fe321637ca47853fa005ee372bb8e0f37715ce7e9f11f24bbe23085a69593919

Analysis

user interaction
yes
max time kernel
76s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c.html
Size 52KB
Sample260812-1tyebseq6w
SHA256 fe321637ca47853fa005ee372bb8e0f37715ce7e9f11f24bbe23085a69593919
MD5 fa66ade4c188cf79cc5842b4ee92451e
SHA1 b7d1302c22a1558ece555c42d43cbfca79e18b2a
SHA512 3a1822fe3caec3198b444211279111c62b2554972e80325594c7de015f47819e0a505d6b7bb98d22f4595b968a626ac3c4795025d54ac686ef57b6a7d4146f2e
SSDEEP 1536:1Jbdi3OTyTVG0A0OH626RviLKmJbdi3OTyTVG0A0OH626hgYmx/k:vdKOTyTVv5OaNRcdKOTyTVv5OaNuYQk
TLSH
T1FF33E16A1A036C303573619FB9524756B67BC205C41362096BEDB282D0EEF85846FFFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{52C94BE0-CCB2-46C0-BEDD-C65B75C2159F}	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3788	2600	msedge.exe	87
PID 2600 wrote to memory of 2492	2600	msedge.exe	89
PID 2600 wrote to memory of 4284	2600	msedge.exe	90
PID 2600 wrote to memory of 2492	2600	msedge.exe	89
PID 2600 wrote to memory of 2492	2600	msedge.exe	89
PID 2600 wrote to memory of 3312	2600	msedge.exe	91
PID 2600 wrote to memory of 3312	2600	msedge.exe	91
PID 2600 wrote to memory of 4472	2600	msedge.exe	92
PID 2600 wrote to memory of 4472	2600	msedge.exe	92
PID 2600 wrote to memory of 4472	2600	msedge.exe	92
PID 2600 wrote to memory of 3540	2600	msedge.exe	93
PID 2600 wrote to memory of 3540	2600	msedge.exe	93
PID 2600 wrote to memory of 3540	2600	msedge.exe	93
PID 2600 wrote to memory of 4872	2600	msedge.exe	94
PID 2600 wrote to memory of 4872	2600	msedge.exe	94
PID 2600 wrote to memory of 4136	2600	msedge.exe	95
PID 2600 wrote to memory of 4872	2600	msedge.exe	94
PID 2600 wrote to memory of 4136	2600	msedge.exe	95
PID 2600 wrote to memory of 4136	2600	msedge.exe	95
PID 2600 wrote to memory of 3516	2600	msedge.exe	98
PID 2600 wrote to memory of 3516	2600	msedge.exe	98
PID 2600 wrote to memory of 3516	2600	msedge.exe	98
PID 2600 wrote to memory of 4504	2600	msedge.exe	100
PID 2600 wrote to memory of 4504	2600	msedge.exe	100
PID 2600 wrote to memory of 4504	2600	msedge.exe	100
PID 2600 wrote to memory of 1112	2600	msedge.exe	101
PID 2600 wrote to memory of 1112	2600	msedge.exe	101
PID 2600 wrote to memory of 1336	2600	msedge.exe	102
PID 2600 wrote to memory of 1336	2600	msedge.exe	102
PID 2600 wrote to memory of 4488	2600	msedge.exe	104
PID 2600 wrote to memory of 1600	2600	msedge.exe	105
PID 2600 wrote to memory of 3848	2600	msedge.exe	106
PID 2600 wrote to memory of 3804	2600	msedge.exe	107
PID 2600 wrote to memory of 1796	2600	msedge.exe	110
PID 2600 wrote to memory of 1796	2600	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\c.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff9a697c188,0x7ff9a697c194,0x7ff9a697c1a0
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,16062185333859880869,12941007475611967242,262144 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,10551460920642637432,5549517822672195724,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,10430752869759623133,14863189114956814258,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,11117017911364821153,14481060534253694290,2097152 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,16047823045628879796,9666904609619629467,2097152 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,1553250693168095778,4628394011941840323,2097152 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,13907434888224393821,9086405278287178601,2097152 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,10597076960894938055,13800250106181805541,2097152 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5240,i,5183458992721473420,11830155972053821159,2097152 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,8062916975514815858,17237832620444569852,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,2144607742353462515,3085106411217825300,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,15435783088620281383,15786066605822817248,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,15435783088620281383,15786066605822817248,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,10650649719704586284,4045954196006376992,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,6658657055063624439,14622243506601536766,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,12458841122658093061,532850629975842150,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16018933510064699357,7775069796348966191,524288 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5716,i,4021504900013681803,14640150431449759427,262144 --field-trial-handle=2280,i,11043034365707090295,16075647149042726994,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 991008b9b0595d73a834485ea29586af44591a386941c327848eaa62bdda1d31
MD5 361e52e3af42b9ecd11b87e3113f10ec
SHA1 317337f4abf4ee15758d7ffaf16d705572917ecd
SHA512 176061638831bb89d64d18adaba36e7e65a39b64768b1d30891a8116bd979cdb3c938e30394f379c786c984d6a7590d1d7d0b299de23e12b878648fc110b41a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1ACB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c45f1fa6b3ffecbb181751b768e04a6a10462facd77a717eb1c3eec0aee7893e
MD5 b986a1fd424700d7ab184ae646ec04ac
SHA1 22eb9c8ce1330e8b88b412af49fe8c34339b2941
SHA512 8ff1a9f438c72559aeaf948317df78181ff98c09a5c36cefeb3b75a6671374210923327c46b0eb5f0db854e54f7932a86f137279762b1a58a88b7e08f9b503b1
TLSH
T119716F740D368FA6FBD041BF51F3E255747582D8F4131E36E19056382A2EF28A1ABD8E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584c08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584c08.TMP
Size 3KB
SHA256 e6488a0eb1590b21b7be613e6269ab07e28cc10199237506270be44c3a0a1d8f
MD5 122fe12cf30f7b40a85303cc05b22bf8
SHA1 35a6f21c0012fc20b015637e04f93e7c7bd509cd
SHA512 fffb2a2fe9a0b85df5901e8b0e75c774e6bfc40bc9b1268609a0dc8a9e45b977fd13f2d6800d5c8c9897f5549665385813f161d98b72d3e827de8b08c8e86c30
TLSH
T13B715E740D368FA2FBD001BF51F3E255747582D8F4131E36E59056382A2EF28A1ABD4E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e991a0e629fe413e3156d635909f739d019db35cdf81c41b79c1a986e3fc73fd
MD5 39d333f89c6b121f9e7f5e5905248b20
SHA1 7c431c5b3b44a906cead7ffbf9932e4470092412
SHA512 71f39c31a3ef8f850f9e740c8ed0547094b65d741605ada3583c58610deeb24667fe06387717a7c45c5c044050c961e45c5c5cbd3aeb0eeb05323662d677d08e
TLSH
T185416DB6C3D8877E881112F05B256E2ACD2D055A42283C668EE9EF5F67F24B4E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0be9512db77686e01cbe95292cda6bc0541d5fd6db5c5a296a9eddf5b03c7d59
MD5 bf3673cc965ecb76a2368df5a60a8c8e
SHA1 c5a0050599e8c2f65eb16d9357d696699a2e3797
SHA512 93e2c7d65d6578c678f8f9e8a0ec8ee3cbf92464a25a000ab1b1f1344d2a545b9eedbb3f34f397bd77aaf01c760c895ba53320eaeae74673f2b8b8832f14d3a1
SSDEEP 192:sxZURfyM/jK1Ml8Mkz/fBxs62/Edpd8HW6+WNGYCTrqrIgrJ:sxZUpMz/fBxs62M2HbGzi9
TLSH
T17C42D8117A346977CCDBD209FA517F53D6F91573A2940E48AAFC8A1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 60da7da20440545b8b8516ffee5d3bec8728b83e54dedf67ef76c7aab5a969a4
MD5 229366db68299459ed1c63cf651474e5
SHA1 88d35f8584935c8ceccdd6f4db93ce44805bafdf
SHA512 a9ed6fa2357526a9fb7de16de3357341730af097d840a0d2936dd8cde5850cee8eb102821d88999e9aad310b645ba7df38dacdedd87e8c887f2afe355b6c2663
SSDEEP 192:sxZURfyM/jK1Ml8UQMkz/fBxsruV/EdpH8HW6+WNGYCTUrqrIg5YJ:sxZUpqXz/fBxsruVMcHbG+im
TLSH
T1BD52D8157A345977CCDBE209F9417F53D6F45873A6940E44AAFCCA1C01EAAEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4f791142d71fe960834d3bbf8f488450736ffddccb4f86ff0d6a23fd94857e61
MD5 d5425c39bd93a3c722df0adefaba0fcc
SHA1 b1f6b26b4c3bc8b5ae2b24c26617dd64bfd639c7
SHA512 2b085a39c64006ae7373b54d756ce6739efc5f6a4e6e5a0ebdc5c9f5ba151e39af3ffc45d24221fad5484d4a340ba869e49a0fd334b002b0b4074ea1978ebdca
SSDEEP 768:uX8bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVtroF:uX8bqn+WvSC36u1jaCZLbWVGF
TLSH
T169E20B3B280CCB7E4F845E5DDD26AF962ED801CB5B988D4447FA884C03C72EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 a6aa86c8464baeacffe664fd948f137b8be8544208ed636b0b4196a08a9ed2d7
MD5 00f11afc5c9ea1438e9005f848e22c31
SHA1 e2cf5ab00f2f53dde65bb24d5f54c3e6c35f4857
SHA512 e4cf48beb678d590c53fce094517ac0308ba15c2ea6ddc4a6046d6613c36c0604a89ba662d3a0340a96a7ee6f09a20501c01e77d0c12d292e48e85d02368fe8d
TLSH
T1C5815F01767B16013CBE751CA256CA7B4F4231A73529A46F3BB918A20ABAE110DFDCCD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0bca15997647fe1d9a99660cf7fde21a7ba9e2f4fc67ca4179c1d42bda20b8a0
MD5 f9f8e702abbc901b06861758866dd4b9
SHA1 c94f0f681eec709292100ddea2a462b592deed80
SHA512 2fd7b91c1c9604975003adc6e758ff40545a6adcf43ac7d538b41ae61f58bf3dbae7d2ddf4ab8bdcadaa6df58d4049cee80c6e507274284c512183b7c447bd5f
SSDEEP 96:KQ5aKSMayawK7aMbUXrlZtMVp2X/DMKnZ/tM77r2VbRGEJiGUWqfViX2/efKnO/q:YFXk31C
TLSH
T10EB16F15767F16123CBE751CA195CA7B4F4230A73569A42B3BB918A20BAAE110DFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 308b3ac16ad05c232a42544775bb9cc6aabff7a93553ebf600e02762a0741aac
MD5 8554ada91972442289f0e2dadfaca57b
SHA1 cbfc54979164e8d149a2f9412b5fd4dca37b259b
SHA512 d4d3ef4cc52bde5473870ab745c2711cdb424954ff6bf623393a722496faa9c8704e37ecb5a8f29fbe7c8cb99a9119ff8910262eb83296d819970cbe9d36aea3
TLSH
T105216180D2ED14E56FCAF949D10E5503A5E13A5B261E5871236E64F45F88C250E2EE3D
MD5 SHA1 SHA512 TLSH

Submit Download

530e2b45-9c5e-4419-9a49-2749b33836ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\530e2b45-9c5e-4419-9a49-2749b33836ed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 657773650d7f0abafc794977977d928293594280ee17ac3fea2eda1572c019f8
MD5 9a17b85b83054f311a55815ead1bbddd
SHA1 64b3fbbe107615ce74492a673e09de53634d3ef1
SHA512 06c52278de908b9244dc80b4b131002d9f761ad9383447d1775357af29430fad74f96b55e2eeb2c3ce01e8cda876b765b61b8f764de339cbb8fb252e25e543e0
SSDEEP 384:SiF9sNi8TUNTUlIlA+HLnNxEa++OrIEaDgMsRnlYurn:ZF93wg16a/OcEeghn2urn
TLSH
T122824B33A96889776DB66A82F98A35138FF440A7C98ABE94EBDC5F0C01DF1DC1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f673c19aa5da17d4626b301d129171967dea40ad151ba0d37cca7675bef2bc63
MD5 1eff701e7365485d30c2d3b6b4c3ac52
SHA1 d3f4887ce2e2ef8f74891d0769c15b08cb29fc91
SHA512 647610aaa3a4bdb47886d6678d38cb2397f0a37860535a0aa7fbc4a602e3c17bb542a2dee78eeb09b4147d9ff76df7bfe9973d1d21a2bcae956930fd71078f63
SSDEEP 192:9sNaUQ/SQAoBcbiDlQmiU10wuZEa+jiOm4HoEGMNmOq0k3RKr:9sNaU+HLnlEEa++OrIE+gk3S
TLSH
T134423A3579785C335DE6A585F48A36138FB84067DA8A6F84D9DD1F0C01EF69C234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4e8728e941aba286f42efb6b5dd3bb7ba2d254718a42d1da14cbe820c8dc373e
MD5 d8e6c7961c3e857329169569892f3d06
SHA1 d648344553a76e18bf94aa79c418452e71713626
SHA512 8c237d9fab88ab0740a0dbaabd9bc6c63ba86facb48121ad07f4a30359f448b239b9e858cf59258b05947ad0643c8e511decec5bad148ff53e0e881ae972c365
SSDEEP 192:HLsNaUQ/SQAoBcbiDlQmiU1Iwu4Ea+jiOm4HoEGXRamOq0k3RKr:rsNaU+HLnNxEa++OrIEabgk3S
TLSH
T18D423A3678789C335DA7A585F48A36138FB84067DA8A2F84D9DD5F0C01DF69C234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1f4006b8c124f0ca3f80ca84da1c8f4dcc5a588c2358a0bc3ffb5c32c42d131a
MD5 defb96488fb4ad1280a33817a2113bf3
SHA1 b5b5f8da898a5644a53e0bcd74036ee7debb6fc0
SHA512 45850f7441960aec088f785242dc760722b5580d0d99491fd2acd73e24f1dbff2c2a7630bab70b1c8de6eaac25db96ca10f442e994ff875be3132a841d8f9b72
SSDEEP 192:uQLsNaHQ/SQAoBcbiDlQmiU1Iwu4Ea+jiOm4HoEGXRamOq0k3RKr:jsNaH+HLnNxEa++OrIEabgk3S
TLSH
T10442293578785D335DA6A585F48A36138FB84067DA8A2F84DADD5F0C01DF69C234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a28620a1eb3a426046d173f93d5d50e34a39406243c97844c457f1142ff70b7
MD5 ed861b9051d3ec0fdc2a1c55c4ea0a46
SHA1 24a931e50dca4dd08c4198fd3cb8e21a73bc72bd
SHA512 0e1f27d9eb8228ea38b5964fc2a086e1c39ef8cc1df95f17990250a0e94466de08ed8b8590d21e0c03d42dd9d134901115b7971a3ce5579c6d3993e74b0f0e69
SSDEEP 192:vONy6Db6QmiUytFHBa+jiOm4HoxRg3iU6:vONy6uGHBa++OrI4SU6
TLSH
T1AC02093569785CB79EF26E49F88B3B279FD4102BD9962B84DAE81F0C00D764C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eda4a3a723c9d93cd1332c59c23e998fff78c8faf657045abe587f33906f1e6e
MD5 950d2c712ac0fd7907a88ce6a8c46dd4
SHA1 f39f676eaf158c6ffce5ad3f20097130226a5542
SHA512 6504d69570a21f7882073ca1709020dcc284fdca55af51adbee2620d987532e734cfd85e014a1c85b78d73ce943a83300529c938e989dbb21c74e7964512e940
SSDEEP 192:hOND6Db1QmiUy1FDBa+jiOm4HoEGZNzOq0U6:hOND6LwDBa++OrIECgU6
TLSH
T10412093579789C735DE26585F8C735138FE44127DA8A6B90D9DC1F0C01EFA9C134AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 7fdee7939a900246f75e67f1fcb8fbf354a167635df98dd7428d6e6b5b2d5a57
MD5 a597156c274b23eda2d0a090caa341ac
SHA1 aa8c6551eae5cd23d7f1d4aaa4c07a05a8686548
SHA512 f5bbee150e44b495fce8bf827c2e1c054e99a70a916f19c33462cb4e573dfc6939bafafb16179d3d5c9dffbaf69e1df5ff6efebfc0006201ca1cae96ab66393a
SSDEEP 384:SiFiZcIFsNi8TUNTUlIlA+HLnNxEa++OrIEegMsRnlYurw:ZFQF3wg16a/OcEeghn2urw
TLSH
T1DFA27D339D6489766DFAAA82F88A35138FF440B7D98AAA94E6DC9F0C01DB5DC0306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b63d23be-ef78-40dd-9bcf-e21a2b63f5be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b63d23be-ef78-40dd-9bcf-e21a2b63f5be.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a44339734edacbd6a3574071b4664a70be6aa85ec144b8063d4eb847cc138f58
MD5 0dbf8567d29bf10fd8aa5e1342a615cb
SHA1 e1dc0fe1142db16a95ffe68849437938fd7ac72c
SHA512 698f7951d53402ea23c68fad10556cb9fa930c44cc097e6eca6175c49c0527486b98822a5aeae2f7ebb471bcaa838380d429aeb791ce0cb65c89b3a18c7b31cf
TLSH
T1F2415D58B7E91148B3B72E46AFF6B86E487FBD672E06845D10110E4F0A23B40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads