hxxps://upgraded[.]se/konsultuppdrag/187759-inledande-analys-och-forstudie-for-pts-uppdrag-som-vagledande-myndighet-for-molntjanster/

Analysis

user interaction
yes
max time kernel
20s
max time network
14s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/08/2026, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://upgraded.se/konsultuppdrag/187759-inledande-analys-och-forstudie-for-pts-uppdrag-som-vagledande-myndighet-for-molntjanster/
Sample260811-q73absef74

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309301112142264"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{62032930-3FDC-4C35-ABC7-943C6CBEFB65}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5004	1072	msedge.exe	80
PID 1072 wrote to memory of 4744	1072	msedge.exe	81
PID 1072 wrote to memory of 568	1072	msedge.exe	83
PID 1072 wrote to memory of 568	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	82
PID 1072 wrote to memory of 3224	1072	msedge.exe	82
PID 1072 wrote to memory of 3224	1072	msedge.exe	82
PID 1072 wrote to memory of 4824	1072	msedge.exe	85
PID 1072 wrote to memory of 4824	1072	msedge.exe	85
PID 1072 wrote to memory of 4824	1072	msedge.exe	85
PID 1072 wrote to memory of 2180	1072	msedge.exe	86
PID 1072 wrote to memory of 2180	1072	msedge.exe	86
PID 1072 wrote to memory of 2180	1072	msedge.exe	86
PID 1072 wrote to memory of 1064	1072	msedge.exe	87
PID 1072 wrote to memory of 4028	1072	msedge.exe	88
PID 1072 wrote to memory of 4752	1072	msedge.exe	89
PID 1072 wrote to memory of 1064	1072	msedge.exe	87
PID 1072 wrote to memory of 1064	1072	msedge.exe	87
PID 1072 wrote to memory of 1392	1072	msedge.exe	90
PID 1072 wrote to memory of 4028	1072	msedge.exe	88
PID 1072 wrote to memory of 4028	1072	msedge.exe	88
PID 1072 wrote to memory of 4752	1072	msedge.exe	89
PID 1072 wrote to memory of 4752	1072	msedge.exe	89
PID 1072 wrote to memory of 1392	1072	msedge.exe	90
PID 1072 wrote to memory of 1392	1072	msedge.exe	90
PID 1072 wrote to memory of 4036	1072	msedge.exe	93
PID 1072 wrote to memory of 2656	1072	msedge.exe	94
PID 1072 wrote to memory of 4036	1072	msedge.exe	93
PID 1072 wrote to memory of 2656	1072	msedge.exe	94
PID 1072 wrote to memory of 3968	1072	msedge.exe	95
PID 1072 wrote to memory of 4416	1072	msedge.exe	96
PID 1072 wrote to memory of 4416	1072	msedge.exe	96
PID 1072 wrote to memory of 4416	1072	msedge.exe	96
PID 1072 wrote to memory of 1932	1072	msedge.exe	98
PID 3968 wrote to memory of 1204	3968	msedge.exe	99

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://upgraded.se/konsultuppdrag/187759-inledande-analys-och-forstudie-for-pts-uppdrag-som-vagledande-myndighet-for-molntjanster/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x2f0,0x7ff8b2fac188,0x7ff8b2fac194,0x7ff8b2fac1a0
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,3500485878654439306,445824492888436839,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,18123642833436804958,1071354509010218439,262144 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,6929645180846180250,14272740000263660933,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,946114395506229351,17748363322160837346,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1493238095486655486,12263735961013806041,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,17441401255502250280,17773342603742186,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,14593803601783578368,1200344823836420740,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,12833529443886155972,18063519473099745520,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4224,i,17347279353939367407,8529732353002059899,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,16921111053211597296,2864151523952202081,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11191330162674276166,9397667969685691139,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3834165161260715843,1474167904205061343,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6204,i,2727619282272839360,2426164998255076528,2097152 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,17245193529334398648,6957144017384981762,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,17245193529334398648,6957144017384981762,524288 --field-trial-handle=2060,i,6001018265582385435,8300213303104582179,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 604072f3abdaaeff9a9e2e7a7ab4e1a63bbf53f2e277adb4150d99d5b3224baf
MD5 01c4fc9d711a2936e751d84f4a964aea
SHA1 d63fe0317a0f1fafac3cdca3b31091bfc8c59615
SHA512 88ecd5f80fd1b4aee3d879f2922a6d41bc61c6a98f01c03a29eb32daf8ddb9ba8aa9ec1cb0e449e02716e2555db70650d40b8875dccfe04f82b9c4b5d109b557
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T1CBB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 331KB
SHA256 50fad63e01cffc4babec09c81e72d99a0112517eaef464b9ad7ecfa339c5b296
MD5 48c1a26c46af2174fa6e31a306fd11bb
SHA1 028762f3297d781ae93ce7c4f4bcc46b6e1b1780
SHA512 0b324cfd766adc6832ed3b032efa7a1e129e18bddc49b363d00c91978824c010a31e432e5d43feb8089b57ff61d5469c46c2ed450d855b87acfb0e664f1f14d9
SSDEEP 6144:3u5qAxUh4ihzAjuIAiO/viQ7Ryvot2qM9YTIGMrb2+lHVelGesi:GUmihzAqIAN/v5yszMnlriGVelh
TLSH
T10B742361751B1419C1AB56E902AFDFAC7EA6A3D63A7FCD023911E41DECC0339B69C890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1db1373208564b0c584630b3684df3cb1c8afc4901370794768d80d50026380f
MD5 07163c0ea75c402422fa1e78944c0624
SHA1 e149ebda8eb84e2f254b6b884b46b4b3e95c58f4
SHA512 2f624410f711c8c89bf7e2b1bc586c1a4b319325c3a9beeee4007fd2c63b9b3ae5dd27395f76b1967795dcdb3f1baf87b1e7b7fb1335ececb233760ce0394b2a
SSDEEP 192:sxZ3ROyM/jK1Ml8MFA/fqs0LLbIdpuJe/W6+WNWQp/Y0sCGCDIgrJ:sxZ3QdA/fqs0LLEqe/bD/519
TLSH
T1E5520A12AA346977CCDBD209FA15BB93D6F5447392901E48A9FCDA1C04E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 4d92470c4a47a87fb9a7b3144e4fc9292680491c1190633f531db3c6c8bd4721
MD5 1ba37ed336c6d1a4903488eff02b2346
SHA1 587d5d750b7da0db7b29846c8e4443f1f317c98c
SHA512 d5fc002cf66fd5c8cddb194269255e76d825d560aef5de9304cdad1f97c5c9ca4ed14d1a1de9a1c5ebe9f2b7f00f8c71b6485b56cf24d9c7988b458395cba6fd
SSDEEP 768:6V/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601ltroGa:6V/Xh8dF27kWRmwcQDwu1jaKmjLpkD1w
TLSH
T154E21A3F280CC77F4F844E6CEC26AF966EE801CBA658495447FA894C03C77EB511A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 788820fddb02bfa5321b08152225a110764350835346d297659f73bd4ec19135
MD5 c62183a01499d976d2c4ff6161ebdae6
SHA1 25f9a4bca0dd9f93aec3884a7d7e8071d1a11f3b
SHA512 20546ef0a13c7e9703d8ff1cab02244e616bcc78cc6920b1f84385a95cb3b493825f224b56f85a33630cbe66f09465a98e2253063ead17e340dfd5a10eb5ab92
SSDEEP 24:KdmfJ67aodcIk4co+PIj+kKiHhaok1Em0SmaMr8m5yXYVmfVJV6V7aVodVcVIVkt:KQbIJKoIsrylxItKS4wHy11I9KGAAC
TLSH
T1AF91D65272BA02423C7E2508829787675642F2A37014BD3B7BA88476DF67E635DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1a91971e3a28e4ba290ed519792b3fecc40520d22a07f4a12af85cdfd1b88044
MD5 f2cc35051c3b625e53586f70f27a1efa
SHA1 777d87e5b32c873eddd8a3115715888d7de687f6
SHA512 eca15a9cd468815128195cabefc500c7b6f0f5341a54b0a6c7fc13ae6c85437374e6cbaaa26e8576026dc86ebad32c04847a56779cef65d917113ca4156a5c98
SSDEEP 384:eZcIc8NKnmV7XiyWbr/E5r+11t+OOPrXLpe8C/0c:ccSqv/EVKt+Oi9Py
TLSH
T18B928E31ACB86C6B6CEBA941F44B37139EB88567F7C42B9C91EC9B1D05DA19C1307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e19f0af009570c10aacc61ce536deaf473cb13e123bbe2bdcc0e5df8b2592a9
MD5 5579ebce844f62be8f54755fd8bca3d1
SHA1 3293e8d087ade51fcf9914dc5963d3e5d5c9ac69
SHA512 8c4cc95e73d508c83a0b311dac3a3cc3fd286ebf35f8df2cb3fd41b6a1f77f4492194c3edccecbf677562b6e4d0bbe137fefa6d8f4352b98a00c74ea847f2f0b
SSDEEP 192:1GNZ6t6H3BQmiUy0HBH62Qq/rUH5m2+wD9MtCF8U6:1GNZ6MXfTU2Qq/E5r+ft88U6
TLSH
T1D902FA3878A8ACBB8EA35E45B44777239F94216FE6D56F98D5E81B1C01DB28C1346833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b928c8de27f396ec063765c8f66559080d458859a42e47bf5d3ebf6fcd4d45c2
MD5 712f806c36451ce796b9ee043c47352d
SHA1 aff7d633b4de4baa14a6cbb74d661cacdc979dcd
SHA512 8bd974528e840c5a4cb8063a6c3febacd447b37681cf530bf1d45a746cb82d69f914b225b9876469acd3df0eb1686f1311a2b7c56ff12e55f4ec401cf99d3a60
SSDEEP 192:bGNL6t6H3UQmiUyx0625q/rUH5m2+1Bb/9ntOqCU6:bGNL6MXku25q/E5r+17t+U6
TLSH
T116123A3578E8AC7B5D939941F44B36139EA4522BEBC86F98D5EC1B1C05DF29C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads