hxxps://eoas4uhbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001KLQzfnh3j8c3nm11biYcPHNad1AFezbsben9sYpJzDyW5yy92PNfBGD7j_OzgL7KcUqJi2R5_jrlDrvKG_Jb8f3GzEZML1OaGI5L3OgjboGLVlpcJyWj49ruqKIGA0SHkh6LFLRJlI2umrFd1rgHMX2t3yFcU0Qu6aOsRbv3TVw=&c=KNG-50Ff-MFuZKMTz9cbQaFombSXQhMRI7RCNPVpGKlwNJ9nEQRM5A==&ch=s7sfmbWxXaQGrmU162w8ONrkVN1YfSMmUFPx7kO3LsSGlCCSQ--S8g==

Analysis

user interaction
yes
max time kernel
58s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eoas4uhbb.cc.rs6.net/tn.jsp?f=001KLQzfnh3j8c3nm11biYcPHNad1AFezbsben9sYpJzDyW5yy92PNfBGD7j_OzgL7KcUqJi2R5_jrlDrvKG_Jb8f3GzEZML1OaGI5L3OgjboGLVlpcJyWj49ruqKIGA0SHkh6LFLRJlI2umrFd1rgHMX2t3yFcU0Qu6aOsRbv3TVw=&c=KNG-50Ff-MFuZKMTz9cbQaFombSXQhMRI7RCNPVpGKlwNJ9nEQRM5A==&ch=s7sfmbWxXaQGrmU162w8ONrkVN1YfSMmUFPx7kO3LsSGlCCSQ--S8g==
Sample260812-rcb1bsdb35

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310169654300424"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{98A1DE15-3F71-47F4-A9B0-C32F1D584F4F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3332	5000	msedge.exe	84
PID 5000 wrote to memory of 4988	5000	msedge.exe	85
PID 5000 wrote to memory of 3248	5000	msedge.exe	86
PID 5000 wrote to memory of 3248	5000	msedge.exe	86
PID 5000 wrote to memory of 3248	5000	msedge.exe	86
PID 5000 wrote to memory of 3288	5000	msedge.exe	87
PID 5000 wrote to memory of 3288	5000	msedge.exe	87
PID 5000 wrote to memory of 4308	5000	msedge.exe	88
PID 5000 wrote to memory of 2072	5000	msedge.exe	89
PID 5000 wrote to memory of 4308	5000	msedge.exe	88
PID 5000 wrote to memory of 4308	5000	msedge.exe	88
PID 5000 wrote to memory of 2072	5000	msedge.exe	89
PID 5000 wrote to memory of 2072	5000	msedge.exe	89
PID 5000 wrote to memory of 3912	5000	msedge.exe	91
PID 5000 wrote to memory of 3912	5000	msedge.exe	91
PID 5000 wrote to memory of 3912	5000	msedge.exe	91
PID 5000 wrote to memory of 2568	5000	msedge.exe	92
PID 5000 wrote to memory of 2568	5000	msedge.exe	92
PID 5000 wrote to memory of 2568	5000	msedge.exe	92
PID 5000 wrote to memory of 3744	5000	msedge.exe	98
PID 5000 wrote to memory of 3744	5000	msedge.exe	98
PID 5000 wrote to memory of 4824	5000	msedge.exe	99
PID 5000 wrote to memory of 4824	5000	msedge.exe	99
PID 5000 wrote to memory of 3376	5000	msedge.exe	101
PID 5000 wrote to memory of 3064	5000	msedge.exe	112
PID 5000 wrote to memory of 3064	5000	msedge.exe	112
PID 5000 wrote to memory of 3064	5000	msedge.exe	112
PID 5000 wrote to memory of 4596	5000	msedge.exe	116
PID 5000 wrote to memory of 4044	5000	msedge.exe	117
PID 5000 wrote to memory of 3928	5000	msedge.exe	118
PID 5000 wrote to memory of 2360	5000	msedge.exe	124
PID 5000 wrote to memory of 2360	5000	msedge.exe	124
PID 5000 wrote to memory of 2360	5000	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eoas4uhbb.cc.rs6.net/tn.jsp?f=001KLQzfnh3j8c3nm11biYcPHNad1AFezbsben9sYpJzDyW5yy92PNfBGD7j_OzgL7KcUqJi2R5_jrlDrvKG_Jb8f3GzEZML1OaGI5L3OgjboGLVlpcJyWj49ruqKIGA0SHkh6LFLRJlI2umrFd1rgHMX2t3yFcU0Qu6aOsRbv3TVw=&c=KNG-50Ff-MFuZKMTz9cbQaFombSXQhMRI7RCNPVpGKlwNJ9nEQRM5A==&ch=s7sfmbWxXaQGrmU162w8ONrkVN1YfSMmUFPx7kO3LsSGlCCSQ--S8g==
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe0009c188,0x7ffe0009c194,0x7ffe0009c1a0
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,12573128093582718071,6360674727274925776,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13848467094063231406,12244580675645709381,262144 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,31232802772009578,869321282449208324,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,10195669396984674048,6494117105975695053,2097152 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,2018810403675501460,18385473731463305543,2097152 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,5948432746378299838,1876096369564116781,2097152 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,4237759364402239417,9191054647398665975,2097152 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,18208063891450819320,4254826126378506331,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6117171734711487276,7078178196274399819,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11772184493820341710,17950835329700001288,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11772184493820341710,17950835329700001288,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3392,i,3680694276395493033,14655927147395130913,2097152 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,5901198245946981083,882154594815804226,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,1317123826999450359,7729997034457372515,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,8881453115442671003,778952811953428749,524288 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5924,i,14663651685720759298,10529597057498253177,2097152 --field-trial-handle=2412,i,11790787621595087810,1357841426324821409,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dfd94c748e674ea9fd9501a156f36fe98a91bc30e4fbb7a050b3e07b6da87251
MD5 48d2a74b9f9b337cd4d5ba5e79dfdd84
SHA1 6ba022dce5af70c1a5595b902b4e5bce7ba7ee3e
SHA512 26bb29893c5ff0f3c85dcbf16f331db1f6ab01b4ae8d6d9c68be344cab219d9861e101be415b454fea0375470c85b7e982f35351ad4c64e248be7c2bad9702e1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4b40b768780f791d21412fbe10fc2d8daad603f4a7cc7c2c742477f249246d1a
MD5 dc7d50926c0de75720c4b0bec2fa8ba2
SHA1 3468e5d0aeaa9854e63d0a66529ddde8d9262e72
SHA512 132517baf6b04b33053d6ee89c9245bcfd7e49eccdf1e8fa4592ed1fdfd8466645f0b272ae890293107f9e53eaafc8d5e4eb59109172863c39ad468fd0d53b85
TLSH
T1FB718FBB07E1A8BCE7D08872A0D21540703EC1F9F807EE9AF7D485791E0132982F8574
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c57163924acd9c55f11cade0c9c1eae82020e02174bbac96a012eec8083cbc2
MD5 15d83988929c57514d8af9ade4e2c3df
SHA1 c879c915e9ba0d0d22a2a6303eaf2e3e59c63494
SHA512 7169d593921b7bc62669547d43d7ec6b5f5bead8cd684e4ef2551123a9225c55b06c923e7bc105f5aee2ef6b43860048c9a81727bb9e132e21ba8eb2a3a45552
TLSH
T194714CBB07F1A8B8E3D04872A0D25541743DC2F9F817EE9AF7D085791E1132582F81B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b224.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b224.TMP
Size 3KB
SHA256 fd0c37e40e9279c94c80805bfff4faf5159f0215ddbd12a61d9f61f782bc4da5
MD5 dd98c4cfb876cf242a76acfccc3f361d
SHA1 97ef1cc602ae67d35adc58a053ef805fa3f45e39
SHA512 2c6761d9be2f61f244f5149104d3d3e38c02b82842fd9631152de39c8d9bcd79aa0abfbaf489d4c4acfb928153e40728cfc5634025bcd85beea2754ea7204d2e
TLSH
T15D714CBB07F1A8B8E3D04872A0D25645743DC2F9F807EE9AF6D085791E1132582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 87fb8a8fe30b58d1ffe25f6ba1919280caa8a87b8097245e380219563a9a954d
MD5 dc04c3310761a75b14e9c8634e35493b
SHA1 4eb8f65a12b4f9df910a6f8bf4bacdab125a75f1
SHA512 859d0f42cb321c2ed102be7c0b71119b68f75038de241adefee732b7e2f25d98f360d3c5cae7ce1b7c20378418ba3b4e91ce751a53971e736fdbc519dbe987a0
SSDEEP 192:sxZORvyM/jK1Ml8MkU/fusPBVVqIdpJHW6+WNGYvxTM0hzIgrJ:sxZO7MU/fusPBzJHbGOXx9
TLSH
T16042E7156A346977CCCBD20DFA51BF93D6F91472A2900E44ADFCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f646ea2a3c9d1f31246ddf399d5c88ed8f5035bd3d1735414262732593c30ac9
MD5 cbaac41e51985dec8d8af9672b0fff74
SHA1 99204baa1d28264583a5697cf42053abf70ebdfb
SHA512 8b32d6268ac92ac8598aba388ffee14a973a9b2581fae7244ffdad8303f428efa11e1401142cb0ebbf9dfed307b401df7a2a94f31eed1e98eea1793187661fb3
SSDEEP 384:sxZlDVMU/fusSbw6Wcm/iHbhZY/YiynxB:sZyU/fsbbHbeOr
TLSH
T11452C755AA346977CCDBE609BA41BF93D7F5053292900E44AEFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f18a9d8c0b39c20f44d6e03ecf6ee26dd98f588884b210bd7d339210c9414c3c
MD5 83fd3aa36ccc405ef2f4d9c20f8d5f0b
SHA1 648e20fe0275030ad9b2363e5b9840be66aac251
SHA512 4c407459e330641422ca39f43f26353619acba8c64acd94b0278798fcb337bbc0ac8a995c49de3d79da8ca813da8f586dbdab5959e9d4c3e2d7d936bbf48dcd2
SSDEEP 768:XjseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppsrovQE:XjseJ3xWvhfynu1jaVcL88p33
TLSH
T1ECD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3eadf3a07bf11570df71174bb2d8ba3db5fd02cdee68c33b1b5b68d18b092ee5
MD5 9b00565bc5a2cc53cb0fbedeb9fcbe1d
SHA1 18009498096e1506f679a3bebe9e45a1aa7da58f
SHA512 f1344e135bdaf57d12cc5c41dd3bcfe256810641dff72d11a5711d93ba94a2fff78b2951f270394ea6f3f47050ee35719645254c3a59d8e09d967ececb5cf7a4
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Eh:KYHIhKggkXyi0InKxmUTyNrIlKkswq
TLSH
T1D3A1A10A343A0A123CBD3988B69596361F4631AB3528646F7FBC00530D6FD526EFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b09ad0588b6e296138f226e1268c2c923406587972bd7ef45006087e36b65977
MD5 337bae097d6b08f998360b58373b2c3b
SHA1 8b0576ef9a4465d43abfad69b0fffe04ecc0ac27
SHA512 8146f259c90e4ff4933105841e446f9b9723cb1843804fe8b29830455bca1ea2387d09e972c7719d2543f8f8ee1945140b1e707bd0095013d2a91d797f583398
SSDEEP 384:oZcIhsNI4W8I4eYB7YSiNvIQdExMdUEF89J7w:Wh/YBcvLU9b7w
TLSH
T1E1626D715C745837A9B7F547F88A3A034FF8907796C46B94F6EE6B1C00D96A8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a4ce00996ff71479a794701ceae64c85cb592d146cc96d80cadf753d6f6a394f
MD5 9eadf7f99c5422d754c0298a0635f393
SHA1 bbf5bc9731eccd34b1fba5687b91041176e47035
SHA512 006b2bc76ef1bf0ca992cbd30e811c54120b740427245a3fed74cb667a44623efff5fbf2e1271427fe2a521523e2e7c9ee3e76e8daab79dd1f94730bf3116184
SSDEEP 384:mZcIhsNIHW8I4eYB7YSiNvIQdExMdUEF89J7w:0hsYBcvLU9b7w
TLSH
T1BC626D715C745837A9B7F547F88A3A034FF8907796C46B94F6EE6B1C00D9AA8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ebbb857847d820238157ae360055e5ede1921cc12ab70d1cf11179322b84f5e
MD5 987bc7343849336531f7256a713b596c
SHA1 b52be8fae2c5d3d3e65641e85fa3d1bb9235a669
SHA512 8778ef1067b79b4b4381302ab667c98f29781f7a98cb873f37f57709ff541b1cb06299bfb118f725670e36ba85fcbb79ff6a08d5d57b974615e8feee56baadf1
SSDEEP 192:lONw6vMtPQmiUyXEThTQv+FdLYx5847d7U/u:lONw6UtRvT3dExBpU/u
TLSH
T1D9020835AC786C7BAAB3BD46F48A37171FF4516BA5D06B54EAE82F1C00D768C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 54dea51fcc1645018d21ea539a7aa47f6bd0e35a3db096de6fff490c0a542347
MD5 948aa2e96b472d27cf7217edfdcae4ae
SHA1 813e0975c68bd005117dfb5e97cf9c5aa8536aaa
SHA512 56d24eb36e50ba66eb00c07885fd44c2618cd04e6cfe6529aa6e206663fba5ea34d5a8c147be12658f0880e4e47b978665fb98c3d48b4f882b0f5d9792e59d45
SSDEEP 192:oONZ6vMxPQmiUynKFE4hTQv+FdLYxTkFd3EEW980I9DqiU/u:oONZ6UxRsB43dExMdUEN9JU/u
TLSH
T1FF121A71A874AC276D93B946F48A36135FF0816BDAC56B50FAED3F1C01DA6AC130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

287de68e-59b0-480f-9e1f-e2e02ddc47db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\287de68e-59b0-480f-9e1f-e2e02ddc47db.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 231799069c2484c34f9a5fab7f1ecea2bbfa0448bf2d4b31b6412d35b5889730
MD5 c17efaf16a998280b746e552e3ab3dc8
SHA1 c2dca825e879313ddcf815d76d508b1e746a2cee
SHA512 c2fb1ac7060aa33e2721c51696e6bc1093f067c272aa3eb0a5bd9641d8d57e99669ebd1e575a7cff4f96e94785c0513cfbfa0c339045f5f1d5422b481ad41f48
TLSH
T11F41F658A6E91158B3B77F0A9BF6686D487BBC772F06945D10010E8E4A62B40D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads