hxxps://limewire[.]com/?referrer=pq7i8xx7p2

Analysis

user interaction
yes
max time kernel
4s
max time network
94s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://limewire.com/?referrer=pq7i8xx7p2
Sample260808-sxt73szarg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4760	4680	msedge.exe	84
PID 4680 wrote to memory of 4408	4680	msedge.exe	85
PID 4680 wrote to memory of 3688	4680	msedge.exe	86
PID 4680 wrote to memory of 3688	4680	msedge.exe	86
PID 4680 wrote to memory of 3688	4680	msedge.exe	86
PID 4680 wrote to memory of 3492	4680	msedge.exe	87
PID 4680 wrote to memory of 3492	4680	msedge.exe	87
PID 4680 wrote to memory of 2376	4680	msedge.exe	89
PID 4680 wrote to memory of 2376	4680	msedge.exe	89
PID 4680 wrote to memory of 2376	4680	msedge.exe	89
PID 4680 wrote to memory of 2056	4680	msedge.exe	90
PID 4680 wrote to memory of 2056	4680	msedge.exe	90
PID 4680 wrote to memory of 2056	4680	msedge.exe	90
PID 4680 wrote to memory of 4728	4680	msedge.exe	91
PID 4680 wrote to memory of 4728	4680	msedge.exe	91
PID 4680 wrote to memory of 4728	4680	msedge.exe	91
PID 4680 wrote to memory of 3600	4680	msedge.exe	92
PID 4680 wrote to memory of 3600	4680	msedge.exe	92
PID 4680 wrote to memory of 3600	4680	msedge.exe	92
PID 4680 wrote to memory of 4708	4680	msedge.exe	97
PID 4680 wrote to memory of 1288	4680	msedge.exe	98
PID 4680 wrote to memory of 4708	4680	msedge.exe	97
PID 4680 wrote to memory of 1288	4680	msedge.exe	98

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://limewire.com/?referrer=pq7i8xx7p2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff2c72c188,0x7fff2c72c194,0x7fff2c72c1a0
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,9991023667784519349,4148850898240508772,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,5956567165012151947,6204350360644080424,262144 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,581069881296533271,16689784863188707757,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,3122870315680160121,4678446421671059731,2097152 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,15324296449502952878,1439522313225946369,2097152 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,10349851482734281423,4605464823773078815,2097152 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3236539405396306751,6004529472669338331,2097152 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,4782479970870021960,6782487455457153347,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,15814370588978303970,469092002490665537,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5940,i,9923244236206434681,8294287479577489004,2097152 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,16812914913691052395,12339020010021360137,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,16812914913691052395,12339020010021360137,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,2958338632605367690,6543180168791596777,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1986698716262169302,1293417495662399130,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,8689806657692058311,14151255515473805386,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13861910118682141054,10894726482558624797,524288 --field-trial-handle=2184,i,15391345663879057949,5694509918846767494,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b28890deba12e067fc4d2feb5580d3c41c440f03564bf57389061fc95e34ffb4
MD5 f56c99096ebca93d541e848019c50ce7
SHA1 f05cdd26283c3ad72be6c76d2723c8b2921e76a5
SHA512 5f6ed4ff674ddb4d1011c58252766c4de17dfb0ffe6567503e473bba4084104b233e51b1258ea50f5fe88fab251a8396460e5f289a7770b4a20b08cef23589a2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7t:fwUQC5VwBIiElEd2K57P7t
TLSH
T186B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0382957c99791bbf37f0a292a68a688ba898893f53c7be2d420d0abfa3205949
MD5 80e81afd519a94b0e3f1e843218d3393
SHA1 093d55b2a0251e8969cd893db151c2617d83ebb1
SHA512 192644826f1731a384b4a8a62d6df749510036d4f447f976a99b3b16ab73b188a9f8602e8e5e57f53a4ecc919d28bd8b5b97a0d5dd2b3cfaa58fdd196e2db9a1
TLSH
T148D08033364D6002D7A573B3D447CF45175E557415525601F124D54CD6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eb6e4c3c1ff9ed97bb67aeb0d434ffe02961fef2204006156de0c8016e804f8c
MD5 ad47d0f507ef049d8589a010a5742cb0
SHA1 b6cd0d47a5138ac8c4b9f43cfb419391ca142fa6
SHA512 8347fe69939685ced24d8db2ac65a696d817ae5d3cc9eaadabcc077032027d0ae50a34c8744211ec16388506f4257888fbaa081dbfc2aa366d9e0e40c78e2b89
TLSH
T1ABD08033368D6402DBA573B3D447CF45175E557415529702F124D54CC6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 00d106bd64eb029c0bf7c4cb0e72bc2b16d22fb977a9b149116f954222e2bd53
MD5 93999209b46e874c0cc46f483fc78559
SHA1 1ad6e0f5c955a402e1b5a5e217fe928b6ea82ffe
SHA512 6774195d188bc14038e12fee13533527bb56e883ea530aa3e8c32d8428b256f7e35640bd2a4d5fc18fa926f8b44a36d9b9b36998fbfa64bb6e6b7fdc52e6dfc3
SSDEEP 48:DZogJvUE5pAmkMUKbMduBW7D3RTepI9fvGkhwziTlE6m+igYTPWProXfOJELOvPf:DjrTMduWBT2I5v/AiTekQaPifJK0vcP
TLSH
T17EA13AA78F4184A5E7631231A5C1D93B3C320FC99503BE8BC3E29CFE2B3575B5180286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 59b7313cf30638c7554802dd70cfc78aa6049dc440a83a769299c4acc133f78f
MD5 d7e3629c2205eff9d520f93f79494279
SHA1 09668a24e1d3051eed177f1b2a2fb6b68a1cad4c
SHA512 88a3aae90aa740683204997bf66a25a9aa2f9570508bd967cbe1f4f43b123930695d32840e4f5d4836f566027d14a932669d035788fb4e19b047f2d0acc0c368
SSDEEP 48:JZogJvUE5pAmkMUKbMduBW7D3RTepI9fvGkhwziTlE6m+igYTPWProXfOJELOvPD:JjrTMduWBT2I5v/AiTekQaPifJKovcX
TLSH
T10BA13AA78F4184A6E7630231A5C1D93B3C320FC95513BE8BC3E69CFE2B3575B5580286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589a95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a95.TMP
Size 3KB
SHA256 618691637572caec57f766dd21846cd65024695b9fd871b4b69c54c74d9d12b3
MD5 2b59095ba2fe00a613f8bdc38fdfec9b
SHA1 1381e6107540750c43b793f0921823237c2fc801
SHA512 7475634b47345c78231e59c51821e85be646e060b789c1b90996667045e54c5273fc6d219676147d8f2c848fbf47486066349c5ba00cfc00e0e9883c6d1ff3a2
TLSH
T14A7170A60F4284E9E7635331B9C2DEAF3C3285C985676E9B50E4187F2B3975F850428B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7235a19168ec25cc896ce0aa9663ea95a8f52f396b26255cfe16d1f562d22481
MD5 3efab2ed7a2ef3ae3f2a2444cabd2434
SHA1 ff783c2afbebad6d5399b84738efc7060269ea19
SHA512 651e1cb5b6c2d22850f4e344533add5ff5efcc455dc91881e043462698941961918b9d7eb7e5a84bf5efc62e582c2b4736a6621ee8a3cd3e5196e8840dea5e97
TLSH
T141417DB3CBE5996DCD2252F06A157F1BCE2E091542187C2ACAE4EF5793E2071D201A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6cf9cbf21005781544515f0b0a6d21fd5e416bc38ff4a31cf1b77929431149f8
MD5 3bf201a978b2399a11a5a114d1a2527f
SHA1 e8c169cc3f501d054475b3b965c144bc2cd2bde6
SHA512 d5abddb18c6bc35206c9ddccd403dcf947894d7eb0c8da30ffb72d89b8d2aa147b850d4b7f8340946560b0f1b7b20b2bff78a990cef0cee38721bf6beea992b7
SSDEEP 192:sxZWRgyM/jK1Ml8MkS/f+szM4/q6EdpwBHW6+WNvgR/Y4ZOeOmzIgrJ:sxZWWMS/f+szM4/qdEHbI/KeL9
TLSH
T16842E8126A346977CCDBD209FA41BF53D6F5057292940E54AAFCDA1C05E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6ce873e3cdb09665a304f6b820245204c1149757e560e007cecdefee977ed56d
MD5 bce395c90e84d1c639107d8ec798bc73
SHA1 3566573416d9d945f1ff0bfabd65267f0970ddab
SHA512 8dcfc19efd835a641485ce206e25a51e86e554f9ad11bd19c9b02056a6973b1342dbdaf97cf641eb63b83f6b2ba3f2d5fb1368d8df57a0879b125984c6c677cd
SSDEEP 192:sxZFRgyM/jK1Ml8MkS/f+suM9/q6IYgpmBHW6+WNvheXY41xOeOmzIg5iJ:sxZFWMS/f+suM9/qYQ6HbkX4eLs
TLSH
T18E52F8126A386977CCDBD209FA41BF53D6F5147392940E54AAFCDA1C05E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ebeaafebaef65f0e43d43e5441708b319f04fc9a0f374d828bc5c81c936e8e90
MD5 2c09129fa5d56b411599c12f770224fc
SHA1 e0d02406ad9bff442c7ed5c1e9b88871d0dd16e2
SHA512 91d9ea262e3049f75e7f233637818d7ce0085db75b4f8018bc10251f46349e71867efb37536506aff0f69a69bde3d340f6e10b6260b4a621a964062940a3d446
SSDEEP 192:sxZORgyM/jK1Ml8MkS/f+suM9/q6IY4IpwBHW6+WNvheXY4cmOeOmzIg5iJ:sxZOWMS/f+suM9/qYLEHbkXqeLs
TLSH
T12B52E8126B346977CCDBD209FA45BF53D6F5147292940E54AAFCDA1C05E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e875f869ff8c0e1eb113383bebb880266cb5ef51ad10db9e2cd584959ce42b4d
MD5 7ec035430b5028cf3a60988a07ac1bb4
SHA1 7554035f1636b006c565605aaf5d33c40eae5779
SHA512 527a2b779a26f22b5a80346201d75ec4620355e15c5b88043223399883d3eae1eb6bb23d15fadd9e07c1d5139a93781005ec61d49b7e5d6bc9b6ad376e719696
SSDEEP 768:GPEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1xroA4GSt:GPEPO/KWvWeI5u1jafqLXO1KySt
TLSH
T16FD20A3B680CCB7E4F840E9DEC2AAF966ED801CB67984D5447FA884C03C77EB511659B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c53b6f1b4f581977f695d04499694d059f733063ef4ac8455ed2551da1c4a9d3
MD5 e76d63771526525d7a12c9a9e22ffead
SHA1 3d7289d9ec7913dd8b98153f2bbb736c7068c8a7
SHA512 1d4e024fc9bd7848214eb6ccee26b3d5f26ecd53d11ce43ba6c684c9d34b06f9fe486ee11601b12e11a9f8c1bfe3ef9b5875e79fdc69bcec740459945b37f49d
TLSH
T1CEA002560A58C163C181567694A2438C6F34495602511352F0BF68548E51348C592259
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589a09.TMP
Size 48B
SHA256 a8c91fe20e39b9893c799cdab49ba5c75c5f2f36f5e0800c4ba565fc5edd6415
MD5 4a6bda80aa28a860ba6a3d090987c088
SHA1 14c5c43325ad6287ab0cab41d5101880b74f8156
SHA512 ceaac5eb5e475c0c7f675d0b2e78c77016e3b46e820e302b8d2283a067f0549c4cefc625f3403a6fce88f9acd64fdd1003f03cfcc43f80779174a582703a5947
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7996afa01482c7918a512dd1764f5a9c808defa14bcaea40746a9b406d1cbfac
MD5 574c5c2f4245d2b7d0308a1171015020
SHA1 3cac899efc3586ca3e57bdc60e53bcd6254e0d7a
SHA512 b6d7887efe71f8356ad4de39952dfbb72168e1f63b58ce005a72e3924cf140b53db37787f0cbc492ba92eb3bc462fd25c833ac80129ab30c6749133ccc92a1bb
SSDEEP 24:KdefxijawdEg84UA+nIjm8KiPhaA81EesSmSMj8ehyXYvf290axdl1l4xN+YIjR1:KgHIBK4wkPyhMIHKh2sdGIHKHqMLyC
TLSH
T18F91A756797E02823DBE384D95629B2B5B8132733204E92F7B7900B50E6BE121DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4fb1b22f6f968aae525cbc2d8cdc78fc69a8ec3faadb1e6ca0c6df0787437187
MD5 c0aa47500b821ac688d66b326660313b
SHA1 0bba4449869a00f2b3dcc036f99acc2cf92efa4a
SHA512 82da681557fa8f68cec5cd610dbf40fd46ef22b04f5f62f40a2ca080e53ac42212ea92fff99de41855e5d4978de958b7844104d925ec0e6c385051a5fabda2ad
SSDEEP 384:6sNhLkIH5HLpD7bVXq69BDlceoXncTv1x:6Y5HlHRnOncTvL
TLSH
T12A420B3268789D379AB7B645F04736139FB4512B96887F94D6FC2F1C01DA29C430AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 47f284029e251474783a1e841c47effe1420c28e43d45045c25e2155e993e7f9
MD5 d0885309ec7cc46094e58545982f6b30
SHA1 b17343f179ad81c6e5fdd4de7c2c764e612bf214
SHA512 2972450ba55f3961e52b736667365e4d94a5534aea02a17feba7ac08540e8806d45f44b11b02f8edf4437466e7d6febaaa573e6501ee52586727487bccc6f32a
SSDEEP 384:kZcIWGsNhLkqH5HLyaKVXq69BDlceoX7cnTKwBODNZOCCKDb:Cbu5HbgnO7cnewBKZOtU
TLSH
T150926C725838AD379AE6B545F44632034EF8916BE6C83F54E6FD6B2C01E9698030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1436cfd90d90559d106159febdee0b9fd23db97be2fbbf511cab0ab3e08a932f
MD5 02186c5133700749cbda3b0172d85d4a
SHA1 62ea47a213d0796a8f0cac042e76b783eae7b09e
SHA512 824aaf350343dd995b22283eaecde8c0fd16dbfddb4f7658c3451d7cb7728c8fe3b77d5097015952d80eaa345947eb5c82c4fefd4f2e98a018e683f2be83fcf4
SSDEEP 192:mONRV6rvoQmiUyaKmDrKhD4XqMB/1jfNjzoqURYce3ExMMU6:mOND6cL+6Xq69BDlceY9U6
TLSH
T11202E835A8686C7B9EE2AE09B48737135FE4202B96956F84DBF81F1C01D765C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bdeb5e03d0deca5db11d3bdbb8e3108c2616418cc3da8f9ec0bd21edab4d6153
MD5 4c2f42a6a628642b61607b535bc26c8b
SHA1 64fd0491e3226e0690abde5dd1686c36e2796b3c
SHA512 04a0fa4d2878569333e7d4f1347e441d6568bf08b487bc42f39f4d85cc2795b6115a075a0e4232c175e2f075a7de681f041af2c56b9fbe93aa4a7716eebefc0c
SSDEEP 384:lZcIhsNhLkqH5HLpD7KVXq69BDlceoXIcnTKwBODNZOCCKDb:dhu5HlHgnOIcnewBKZOtU
TLSH
T1D8926C7258386D379EE6B545F44732034EF89167A6C82F54D6FD6B2C01E9698030FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e2dcd4d155611ee91c293ef0f306539430c9ffa4684e5cb2af9eb808fbcd713f
MD5 77537cd7db67d018c679d79e80a24925
SHA1 fb402cb947494899dc0b18cb92824e3b4be6a76e
SHA512 817018ac3532c0048c40f37690f307d1a3eb6c756e552a171855ab4d62e774f462271b669e912e437c0d034f9469fdbfd3557529f6a28b24dfbd68deb7377ee7
SSDEEP 192:aONNa6rvSQmiUyGmDWhD4XqMB/1jfNjzoqURYceoXq9zICWqybU6:aONNa66SW6Xq69BDlceoXecU6
TLSH
T1C512F932A468AC2B9DE2B545F48736135EA5512BDA897F90D7EC2F1C01EB65C430EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15aaa3db-55c0-4c1c-9e25-58381a7e1fc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15aaa3db-55c0-4c1c-9e25-58381a7e1fc3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f93d0ca5-d9fd-4f2f-8b5c-0005e75b5d3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f93d0ca5-d9fd-4f2f-8b5c-0005e75b5d3d.tmp
Size 20KB
SHA256 8de7e123ae2b37d1764b83784a7bf0943e6309356bd9cdbb7b3fc7f754a2c4fa
MD5 5c8d4fd630c59ea43cdd770626184156
SHA1 81b2bfb9721eeff235c51b224527bc397f823ed7
SHA512 3032a37df54a54bb7100490770bd4009984a7c413573de5606c5b0c2c7fb7dceb4d772b640ab11fde27f87c7ac7a4f6739cf0e92f6a819355be2d06ee8877df3
SSDEEP 384:kZcI4sNhLkqH5HLy7KVXq69BDlceoXicnTKwBODNZOCCKDb:C4u5HwgnOicnewBKZOtU
TLSH
T12E926C725838AD379EE6B545F44632034EF8916BE6C83F64D6FD6B2C01E9698030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55688589725d3c3e37b18fe984398577a1e1cd47e6f3a5ecaa3159ce718b2c50
MD5 b77453b5ed9b62bfd983bf500bc61009
SHA1 fe39888606ccaa6b8f08d65f9abe22ffe070d566
SHA512 f4fc4e85e0deb8b1401bb22933b42d96f01b0c2d8a58af3b188bc13bab5ac0b5a56fb5158f1629ef6ce697dd8bd6afdfb271fa16bb7061c3656754bd63d4bc1e
TLSH
T13141395CBAF92148B3B3AE56AFF6A86D447F7D772F0AD05D10000E4E0A62B40C962733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads