hxxps://bdr[.]granicus[.]com/t/6279/sc/aea054a3-84a1-4cf5-aec1-ca9531e233f8/NB2HI4DTHIXS653XO4XGMZLEMVZGC3DSMVTWS43UMVZC4Z3POYXWI33DOVWWK3TUOMXTEMBSGYXTANBPGIYC6MRQGI3C2MBXGY3DGL3FPB2GK3TTNFXW4LLPMYWWG33NOBWGSYLOMNSS2ZDBORSXGLLGN5ZC23TPNZSGS43DOJUW22LOMF2GS33OFVXW4LLUNBSS2YTBONUXGLLPMYWWI2LTMFRGS3DJOR4S2YLDMNSXG43JMJUWY2LUPEWW6ZRNO5SWE===/GBSWENRVGQYGGNJUGI4TSYTGMYYWIZLBGNTDIODDGZRDSZBWG5RTMN3CMIYWMNRS/www-federalregister-gov-documents-2026-04-20-2026-07663-extension-of-compli

Analysis

user interaction
yes
max time kernel
33s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bdr.granicus.com/t/6279/sc/aea054a3-84a1-4cf5-aec1-ca9531e233f8/NB2HI4DTHIXS653XO4XGMZLEMVZGC3DSMVTWS43UMVZC4Z3POYXWI33DOVWWK3TUOMXTEMBSGYXTANBPGIYC6MRQGI3C2MBXGY3DGL3FPB2GK3TTNFXW4LLPMYWWG33NOBWGSYLOMNSS2ZDBORSXGLLGN5ZC23TPNZSGS43DOJUW22LOMF2GS33OFVXW4LLUNBSS2YTBONUXGLLPMYWWI2LTMFRGS3DJOR4S2YLDMNSXG43JMJUWY2LUPEWW6ZRNO5SWE===/GBSWENRVGQYGGNJUGI4TSYTGMYYWIZLBGNTDIODDGZRDSZBWG5RTMN3CMIYWMNRS/www-federalregister-gov-documents-2026-04-20-2026-07663-extension-of-compli
Sample260811-srm7ksgn21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309353110498675"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{8CCF94EF-9712-41BC-929B-BCC3669AEB36}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2036	2724	msedge.exe	86
PID 2724 wrote to memory of 3948	2724	msedge.exe	87
PID 2724 wrote to memory of 3940	2724	msedge.exe	88
PID 2724 wrote to memory of 4832	2724	msedge.exe	89
PID 2724 wrote to memory of 3940	2724	msedge.exe	88
PID 2724 wrote to memory of 3940	2724	msedge.exe	88
PID 2724 wrote to memory of 4832	2724	msedge.exe	89
PID 2724 wrote to memory of 980	2724	msedge.exe	90
PID 2724 wrote to memory of 980	2724	msedge.exe	90
PID 2724 wrote to memory of 980	2724	msedge.exe	90
PID 2724 wrote to memory of 2500	2724	msedge.exe	91
PID 2724 wrote to memory of 2500	2724	msedge.exe	91
PID 2724 wrote to memory of 2500	2724	msedge.exe	91
PID 2724 wrote to memory of 4380	2724	msedge.exe	93
PID 2724 wrote to memory of 4380	2724	msedge.exe	93
PID 2724 wrote to memory of 5028	2724	msedge.exe	94
PID 2724 wrote to memory of 4380	2724	msedge.exe	93
PID 2724 wrote to memory of 5028	2724	msedge.exe	94
PID 2724 wrote to memory of 5028	2724	msedge.exe	94
PID 2724 wrote to memory of 4328	2724	msedge.exe	100
PID 2724 wrote to memory of 1732	2724	msedge.exe	101
PID 2724 wrote to memory of 4328	2724	msedge.exe	100
PID 2724 wrote to memory of 1732	2724	msedge.exe	101
PID 2724 wrote to memory of 4248	2724	msedge.exe	104
PID 2724 wrote to memory of 1892	2724	msedge.exe	107
PID 2724 wrote to memory of 1892	2724	msedge.exe	107
PID 2724 wrote to memory of 1892	2724	msedge.exe	107
PID 2724 wrote to memory of 4172	2724	msedge.exe	110
PID 2724 wrote to memory of 4172	2724	msedge.exe	110
PID 2724 wrote to memory of 4172	2724	msedge.exe	110
PID 2724 wrote to memory of 3944	2724	msedge.exe	117
PID 2724 wrote to memory of 3796	2724	msedge.exe	118
PID 2724 wrote to memory of 4892	2724	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bdr.granicus.com/t/6279/sc/aea054a3-84a1-4cf5-aec1-ca9531e233f8/NB2HI4DTHIXS653XO4XGMZLEMVZGC3DSMVTWS43UMVZC4Z3POYXWI33DOVWWK3TUOMXTEMBSGYXTANBPGIYC6MRQGI3C2MBXGY3DGL3FPB2GK3TTNFXW4LLPMYWWG33NOBWGSYLOMNSS2ZDBORSXGLLGN5ZC23TPNZSGS43DOJUW22LOMF2GS33OFVXW4LLUNBSS2YTBONUXGLLPMYWWI2LTMFRGS3DJOR4S2YLDMNSXG43JMJUWY2LUPEWW6ZRNO5SWE===/GBSWENRVGQYGGNJUGI4TSYTGMYYWIZLBGNTDIODDGZRDSZBWG5RTMN3CMIYWMNRS/www-federalregister-gov-documents-2026-04-20-2026-07663-extension-of-compli
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffaa95ac188,0x7ffaa95ac194,0x7ffaa95ac1a0
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,2825517412611240322,4898983877507229503,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,240553347322668286,6124933274246512982,262144 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,11734231104747101515,15069674479746669035,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17662834879062388645,12788497180241815715,2097152 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,1309712907948613225,9640738831547055092,2097152 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10203203230743421996,16905608203401594813,2097152 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4085908436249466882,16005495283560336933,2097152 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2143708345203277792,1183498895941861655,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8733102061510400502,6858155410800441648,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6422203893255829540,9836319416831782591,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6422203893255829540,9836319416831782591,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6188,i,835630013516637542,6759318819610678137,2097152 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,11262907480830850463,17645355592582062396,2097152 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1842481229476446476,7864051786959590920,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,17410938754000615130,3637700831228905872,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9969807222655900870,7947367737929423809,524288 --field-trial-handle=2324,i,3162219427645112661,159177289553307577,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 58bf59828900ca16decab5fc3928ced48d5dfb1404bd8350ef5eb321678c2769
MD5 ff071cd98494474fba4bfc2b312d4ce8
SHA1 36f8badc9aa17b72fcb9ec3984ccdfe0f6268ab0
SHA512 6adde0e0dc43d278eba058b77d4cb61e39cde6d1d7c5f204617c5a5f714c78e39a05da87ec2e97867f927203a3c2190b609aad3c69bf6aff498716e48b415e41
TLSH
T1BA71A334C78308A0D7A970B298FD0F24B87687D8FAF36D85D95829342F1B392C3282C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594329.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594329.TMP
Size 3KB
SHA256 afe1f30f885e49bbfb0be854ecfcc20bac1724a7624ae215911b6d0c36eafe76
MD5 9cef6c05209473b4c7cbdcd834b06cf4
SHA1 f0987b0a50555c193b9a6f1a469fbecf220b96b6
SHA512 c5022130042020e4ea94c9884a1869ece3e3d3ada99986424702bdedbd9ed31bc97b42e3dfd217af57abbed7afab8a1836ecce1e67d729a946f3076fa3d98bd0
TLSH
T1C1619238C78309A0D76174B290FD0F24787687D8F9F32D85D86829346F1B351C3682C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9b175179458bfb803efb3be9c6e1c57351fb3f643feb094f4c0f7074af7db9da
MD5 1f33730a4ba7eae12d2a53283c1e0722
SHA1 a38607cf1a5db1f58d03909bc31f5bc2b8442df1
SHA512 663e4e47d52704bad79812ee66b61eb92fcaeb2f17db4c80be8bdcb6c15c90dee336a9b185814ce5fbdc4cf1bd6304a982922bcfab64cacd753e95d21b462d50
SSDEEP 192:sxZbRHk+W/fnsW2SIyIdp8IDHW6+WN6XuN/Yzew4DIgrJ:sxZbS+W/fnsWfcxHbz/59
TLSH
T19522C7126E38A87B8CC7E21DBA15BF53E6F9507291D41E58B6FC951C08E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7fc85c721d477805075e64ba23356f6609001ccd25d77ec148e979fba89a0154
MD5 e9794129a7f6d20527fb660814a1d5e0
SHA1 8608855878f1680e4afc7933b919d9393b535706
SHA512 dbde198db45fe9457ea279b9d272d44cff9ceac2b93ead04a69dff747a341fc0673e4c8518be364788d9557adcd40358b6f9974c4c8925dd7639375676979be4
SSDEEP 192:sxZbRHk+W/fnsF2SIyIdp8IDHW6+WN6XuN/Yzew4DIg56J:sxZbS+W/fnsFfcxHbz/5w
TLSH
T1B022C7126E38A97B8CC7D21DBA15BF53E6F9507291D01E58A6FC961C09E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df5f48f5071ab5f8787896baf8f279142f14f04bf0d69e747053ec670045c50e
MD5 81e729d86c97c7584423fc93895d9b2c
SHA1 b2d39d0fd788a713d78150ad1c5ac55253903d13
SHA512 3aa72bd2204c11b8073e0a7e903efabb56f798e2a2ffd8f091de83a0ec0fba0acb5ce497a8f3880914004717d4ffe1a858d9d07a43a1a635f40501f037e5b622
SSDEEP 768:zzk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBsroyrYH:zzk7u70WvqiEau1jai5LA3B3HH
TLSH
T172C2E93B744CCB7E4F801E9DAC5A6F973E9802C7A6948D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 666880bbf1119bcb20a6d923b3317b81e6907ca4fb534a6011b7847e2dc4f02c
MD5 e19d684e832fd450d96b4ab724e7ffc2
SHA1 080562e0851a77e35300e3f8f426dc0088ff9a3b
SHA512 684ad17f237ae10c6a5f7f96e144aa96cc60585cc06881dd6e701bac765796e4c5e9c836003aed9ecf0df2be7924d319238fa7df40d5d4ecfb15093db3b95a04
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTTIIjK1Kc7y5CI/KT60vAIfKz:KIbCKcTIwK1K6aCgKT6oAAKz
TLSH
T104914506343A0A553CBE294DB69696365F4232733018B5AF3F7400A11D6BE215EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2334fc59acb518e59a0caef6393fed916c4c3c45aa9a1d07c959391e468de219
MD5 a97bb05a8a8264697a6767e11f093f96
SHA1 33bc43573fa8a9bdc2a62f60dc65df41e9d12a2e
SHA512 65ed3425090f1e8d0093ad772e3602479b4bc671b5366febdeca6c24693cf284a8a991aaf0bed23773e45380e60889510bb2b10fd772b8daf4cbf2515c80e2f3
SSDEEP 384:yZcIhsNswCox5bdzhMdtp5CEJr3TOOPrXLpe8C/lO:Ah/85uph3TOi9P3
TLSH
T1F1929E71AC746C676DA6B695E44636036EFC8077F2C42A58B2ECFB1C05DA6A81307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b97510d36c1ec5f50d1429584b190980dd23d3c074400d4e96a6b21325e2efe
MD5 a8b52c2e2819e59d88a518d5ebead814
SHA1 be96ed5eb1aa4b20b6e8efee086b3b5b69c3f11e
SHA512 b10e15e5397c7a3f731ab863e7635f46598885a36fb0621f1c60b37194fa0b1f3ed9ccfb75c2ca0d74b9a575afed37b82af3b35b7ad158635636f1dba5f89c91
SSDEEP 192:MONY64BAQmiUyP1YW5GBPKK7+FdG29poaD7UxU6:MONY6eAkqWLdtpRqU6
TLSH
T171021934AC796C7B9EB2AE45F58637176FE8107BE6801B44E6E86B1C01D764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90d7e5b32cc1fd9e50b05ba8bff8434d5feb0c9ec0d3c0d8e65c708dfbe89d80
MD5 e904bbd9e894260f4cecd661b0663d71
SHA1 6b7d08d6541360776648c25ee024a505abe95a2b
SHA512 684c4379b418d798d6419fb4a5010b5cd35cc4093a88eb5e0b5a3ca5bad49511e3a4533b236df740641fb6657edcc51c0aa573045f47c3919d43423aeaba7293
SSDEEP 192:rONt64B0QmiUyDYT5GBPKK7+FdG29p9hFC1SJrWWwEqFU6:rONt6eEdTLdtp5CEJr0TU6
TLSH
T18A121931AC75AC2B5DA2B585F48736035EE8412BEAC46F54F2EC7B1C01EB6AC2306856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f28c0f7f438ba9c8aff1aace41acef4de4a050e41a583371aabc27ecfe22d7c0
MD5 0da1a385199dcd2ef1e8d6a617ceaebd
SHA1 489051ac456fa36846d31d294489b9274642368b
SHA512 e616cc25f63da80e45be27b085f37c8fcee7c9151622568136cd7e997d205ed951f3983acad5142895620de2947c7c2a06fd571eaa76d31b9875514c65ec56ad
TLSH
T170411A68B6FA114DB3B7AE16ABF6A46D487E78372F47945E00010D4F0A62B40C862B77
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads