0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/public/index.html
Size 383B
Sample260809-eq933atvev
SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
MD5 e582b9106fb430459c697d4c5a519c25
SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
TLSH
T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307226075445405"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{D11B2F56-1E29-4EE9-B3CD-7DCDCEF9F6BF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 5052	4308	msedge.exe	86
PID 4308 wrote to memory of 4704	4308	msedge.exe	87
PID 4308 wrote to memory of 3980	4308	msedge.exe	88
PID 4308 wrote to memory of 3980	4308	msedge.exe	88
PID 4308 wrote to memory of 3980	4308	msedge.exe	88
PID 4308 wrote to memory of 2120	4308	msedge.exe	90
PID 4308 wrote to memory of 2120	4308	msedge.exe	90
PID 4308 wrote to memory of 2700	4308	msedge.exe	91
PID 4308 wrote to memory of 2700	4308	msedge.exe	91
PID 4308 wrote to memory of 2700	4308	msedge.exe	91
PID 4308 wrote to memory of 3296	4308	msedge.exe	92
PID 4308 wrote to memory of 3296	4308	msedge.exe	92
PID 4308 wrote to memory of 3296	4308	msedge.exe	92
PID 4308 wrote to memory of 3456	4308	msedge.exe	93
PID 4308 wrote to memory of 3456	4308	msedge.exe	93
PID 4308 wrote to memory of 3456	4308	msedge.exe	93
PID 4308 wrote to memory of 4532	4308	msedge.exe	94
PID 4308 wrote to memory of 4532	4308	msedge.exe	94
PID 4308 wrote to memory of 4532	4308	msedge.exe	94
PID 4308 wrote to memory of 744	4308	msedge.exe	98
PID 4308 wrote to memory of 3320	4308	msedge.exe	99
PID 4308 wrote to memory of 744	4308	msedge.exe	98
PID 4308 wrote to memory of 3320	4308	msedge.exe	99
PID 4308 wrote to memory of 1088	4308	msedge.exe	101
PID 4308 wrote to memory of 1900	4308	msedge.exe	104
PID 4308 wrote to memory of 3760	4308	msedge.exe	105
PID 4308 wrote to memory of 1632	4308	msedge.exe	106
PID 4308 wrote to memory of 1312	4308	msedge.exe	113
PID 4308 wrote to memory of 1312	4308	msedge.exe	113
PID 4308 wrote to memory of 1088	4308	msedge.exe	114
PID 4308 wrote to memory of 1088	4308	msedge.exe	114
PID 4308 wrote to memory of 696	4308	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe0b01c188,0x7ffe0b01c194,0x7ffe0b01c1a0
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,5490800549013547436,17894478554052060414,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,5591171312749988786,1622091609293199377,262144 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2724,i,16690210696407040539,14785377107310947202,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,259786737346154033,8447603125495687365,2097152 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,3136410791295880041,2419777232941383806,2097152 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,13894307796047515571,14971817879968350765,2097152 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,888513851293854749,11257395691638241114,2097152 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13523582233759509435,4235748210005833466,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12028765735257364546,2739617130996714412,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6845107425741314139,7013255613077267134,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6845107425741314139,7013255613077267134,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,12760300251807319005,2351101027314840133,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,2648007457970777931,16447501622688028421,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,5428762806461009414,12419736158849524284,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,16333273633744607934,7931931823406374815,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,9000411155261473244,12384536877340988504,524288 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6676,i,3513757359203495784,12650079788912281796,262144 --field-trial-handle=2260,i,13702794440784724268,5768517009759574856,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f704e8e52e2763598c55fc37d308528eae8514fbbe3082126fb20637efeeb211
MD5 742bb23d59bd3b7e038dc49e2b78a4be
SHA1 9639af25199e65f1b194ff8214b99284aeef6a65
SHA512 92744b8c4b25c27c6f41b864cbc6abf4339e12b38c1742d7999deaba05ca0d0c62419d1189676d4c2c7985ce54aca7fcb5e18832fd41898b672288dea5e5dbda
TLSH
T1D3817FB8024312AEE37D52319ED21E3C747382E8F9235F5B61A4D8B1ED957A3D2364C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c147.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c147.TMP
Size 3KB
SHA256 954686d7dd567a300870a71c3cee03bd9167c93cc15324c9ca403d3699807e75
MD5 b6c2bbd454e8230862fd3ef03990b172
SHA1 73d2e08d37399721589cb8eae6bdd74e53c2a2c6
SHA512 2dac4cd48193a82c4f45116c79fb80328a0b0f54ce05537992d4d228aefbd2b50d4b9563692baebefb0005c3001a079dcf2afcd9d4d98e1cbd29738588f62a03
TLSH
T1458160B8024312AEE37D52319ED20E3C747382E8F8235F5B51A4D8B1ED95B93C236484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6c098a25f39405982a63473935d65ff1cfdd5b901bf93a013c2f04c3b0939485
MD5 644c8b89f7fef19afdaf894dab262b7d
SHA1 9ac417687d6b3f1f8ad3250f2174e88f9f4b7403
SHA512 d74a7fca49e024da7d61d31edf4363e1d2ba8d9bb95869738d5dca57eabdd0707a22ae60ae2974d7d655bb3eaa5e2f6fe53bb72e3fd881d86d0cd61f64f8a513
TLSH
T189117DB3C3D5856E890556F05A24AE1BCE2D0506421C7C19C5D4FF2B93F3075D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 298a8b5d542ea5fe393c35483bd21569a61c40128af50ff30ac3954f85aa736e
MD5 32fa46931de930a6d1345da554f43ebb
SHA1 6a60756116f06155e8dce81d23539f6b46873092
SHA512 c00882285ae101328b1ea8faf2ed55c8f6b3d379c001e6b582631811dc22a9ab45d4f03b20c0840906783955434348b9076b2afa4eb977f431510b757aeb43ad
SSDEEP 192:sxZXR0kk/f+sbpgIIdpdbHW6+WNGYCkjnv+6IgrJ:sxZXtk/f+sbpg5NHbGqvF9
TLSH
T10D22B7126E38A9778CCBD21DBA15BF13E6F95032A1951E58E6FC961C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8c0edfa24592eb0aea3e0659e271b4f718a6bad10a9a0949d1c51d4af06effe9
MD5 d011b4732ed4779c16205823a99e70fd
SHA1 335bfe777a0fd239c43b3c4defa62da0bb151053
SHA512 592a086ded48c6857d099b9fedcad75eae4c99af4d6f287b91684eef25227d30b90efe36685dd495b21aa33867d9d2433445f8a54e790c23c30c1c88d00ab23d
SSDEEP 192:sxZXR0kk/f+s8pgIIdpdbHW6+WNGYCkjnv+6Ig5CVJ:sxZXtk/f+s8pg5NHbGqvFO
TLSH
T18A22C7126E38A9778CCBD21DBA55BF13E6F95032A1941E58E6FC961C04E7ACD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2e33675012b0d62c097ff992080ff3fad6a9e2d0e08d8469da701472f293b88b
MD5 55e284299b8c78b6b51b9b88194081e6
SHA1 f44d67265eb688f5b6ec85c9ce4722242b0971a5
SHA512 ce5f37c9a6ff02db72e581593b271c80c97e6b685373542d42f18adfc20894f6628b30930eab7bfe60510431455fde82d37c3e04344a3b01ea42f17e0efb068c
SSDEEP 192:sxZXR0kk/f+s8NgIIdpdbHW6+WNGYCjPnv+6Ig5C/J:sxZXtk/f+s8Ng5NHbGnvF8
TLSH
T1DD22D8226E38A9778CCBD20DBA55BF13E2F9503291951E58E6FC961C05E7ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c2a9f1c3c5c34030b3629a7db25fb921a371ebd12bebe5d2d470bbaffd1148a7
MD5 de142d113ec70dc40f2fa999a9daac92
SHA1 79b23de7eb66fd3a582c6904824fa05e1ff37b55
SHA512 85f37f28b7ace9554c4421b65ccc4e3401e6efc2c944950ec3d5c4f62784a1c3bd1a534298554469e3752938e0faed06700c07d9a880dca2090ea4b5357538fa
SSDEEP 768:xbqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKr4roF3:xbqbUj+WvSCs6u1jaaZLbWrDV
TLSH
T197C2E83B340CCA7E4F801E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 47ce11731e13adb23f0082f8bb017dc2358bf285f77072336bef0d5df83c4730
MD5 90bf4c3d5d4d7424d1cb59658197448a
SHA1 ac2a37277bd0ecbb8e74bbefd88757acca1ecb7d
SHA512 1f60fa0af9e5aa7bd6ea33118c9a12c695823cce364d900334759cee143336bbcebc1b963f0d982bf318d6aa822122e7fdecd292b212aa3b2a18afba757de40e
SSDEEP 96:KlkdQ0uS+gyKHzssgK01s2gA8s3WEtGZiKCopnSKgkO8:2kdQ0uS+DKHQsI1s2r8s3WEtV3Z8
TLSH
T140917E6130BF0601387F790C9699893ACE4171A33515A4BB7BB800B5AF66E521EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595c30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595c30.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5809ac5614a610f3bcdfca380c10b4d3bef3cfcf9a4c199d6dcd9bcd2f1dd0d0
MD5 99df868ed893cff552c9bfc5716d4078
SHA1 88cd249f6e4a91da0ea97916576e57113dfbaee8
SHA512 88ad67b920a9c8bec29e23323f8d9974d8cee07a0fb573101200313ab74c6d48792b694a4246d0a88de0aaf20fb83caab47b29b88e207f2faecdcc781b511f72
SSDEEP 384:YsNRUqD1QD2HuEa+mOByuv++VvDnTKwBODNZOCeWjS:Y0DNabOAqxVvDnewBKZOjWjS
TLSH
T130725B3A683C9C734DE26645F84B32079EF851A7D5892FA4DADD6F1C00DB29C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 85f092428656005a81ae65349d9c0087cd7736cab7218ffb60bbeb29ba11d8b2
MD5 36bf5c92470bbddba15591acb65bdba2
SHA1 3c1de7bae39649b397493de86b3c907f1cd52db4
SHA512 af30dc48279a5cb1104b5e1d41e7ee0d40044a2210d86c41ea10859d51c90f78da7a9f561711101b0991a5f2535488c271a40b051f12aa3dd0b8dc2e70fe9c53
SSDEEP 384:1iFszsNR8TUNTUlIlbD1QD2HuEa+mOByuv++LvDnTKwBODNZOCeWjS:8FQKwgTDNabOAqxLvDnewBKZOjWjS
TLSH
T161823A77586CCC779EA65B84F94B32079EF841A7C9856AA4E7CC5F0C00DB29C234BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fceabc9065b6160cd2a48e053306826f63d10ee137d6e60809faf1a5bb1661bb
MD5 e54060976c92f4ae4dbd39366524b20a
SHA1 aefe293a01a713ef1c2edcdd2ebd209648f59043
SHA512 ae67547371abeb9d9aa24fbd1331ca73a9079905657cee3be0fab4b20cab53ffbb1d7f3328ac5b05594b771971b7d8768a162732d23091afea166a68a1da496a
SSDEEP 192:vONx6Db6QmiUyu0HBa+jqOmWtm7RgvnIU6:vONx6ucHBa+mOBHvIU6
TLSH
T15402E93969786CB79EB26E49F48737275FE5107BD9962F84DAD81F0C00D764C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9a06c1b746c6195beabd41c6a1b3272ef967e677d681f76009c6bcb28a6ca7a7
MD5 507a3d1ac8b13528afad76ae9560c14d
SHA1 b497fa0b738844d2ed1dca5ba0206a23379d4cfb
SHA512 212318f42491aebf974a87cfb6cfbfef6a820b58dd9c7f65e24f64be8abd6556a8bfaa1835bcbb537b11bec34bad9d18f8b9cd72858a814c7cfea3a4fa023101
SSDEEP 384:1iFszsNS8TUNTUlIlbD1QD2HuEa+mOByuv++EvDnTKwBODNZOCeWjS:8FQ7wgTDNabOAqxEvDnewBKZOjWjS
TLSH
T109823A37586CCC779EA65B84F94B32079EF841A7C985AAA4E7CC5F0C00DB29C234BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 4131a1ae7d0390ac8c2d9ca9c7b36f40b7f80c8176bbdd5d0f04269fd36eae59
MD5 c58e1855e0efbb5fa59e917e451628da
SHA1 31ae7cd2e15882a40bd285622bd34ac3e5215200
SHA512 2d053a4d15ef4776da3eb228e5bd86c5e8da2952ecfcc84b374e5f69bdd65120676b8223f72162ad7aaee9c1772b464b26bf05449decca647f226d3371af149f
SSDEEP 384:qsNRUbD1QD2HuEa+mOByuv++VvDnTKwBODNZOCeWjS:q3DNabOAqxVvDnewBKZOjWjS
TLSH
T164725B36683C9C734DE26645F94B32079EF851A7D5892FA4DADC6F1C00DB69C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1fb1b28286197971a1b8963a5ba990da52203e1d7a622d7de6e41d35c200d964
MD5 a7c661cc063f17b2a281ec63e6814a91
SHA1 627ba90d491dbf297f82a41923c231a2649eaed6
SHA512 9c0757eb0eacc22233f1c1be9a071a7c9e597bdf5712ba7b4bbed1a79ee44a4d50fe83957f4b6ad90b9533c47cd26bdcba562099feddc2273c4dc96436176226
SSDEEP 192:VONL6DbpQmiUyY0qBa+jqOmWtmtuv++xNzvsqFU6:VONL6/YqBa+mOByuv++HvDU6
TLSH
T16F121936687C9C775EA26584F48736179FE9416BDA8A7F90D6DC2F0C00DF65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b483442ff658cf09fda8fc847cd1cc29e98bb0d511930b19885ae015c62c3a3
MD5 764968e2112eb0d0f91bcf090014cb32
SHA1 f79ff7589bc5eaafb7affc47f428395d3d53c5d5
SHA512 b78aa3dda245a4ed1922fb93fa6f774e53ece5122978326bfad3bf6e55efd0fbb77241f67975120c7c1cdc03b9446e65438a56a321f3105ef8ff4dad134a12bf
TLSH
T1EA411859BAFE1148B3B77F569BF6A8AD487B7C772E0A959D10010D4F0673A40C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads