 5c4d7595553f2d1a499e8356a07c291c
SHA1 46d8c08b0b025c85a09b97b83021e08521a53f81
SHA512 9bafb81f483a632950cbc7869e690aa418eb439301d3718edb54991a57eb245f42792bb9a8b980bed6a67474ef2495d01bc203fee794b6ad99733a04c4499ec5
TLSH
T11CC08C8E18016101D5306E8028D0B79808DBBB9420D2C8000AE2F0268862396CC039A9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306142592088892"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{962AE0A3-7CCB-44EE-99A5-4C5073E682CB}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4324	1432	msedge.exe	84
PID 1432 wrote to memory of 1092	1432	msedge.exe	86
PID 1432 wrote to memory of 4668	1432	msedge.exe	87
PID 1432 wrote to memory of 3792	1432	msedge.exe	88
PID 1432 wrote to memory of 1092	1432	msedge.exe	86
PID 1432 wrote to memory of 1092	1432	msedge.exe	86
PID 1432 wrote to memory of 3792	1432	msedge.exe	88
PID 1432 wrote to memory of 1772	1432	msedge.exe	89
PID 1432 wrote to memory of 2144	1432	msedge.exe	90
PID 1432 wrote to memory of 1772	1432	msedge.exe	89
PID 1432 wrote to memory of 1772	1432	msedge.exe	89
PID 1432 wrote to memory of 2144	1432	msedge.exe	90
PID 1432 wrote to memory of 2144	1432	msedge.exe	90
PID 1432 wrote to memory of 2612	1432	msedge.exe	91
PID 1432 wrote to memory of 3836	1432	msedge.exe	92
PID 1432 wrote to memory of 2612	1432	msedge.exe	91
PID 1432 wrote to memory of 2612	1432	msedge.exe	91
PID 1432 wrote to memory of 3836	1432	msedge.exe	92
PID 1432 wrote to memory of 3836	1432	msedge.exe	92
PID 1432 wrote to memory of 704	1432	msedge.exe	96
PID 1432 wrote to memory of 1184	1432	msedge.exe	97
PID 1432 wrote to memory of 704	1432	msedge.exe	96
PID 1432 wrote to memory of 1184	1432	msedge.exe	97
PID 1432 wrote to memory of 2828	1432	msedge.exe	99
PID 1432 wrote to memory of 3444	1432	msedge.exe	111
PID 1432 wrote to memory of 1964	1432	msedge.exe	112
PID 1432 wrote to memory of 2092	1432	msedge.exe	113
PID 1432 wrote to memory of 2732	1432	msedge.exe	114
PID 1432 wrote to memory of 2732	1432	msedge.exe	114
PID 1432 wrote to memory of 3832	1432	msedge.exe	115
PID 1432 wrote to memory of 3832	1432	msedge.exe	115
PID 1432 wrote to memory of 3408	1432	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\is-webrtc-supported.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x2b0,0x7ff9652dc188,0x7ff9652dc194,0x7ff9652dc1a0
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,14611842633158184523,585273302772604512,262144 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,8127676962274222984,2925757795724083515,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,6659955486874109901,14248237133818534539,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,12273150689486192546,13302585752723225623,2097152 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16669338105565071849,15396674380630381767,2097152 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,2156888634004404916,11105316595717759058,2097152 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11584751781911503305,8199649057871430309,2097152 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12452080991690530601,10264849273694615854,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,15941316061683036412,15931442780973502475,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,12875106241000668784,13284943317923936325,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,12875106241000668784,13284943317923936325,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,11279111411431539642,4675433828218209907,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,16798155706226081939,8247150946115335155,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,14569731752167683664,17579920163817650643,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,1624305929801621848,6445172169602247189,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,12341107731221378484,1225471497782238482,524288 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5320,i,13064846602081248457,11666149771054785102,262144 --field-trial-handle=2552,i,8710391180424731792,16646530133519787692,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ef11cee149a619598fb5598c6cc4c96329b8c8eeb91f5e3ea423ed205ce2a21
MD5 05f4324dcfb3bd0fe7c5e8ede840ad39
SHA1 cb98b8524fc7a55949659634f875c4031d10441f
SHA512 3a7a7f0381e426ab5922182125526e382156655a88df28e00fb9f31670527393748b3efa355406b90c2bf872b9b6759c7ba3e88bdda720029b0f107bec39337f
TLSH
T19B41E57816E3054DE3201B7BA4F02E1639F88D953EE36E1D9D4889743A4FB22830F278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589287.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589287.TMP
Size 1KB
SHA256 4bd47a26a2c1c3546be0d979010455d01ef6c020548b2e9a6dbe6757598d05a3
MD5 cb5366973ad5a4481ba9474a41424cbb
SHA1 6a148c6a58119a1f27e447b2dd2f3242358f40cc
SHA512 5deb519456d70a497bf8205e7f4c9bc33682cff66019c9ad8c1c694db2684eb3b1eb44886642c307869bdf7c5a07fff86672071df907801fbc3f03955b953960
TLSH
T16F41E57816E3044DE3201B7BA4F02E1639F98D953EE36E1D9D4889743A4FB22830F278
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ccb1daf310a40b13bf7e78dfff71b9e5573f47f87b50b0f4bf8cbb685ec744a1
MD5 00f0956b14a263baef4fe6b9acaa6a2a
SHA1 16aecc675d20b4bcecb5ae880c029970fa384825
SHA512 157d6cdc42dc133d28a83c9658f915a79db503cce5c39b6d46607932bfc44dfbefcf6c21e9ce03a45f5a6ad33f97a46b2afac32648959d298e4d9678a646a317
TLSH
T121115BB3C3D5856E890116F05A28AE2BCE2D0506425C7C258AD4FF27D3E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

edf1f5f0-4820-4cdc-91a4-2cf15876ea91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\edf1f5f0-4820-4cdc-91a4-2cf15876ea91.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a4114927b74e86b9607523bd8263347ba927e8cfd29e65f2072544f674506a25
MD5 d07d26b79189bc99cced35f15f7c7600
SHA1 c54c6bc13e0abae402e343a7f6e7d0b75d6e737e
SHA512 82a1d6530b8b3f6bed2bcbc5f0edc4a1ca67975a2299315064b375a9ab72fd0fc7d9894b66605a8e1d049fdca6910346ed22633301c4405c2eec3cb9f40eb670
SSDEEP 192:sxZ4RYyM/jK1Ml8Mkl/fNsucjzIdpdNHW6+WNGY9IKpe8IgrJ:sxZ4GMl/fNsucYXHbGy9
TLSH
T1A8420A116A34A977CCDBD209FA55BF53D6F54532A2900E54AAFCDA1C08E6BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d9186ab5a4dc3206d61569d7197c2cf71140033d1c2cc807e74c37d8c89e26af
MD5 5a7a0ae5920d71d4b7bb0a6c04f42f09
SHA1 fbdda006345bb0de168ed8408b7770e4b4eb31ef
SHA512 ae410f38d4c8ec0cbfa686e9ab588a301a47137d72e35b6a211e19ce8a211ccfba86101a9e82f3eb0203bee7d2525a69d1d5a53388891ea0e2a4858b5acfdd2e
SSDEEP 192:sxZ4RYyM/jK1Ml8UQHckl/fNsu1KjzIdpHNHW6+WNGY9IBkCL8Ig5PJ:sxZ4GqHl/fNsu1KYtHbGt8/
TLSH
T15F52F8116A34A977CCDBD209BA45BF53D6F5447292900E54AAFCDE2C08E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3d333bcc769f2db0e406050afaa33a3079091b6b1bc76cc87ccccbeb8c542b64
MD5 e5d5c3520661183791f5a7b37b072a06
SHA1 699e7984eecd1d7166ee363d30aed90119d37281
SHA512 8f8d716cf1074309eaf13bd4f532b387778306cf99ea3797792a9e8b4f5d8dc7267cd12002b10d782d51084805be1ca5bcff68315795127214cfc57a67a519f8
SSDEEP 768:arcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN1roGg6Z:arcv21wWvu+Z+u1jaeFLeRNOGJ
TLSH
T1A0D20A2B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3430d7bd97216e3e6a5e52146f17de6aedcc95f6a93f1c59136cc5237a9edd0f
MD5 8763c9f5904bc9a99d4b50575399638a
SHA1 ae697bd2d82b21f7f2da882fa1a98d90484ee1fb
SHA512 bac69ea02366c03323ed9ff4e95434136dd84459f5a65be9532934e4787af31de2617638e01c16a2ee48e06735aa8ce810d58e7078b679a7e5b8e75f95a11b48
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDujeKEoeEmsKbSOeDmKocQ:mTtNlThx
TLSH
T145C12457B23B0642297D690CA3628A378F4531633814F5EF7BB900910E6AF221EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 83c39c8088385d08026133f0028cc37de2f1875be0524856324d31624e8d82fb
MD5 943d7ecc94f8192e40cfbcb2fb40dd99
SHA1 7d710d57ed433d64f896e81eba27bb62db8afe98
SHA512 7d7e583d618438c36f751da53da406a33bf3eaf3da0449c4198c28c18d75446807802a891ba7dd375be166405676fa5427155b99fe201f9ea8708960cd8e00b5
SSDEEP 384:oZcIhsN3XAYh3zi/cXe+CnOhiJrtDMf5UrzERWt:WhopOvOhihtDMSOWt
TLSH
T1E9929D316D346C7A6AA6A545F88B36074FF89073E3C52AD8C6DD7F2C09DA25C270781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 21a4ae8c476d3c678aa8eb93b66e6560b868d3f2a293e49300d8c01643a7914b
MD5 4a6aed5c7388b142596437de5b649180
SHA1 238947b921b8e5534b1a2aaa9da742e5780c3f16
SHA512 39fb1e29b30952e1a75ee80801d79d4ca42ce97e18a48169f1c8578659777a03df275b2f94829228b9ac14613547ee0c3db4715024888b275d116dab1a8302d5
SSDEEP 384:CZcIzzsN3WAYh3zi/cXe+CnOhiJrMDMf5UrzERWt:wXbpOvOhihMDMSOWt
TLSH
T108928D716C346C3B5AE6A645F88A36074FF89027E3C52AD4D6DD7B2C09DA25C270781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71692860eae891f5898f6507a32f2cc1a497c5c585b02fdaf74d8f2b175f89e3
MD5 40c8100e6797d803ccdaa950da4148d8
SHA1 3e36e991e593aa5f031bc051495ec38ff37f5f5c
SHA512 ddbaa45b926aed51a93f0d758e163fe1c830d2c08109841fb60babb8d2b8cfacf4b78956162b268f1259da70017a70d7c75092ef6d9a0b8bc915a34a3d6f5488
SSDEEP 192:JONo6v+YLNQmiUynCZh+CGKO1m1usDjb2U6:JONo6vz/bZh+CnO8Df2U6
TLSH
T13502EA357D682CBB9FB2AE44F5873B175FA8217BEA512F80D9D42A1C01D775C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c7ea430a1bb07b697a536da92a4018333f64df37bb331629558be8564e240db4
MD5 51e82b8f6584e5aa44dbc8f448d94953
SHA1 f7797c39d2bd484c3dbe2e44545cdbacf32cb50b
SHA512 c356bbca3ddf0706df4d753cffc22c16bc58565a978c509800648299c8d01b8eb2fccfcefddda497ee1ec7d873c38dd73e68437225245812be639ec661907607
SSDEEP 192:bONa6v+YLEQmiUyRClh+CGKO1maXSJrpCHDOqgU6:bONa6vzgLlh+CnOhiJruDMU6
TLSH
T136122A3178786CBB5EE2A544F48736179EA85167EA463F80C6DC3E1C06DF79C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c7f66ddd187cffa4c63ecb39fffbb8a9a88f37ddb71a4910edf70dd55714bbe5
MD5 3954c1f4d153bf67ece9d6c235e6c180
SHA1 4bae03c270bd7bd02c8be758608d694ce18951a1
SHA512 a156e6c58b5a67a996846d891a9640d6c10043d6e4ad71678b63c92ff98afa129d65a24e1921c5649fa40520ae2004bdb628d8d4cd44938b402e555b1ece92c6
SSDEEP 384:EZcIhsN3WAYh3zi/cXe+CnOhiJrtDMf5UrzERWt:ihbpOvOhihtDMSOWt
TLSH
T1ED929D716C346C7A6AA6A545F88B36078FF89033E3C52AD4C6DD7F2C09DA25C270781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f03d7c68-3e3a-4665-9928-0196a7957d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f03d7c68-3e3a-4665-9928-0196a7957d13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b1594e16efe6debc5bf279bd036a495898e565ae4d17dc62c3b0cfc1b331de7b
MD5 d7ec34f28e603a1d8df329ce4bdce5c0
SHA1 ccf9e62cdd38645f3e342f9ddfc38cf7777ed726
SHA512 d942f24872be054086bd215822bc4a7d00043cf09d6529ca92fd134eb3319e577a3a2a3ce721c93cd30cb503f99ba44eca854f7a78b23c59cda0b7169f0d4a96
TLSH
T19941F899A6E91158B3B76F1A9BF7A86E447F78372E47C59D00110D4F0A62A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads