hxxps://kemono[.]cr/artists?q=&service=patreon&sort_by=service&order=

Analysis

user interaction
yes
max time kernel
46s
max time network
47s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kemono.cr/artists?q=&service=patreon&sort_by=service&order=
Sample260808-wezxdswtbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5800	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306850836745668"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{09348009-AB58-4EFA-95D1-BA02A1B74234}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3520	3848	msedge.exe	82
PID 3848 wrote to memory of 5800	3848	msedge.exe	83
PID 3848 wrote to memory of 2492	3848	msedge.exe	84
PID 3848 wrote to memory of 2492	3848	msedge.exe	84
PID 3848 wrote to memory of 2492	3848	msedge.exe	84
PID 3848 wrote to memory of 5588	3848	msedge.exe	85
PID 3848 wrote to memory of 5588	3848	msedge.exe	85
PID 3848 wrote to memory of 548	3848	msedge.exe	87
PID 3848 wrote to memory of 548	3848	msedge.exe	87
PID 3848 wrote to memory of 2072	3848	msedge.exe	88
PID 3848 wrote to memory of 548	3848	msedge.exe	87
PID 3848 wrote to memory of 2072	3848	msedge.exe	88
PID 3848 wrote to memory of 2072	3848	msedge.exe	88
PID 3848 wrote to memory of 2052	3848	msedge.exe	91
PID 3848 wrote to memory of 2052	3848	msedge.exe	91
PID 3848 wrote to memory of 2052	3848	msedge.exe	91
PID 3848 wrote to memory of 2476	3848	msedge.exe	92
PID 3848 wrote to memory of 2476	3848	msedge.exe	92
PID 3848 wrote to memory of 3944	3848	msedge.exe	93
PID 3848 wrote to memory of 3944	3848	msedge.exe	93
PID 3848 wrote to memory of 3944	3848	msedge.exe	93
PID 3848 wrote to memory of 4300	3848	msedge.exe	96
PID 3848 wrote to memory of 4300	3848	msedge.exe	96
PID 3848 wrote to memory of 4300	3848	msedge.exe	96
PID 3848 wrote to memory of 3444	3848	msedge.exe	103
PID 3848 wrote to memory of 380	3848	msedge.exe	104
PID 3848 wrote to memory of 3444	3848	msedge.exe	103
PID 3848 wrote to memory of 380	3848	msedge.exe	104
PID 3848 wrote to memory of 5128	3848	msedge.exe	106
PID 3848 wrote to memory of 1852	3848	msedge.exe	110
PID 3848 wrote to memory of 3176	3848	msedge.exe	111
PID 3848 wrote to memory of 664	3848	msedge.exe	112
PID 3848 wrote to memory of 4808	3848	msedge.exe	113
PID 3848 wrote to memory of 4808	3848	msedge.exe	113
PID 3848 wrote to memory of 4808	3848	msedge.exe	113
PID 3848 wrote to memory of 2436	3848	msedge.exe	114
PID 3848 wrote to memory of 2436	3848	msedge.exe	114
PID 3848 wrote to memory of 2436	3848	msedge.exe	114
PID 3848 wrote to memory of 3532	3848	msedge.exe	115
PID 3848 wrote to memory of 3532	3848	msedge.exe	115
PID 3848 wrote to memory of 3532	3848	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kemono.cr/artists?q=&service=patreon&sort_by=service&order=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffc8b27c188,0x7ffc8b27c194,0x7ffc8b27c1a0
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6208438928208356820,4444985744116443383,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16451502480045722650,6030495858515471974,262144 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,7579351667676315119,14298563628687160012,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,8472035606973171689,2089360504613858298,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,16401662289812309691,6305663782832453040,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4980,i,3776699857653105853,6515426421572537213,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,4294199368866359664,2039947885826705351,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5020,i,7971909040885317100,6058585742480509402,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3568,i,17582560682276909579,2100563023115423782,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,13984009657477257534,480070507229361117,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,6243600579370518035,17593479889047106520,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3742139719063719080,2390631193063938449,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3742139719063719080,2390631193063938449,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,12923841265800218379,13656793482349835108,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,17749710458310364094,10421528286983870734,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,17765105813524691358,13966110099223979815,524288 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5216,i,8112782537040572939,2602312641815844509,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5716,i,9477048637320758497,3135840046751361619,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5068,i,2300359405704662278,8741961699555416040,2097152 --field-trial-handle=2024,i,12038160983419284010,2284409433433285914,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4529dfd4f12903ad7b2b041b4686eb29600942ac82249beaa0e5afe13be26ced
MD5 afdc517f74ce5556fc925eeb45d788ba
SHA1 89756b9434b2061f027abacb6d2560c8c6735a6b
SHA512 151a85dffcf78e56a655fa262f02fe5d9ac978a41864b70c44527542fd6cbeef45bf8a149302f620469cb00e5d1d58eb31541180624c02ffe5fab3725db036f0
TLSH
T1D7E022E9CD71AC370CFD0B6C54614B46E745139B2B80491F3A3C95088FB26374282C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 329KB
SHA256 f1feb0f4525b0e3d3eb220731e27d670f8a110041a7ee642258e0280744fd05e
MD5 2d2fdca87f0eba4a88e52513f8127cd8
SHA1 b76b43fc136f0390071df665937af2530830cdce
SHA512 7967d9a2e39770f78d6456757887c2f9df33e68f4e71653281fc316a2358995565b7a509d703b565b77ff804d76eec671fcf7c58276faa530bebd8d2e4f6ae53
SSDEEP 6144:k4CVepFQDvCkKxHCVThzgJeR2l5PKdLu+BzUtRdRPqqNSl4mTKV+2GXGm7nnjT:HCVaSKkKxHCVhgJAYdAGRymSCifXGm7v
TLSH
T17B7423F74B125BB16230BA7497EAC03A8EA9731A518C5708490FF7D7296D27C189FCB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 19KB
SHA256 6a22ce0b2709c7e856a8bd9bbf31b0f7695caeeeb03915b0212d6d959e9bc1b9
MD5 462df98ac3c165313a4901b2f7b19cdf
SHA1 ee8fae8053bdf30a0d22c568ce7185f76a0609c6
SHA512 3afda65991182994e13c52fd5ae338ecd947243f63fc98473cfa9fca0b84ae2986d758a21a78c1273e71b5ead0020a609a43437cea6f04be35fc47d6c89174da
SSDEEP 384:Ug+Z+rzZEsgriqj22AZDOBR+Og3wBXswEsAckaDwOswc0TcJaUbKkCVF2RsG:UgTGsaRVEDOSOg3wB6IkCwOsx0AJfbKo
TLSH
T1BD92F104EF9D69E4C3AF297260F42B789C1A0E36AD54CEE57618B198BD1AD8A3649200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 1.2MB
SHA256 215cbdd7f86721d86f0d802977c0e776b40ba0d1a22cdec795e6bd2081af36d9
MD5 0209c1f3a29e3d66adb43de08065e12a
SHA1 e2b2f48e5eae489585415348d6420b438a9d9846
SHA512 556b25b928ba480aae4ee38cb6189610a5bfa4ea6d19b08c0548e8edcbaf83453b0aafb1af2e6399644733d03097ef6c49ce8a7c9b6c611d3e59dad7f530ad3d
SSDEEP 24576:1LQcuYhcEyro+WgcMnPTduWN0ea2Pj/mnExrQ6XjODI:1Lvu1o+eMnxuW+P2PaExDXiDI
TLSH
T1EE452364BB996C1FE567C8B21108A6A8F6689C124B846F933548F71FF9FC1C5D930CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 564KB
SHA256 968a2aa44b3917811b40355d665b5ebe2e203491d9d9d2735719312b56ed7a40
MD5 5a9ec4104fea2a7cefa289d6afd24871
SHA1 e0abab731d0c59f886972cfcab07243c094cf62c
SHA512 84de11298d522695e88a41e8c0faece6757660757cecfcd030c68f6a847a342c84e8b8a21393a8f30b9bf8653ebe7ea8c522c5317830687929e5ed34075ccfde
SSDEEP 12288:jPBZHdqshe1SxcjpYNBHFeB/BbN52QVtE9GmN7gTA6dcs6:bBZ9qSjwBuKtpmScZs6
TLSH
T1A4C42359674E2CDB9E61B079264A5B929E9B4C4047443F6B3A02B78EFCFC484E43489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95269ac8c50022c0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\95269ac8c50022c0_0
Size 290B
SHA256 bb14a749c5965a4e50841163f66de4baa3f172e8b7ef4006d3e7dc20fc6fd840
MD5 fb865d6526dce453f44d5063bc0c0d02
SHA1 04439d3d80ad4e6384d5878d1f9395d663ef4c9b
SHA512 14c65a4bc1f17d05c42136acc78a075890ccc0378f036ffca60c4ff35762b7904a60bb9cc52677f56520c2ce7a772b45d6d2a948acc3f1c708d8d4cf2928ed73
TLSH
T1DDD02B57270C4C0ED97CC6B17E5E155EF738496E0474A685D0908157B71143D6225405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f2b3b583b07d52b49cf9523e40a2584cacf92f11ae5b54975a299ba3207374d
MD5 f108963e2ec59961ea86c9fb69feb548
SHA1 d6010e2fe760877da01138b9ff413a39bb66651c
SHA512 33af09684b2a524a7ff9c849e5d2bec1a55414e5e0c103731f3cfdf7f04ee15d7834ec17cf06d2ce5fe41723ad5466356c33d34147f7c8c7151d371e8c8ee6bd
TLSH
T1C9816F2942924E51E7604370D3E00E5230739067BCF38E4DAA974875EF6E71D55F6EB8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5884ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5884ac.TMP
Size 3KB
SHA256 3a3a73c5d96c86c6439d1d5c98bf3329a5fe1326523f5eef7b898892caa98933
MD5 9e4f46850acf854186fc60084aca8b2b
SHA1 4fb934e7b9d40d448c6762c792648204fee333af
SHA512 b66144e71b275096a4b754a55e6358fea606f7b66d1d8cad5f8ee062cc75065618b89e85fe9e7bf1a8f1e972a641be7a228065a4a20debf22ef71db08e9eb3ae
TLSH
T1BE61932942834462E7A00374C3E00E52703785ABBDF38E9D99D75476ED2EB0D95FAEB4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 88007c66fb17ee8b80850f8a233cba9281abd35fee314a82ded444ed7c3f09f9
MD5 b03ebf6297b4deb75eebd60df1dc28ed
SHA1 10d3c10306a651bf07815520b9d8b9b3a43fc6a0
SHA512 760b5429c23d6dbf72490a2d37d3dcaeaddeac80f9b2ed308fd0350df3df2eecf35586a8da2a7fa2fb468267fe4b25208230040b092026510891430903a8a461
SSDEEP 192:sxZHRc9yMvZjK1Ml8MkQ/f6s6fYZZy7zodp0dbHW6+WN2P3dYB5u1WhIg55t/J:sxZHQMQ/f6s6fmZDUHbSdr23tB
TLSH
T1CE62F706AA38597BCCD7D209FA557B53D7F8157392904E549AFC8A0C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31cea22a9b12efeb0ac85177b2b154a9b6c85b12c95d20eda8462bb7ee61b23c
MD5 4daa58c55179dadce5385d72f7a8d9b4
SHA1 80b791a66518ea98bcdb3f99e31a7f763799855b
SHA512 9ba89a59cf6b80cf62d033af1b44939231d72ff9b3dcc262e3dccd75076dd19c035c0ca4a55d24bcd80d9da955194473d4d3c61194c78afc1beb41d86d3a4f2d
SSDEEP 192:sxZHRc9yMqZjK1Ml8MkQ/f6sKfYZZy7zodp0dbHW6+WN2Ki/YBAu1WhIgjt/J:sxZHtMQ/f6sKfmZDUHba/+2jtB
TLSH
T18962F716AA38597BCCDBD209FA55BB53D3F9556392904E449AFCCA0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a5db2156eb4fef5daa5096bff3f90657bd3e3f7e4afca552041515b3bb00ef9
MD5 d8fc0d9ea27f21fb344721ee644926d8
SHA1 13d74fb1b76636436ea648ef0842d2db1c86ea2f
SHA512 6e20274faa19d10d87a4ce06ab63f89516038cb2f97b7aac380d044960e3c29640ac920260a09b885f4ab19ece0927ab3c06e980b145b56014170d5af7d4cccd
SSDEEP 768:P4E/aX6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVLlFX6BaroVNm5Pa:P4E/aX6WvCuFOu1jayVLfqBRVMha
TLSH
T18FD20A3B280CCB7E4F844E9CEC266F976DD801C796988D5447EA884C03CB7EE511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 597083f9dbb7935ea7d3e7b6cd03e528b61c2d418215d989dc7568206c40f098
MD5 03791a82d737dbbca614561d577515e0
SHA1 565ebd19003330668b02b3e4964a8bedacd32370
SHA512 2aacc666ee7761a3cf8c18b0d3953dec8d1c09b225af89680608ee4e96af20795cc88e47617c6fa68da0472ba8ab1e44291751eaa374511de3c6dce6659b6852
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAA:8ptDYDcfvNR1ANAJ5P3
TLSH
T1D7B25B16713B075238BF2508A69399379E4235A33418E4BF7BB914A21F67E225CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4a0102402e931c77d6e058743f384a2e3c0b7061d99d9ecf0ecce189235caa62
MD5 b1a78b4d4d5ce69e7768c387ce6a0323
SHA1 5ffb863f53a1866c753748757bea1247fd507316
SHA512 dad6bb707e322d5cb282016c2f14129870ba79f24b4270e166f7ed5e7b80affc137fe81dfd2d9bf1f90540967efb7ee2a7c52402ed280615f37a7a0c365c1d95
SSDEEP 384:nCiF9CcmyWCs3sN/8TUNTUlImkrDcYrzAJ4fOGHZwidYWJXKITrn8wLaJCra5eT5:JFccps3swgxZUGvhvn8wLaArXl
TLSH
T1B8C24A32D898CABBEDE75BD5E35A3643DEE04163868C9AD0DADD2E0D018B1DD074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 04718b5c67b48c650a70be7aa2fd7540f1f655a3db1cf2aeaa847bb2f6399eba
MD5 111fedfc27ee779f42284a62f7d61115
SHA1 2816b841bdd82ce157f44cf4022ccb6c7f4ffdd2
SHA512 24d5cc613b4028ada94ac0d48f5404f56d78f1a27a4e8aa0c26088f52ab48d14840caf9c81eb0e30472b066498da0cb67c7f69247ed9d8dac53a470bfe39d67a
SSDEEP 384:neiFiZcIDsNL8TUNTUlI4kXfDcY8bRSJ2J4fOGHZwidYWJXKITri8nTKwBODNZON:1FQDcwgbrESJWGvhvi8newBKZOLx
TLSH
T115D25A31DCA8C9BBEDF79AC9A75A3603DEE4416396CC5AD4EADD6E1C009719D030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2d5234089b56c8f77e46f6d62b4dc75ec8dc274dc1d0a11897e34a97dbd26bfe
MD5 a67ef368de83a63afdfc7aed9f0c96da
SHA1 bcfa199204de9c9d0fc37b0909a3b5b6780ce287
SHA512 ac415e07fabeab2d33f8cb87eba23ecb89359ff57c5d71ee7c0748c09075be1e99e91155518e5f9dc79e59b693be8365c19736d512caf05e3c7e9aa59cbd2833
SSDEEP 384:nIiFiZcIDsNL8TUNTUlI4kXfDcYpRSJ2J4fOGHZwidYWJXKITri8nTKwBODNZOCo:TFQDcwgbr9SJWGvhvi8newBKZOLx
TLSH
T174D25A31DCA8C9BBEDE79BC8A75A3603DEE4416396CC5AD4EADD6E1C009719D030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3dbeda72f06b740cc72713aff18a69ccbfc67571ed9979ab5a97b10a946a40e9
MD5 f8dd5e3dbecb9211da9629500d26d143
SHA1 b84ba1abdd490d209956959b8aee39b3ad53b1cb
SHA512 75011f217c2e313ef2e141ee6041debde8c71c3dcf3ee59dd7fc9fdcb79d238fdec1d7908b35379c6e1c1564acaf4d3de5e7ab468d9d539b9c06ccc0db6d4544
SSDEEP 384:n/iF9CcmyWCs3sN28TUNTUlImkrDcYhK9J4fOGHZwidYWEewLaJCra5eTgHy/7II:KFccps3RwgxOXGvEewLaArXl
TLSH
T1ECB25B31DCA8CABBEEE75FD9E34A3A57DEE0016786985AD0EAD81D0D00871DD034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8b0c352dd06568141ad67186f638e3708aef2526ad81ec5341d72808eeff0388
MD5 63e887f08b5d23d3415c939a0fb9442a
SHA1 a3e24fcb8c50fc71a2c546975cafc25c21ed68f3
SHA512 b488e3860265ee4e3ec1149f819eff219c2e79467c40437820b956cd797f8d3cba4a143640a4c01df5534c4069cddcc4fe4f1cb878e494b0114cc968071d7443
SSDEEP 384:nIiF9CcmyWCs3sNL8TUNTUlI4kBDcYpRSJ2J4fOGHZwidYWJXKITri88+Hy/7Igb:TFccps3cwgh9SJWGvhvi88T
TLSH
T113B23A31D898CABBEDE75BD9E35A3603DEE04163868C9AD4DAD91E0D01DB1ED034BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c2cf5fb296d27d2a320ea436ed7766b7e8b3ab18e7da51d82e626f97df65c483
MD5 319fc913c2175da406e0684d1cc77513
SHA1 b3fa317ba90bf4f2a45a6b5abf7a4fb86f9ab229
SHA512 103e5a17d053e7fe7c28e87de1771170e0ebec520a949221f4f0177b667aa6d1e9e7732524d08696b85486646fa0d4e10c457f2db67a3c15bdf7d9bc150ac6ab
TLSH
T115412A5CBAEA114CB3B76E569BF7A86E487FBD372E06945E10410E4F0A22B40D961733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/5128-546-0x000001678F4E0000-0x00000167904E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads