hxxps://protect[.]docusign[.]net/report-abuse?e=AUtomjpFak9GlbPL0zFFi13vKogAFO13HuSGYnn5L-2p_BX168OuKw59I81EqaISbqe9AlLmu2AWfcRaEId219GjXV8JFkU4rXJrtZYijyt-So0QQnguwCtg6UJSFojmafsqSbP9wwFX66ExabQlytAXzPVmxvYQWJ5o494lEz2vjObzu9swxsFetx2VdBGuTAPoWHvANDocCZbiSpQ1Ysg_gP1MwojfOIbvtZdLwOCkNRzgHkF1Gu2qYoIZHi8QvRE2vWrEgtuyVI62GaHlJdFphQ7sX18OmyTat0vrq95LKYyq-y2lGeJaPuvEoMFo6BwBq4zCH2pGPgPVhr-Zt7xxBoTlSTYzTKkuD99xd_qOIBj8jUb5vXP8vnMymiqBe4dY2Aqf6PSen2TCYDVx4zso9XKOLdFE1fxW0dnWEyvlATSDJERdxsXoMh12ZuGcmtwnPjqUn6ZT88AXdRUDq4TngeRNKxcrzJ98lNHBeAsd&lang=hu

Analysis

user interaction
yes
max time kernel
30s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi13vKogAFO13HuSGYnn5L-2p_BX168OuKw59I81EqaISbqe9AlLmu2AWfcRaEId219GjXV8JFkU4rXJrtZYijyt-So0QQnguwCtg6UJSFojmafsqSbP9wwFX66ExabQlytAXzPVmxvYQWJ5o494lEz2vjObzu9swxsFetx2VdBGuTAPoWHvANDocCZbiSpQ1Ysg_gP1MwojfOIbvtZdLwOCkNRzgHkF1Gu2qYoIZHi8QvRE2vWrEgtuyVI62GaHlJdFphQ7sX18OmyTat0vrq95LKYyq-y2lGeJaPuvEoMFo6BwBq4zCH2pGPgPVhr-Zt7xxBoTlSTYzTKkuD99xd_qOIBj8jUb5vXP8vnMymiqBe4dY2Aqf6PSen2TCYDVx4zso9XKOLdFE1fxW0dnWEyvlATSDJERdxsXoMh12ZuGcmtwnPjqUn6ZT88AXdRUDq4TngeRNKxcrzJ98lNHBeAsd&lang=hu
Sample260814-jp628sysgy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311675115210535"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{68EDAC3A-041C-449F-A289-17E14F15F4BB}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 1944	3900	msedge.exe	84
PID 3900 wrote to memory of 5096	3900	msedge.exe	85
PID 3900 wrote to memory of 2872	3900	msedge.exe	87
PID 3900 wrote to memory of 5096	3900	msedge.exe	85
PID 3900 wrote to memory of 5096	3900	msedge.exe	85
PID 3900 wrote to memory of 1520	3900	msedge.exe	88
PID 3900 wrote to memory of 1520	3900	msedge.exe	88
PID 3900 wrote to memory of 2068	3900	msedge.exe	89
PID 3900 wrote to memory of 2212	3900	msedge.exe	90
PID 3900 wrote to memory of 2068	3900	msedge.exe	89
PID 3900 wrote to memory of 2068	3900	msedge.exe	89
PID 3900 wrote to memory of 2212	3900	msedge.exe	90
PID 3900 wrote to memory of 2212	3900	msedge.exe	90
PID 3900 wrote to memory of 1404	3900	msedge.exe	91
PID 3900 wrote to memory of 1404	3900	msedge.exe	91
PID 3900 wrote to memory of 1404	3900	msedge.exe	91
PID 3900 wrote to memory of 4760	3900	msedge.exe	92
PID 3900 wrote to memory of 4760	3900	msedge.exe	92
PID 3900 wrote to memory of 4760	3900	msedge.exe	92
PID 3900 wrote to memory of 1056	3900	msedge.exe	96
PID 3900 wrote to memory of 1056	3900	msedge.exe	96
PID 3900 wrote to memory of 1056	3900	msedge.exe	96
PID 3900 wrote to memory of 4636	3900	msedge.exe	97
PID 3900 wrote to memory of 4636	3900	msedge.exe	97
PID 3900 wrote to memory of 2204	3900	msedge.exe	98
PID 3900 wrote to memory of 2204	3900	msedge.exe	98
PID 3900 wrote to memory of 4508	3900	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi13vKogAFO13HuSGYnn5L-2p_BX168OuKw59I81EqaISbqe9AlLmu2AWfcRaEId219GjXV8JFkU4rXJrtZYijyt-So0QQnguwCtg6UJSFojmafsqSbP9wwFX66ExabQlytAXzPVmxvYQWJ5o494lEz2vjObzu9swxsFetx2VdBGuTAPoWHvANDocCZbiSpQ1Ysg_gP1MwojfOIbvtZdLwOCkNRzgHkF1Gu2qYoIZHi8QvRE2vWrEgtuyVI62GaHlJdFphQ7sX18OmyTat0vrq95LKYyq-y2lGeJaPuvEoMFo6BwBq4zCH2pGPgPVhr-Zt7xxBoTlSTYzTKkuD99xd_qOIBj8jUb5vXP8vnMymiqBe4dY2Aqf6PSen2TCYDVx4zso9XKOLdFE1fxW0dnWEyvlATSDJERdxsXoMh12ZuGcmtwnPjqUn6ZT88AXdRUDq4TngeRNKxcrzJ98lNHBeAsd&lang=hu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8ea5c188,0x7ffe8ea5c194,0x7ffe8ea5c1a0
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,9256136470497351627,13284301693643721183,262144 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,1563390979175555035,498961041192347022,524288 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,9984393238453308314,13094352777607271332,524288 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17682009065937110237,10192158951676470224,2097152 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,18238309292204583146,7031650625910846370,2097152 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4865333944931803440,8006233812443896195,2097152 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,13581080952027250850,2931369247026864164,2097152 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,1671450950121726959,8916754021459483508,2097152 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5348282122562219354,12926040551146402569,524288 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,14288846445821665773,1429507778876437010,524288 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14534608653348839547,9462517836542253724,524288 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14534608653348839547,9462517836542253724,524288 --field-trial-handle=2300,i,1663457036150678444,13392346874598442761,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 783d6561db34623bf8be1b624b1736bededefbb248ff3a845f6971b56f9691ad
MD5 eed48c82574325a7a0e8b5f48042fad3
SHA1 7ef791f8df2b1cf5550da1c752ef46187ea6691a
SHA512 d9ccb9b5560f0cb114ff0cc01890130e0649fb557aa2c18482ce2fac235a2e08c6c12cfbfe561bedbab7b9c893359be84ea6484d29924208d0c879943a2a05c2
TLSH
T1E8715E3A468FC050F3A0D172A1C21D0E3A7E8097874F8E95D3B339FE852E7959463848
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ee2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586ee2.TMP
Size 3KB
SHA256 9703c6bfc8645a3b5eade2922b398b588be5b4131f49e1cba9e977b26b6f90d0
MD5 1c55915e5144e84f1dee5b511e7f7275
SHA1 e63f761ff5ef193e1891162f6488eded0ff6b6fc
SHA512 7395c2282967d66a6e7f8dc191b34c857839e381ca9a493a488afcfcadc7024cd39434b7f4cfb06413f9033ca06a492ea646eebc2d9359c75455f7c9ea36e5cd
TLSH
T11F611C3A028FC160F3A0C672A5D11D0E3A7E40970B4F9EA5D3B339FC951ABA595A3448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 007949562982f0951241a59be69cc623787bbb7ce919afd18b167b9947ce664f
MD5 964783785060182fb5517d23097c6cd8
SHA1 e45058b56cbdce603304cd8d51fd3e6186e9521b
SHA512 7238fa591735a6a1520c6ce5a8683c173f6c305f38021fb6fdeefc65709975f3c6fe5cda8fc7ac5c63404c3b212201dfdd440f0e80a12f0ce03ccf06d663184b
SSDEEP 192:sxZDRwyM/jK1Ml8MkD/fqs2d7PIdpKoHW6+WNOHw/YH6Ix5IgrJ:sxZDyMD/fqs2d7gjHbf/u9
TLSH
T15652D8126A34A977CCDBD209F955BF53D6F90572A2900E48ADFC8A1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8fedea607040a52e3967fb1f185c2ba88e8eb7996811882f023f9f6ee217f9bf
MD5 5168eab9fc6f9fae2a747c9dc632be91
SHA1 d9c8230e04a314b71a34e345176ad66fae9c51c4
SHA512 f10f4e83f7ad78ac06df05e3e178f4fbdac39d4e21f0cd920f707349d1e249e15a93ca0668c71fbd4e120bb72dd11e257adbbfa0212339d6d1411939a511359e
SSDEEP 768:CVUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RFroVd08:CVUZYTMWvg0Pou1ja7eLZmR+k8
TLSH
T16AD20B2B280CCB7E4F844E5DEC2A6F967ED801CB5A584D5447EA894C03CB3EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ac821be68ff5ca55aa333e5082211ce91c8c05dc8393e6fe22fa04708d1bb359
MD5 5e8ccf70bc6a671627eb7c14058926fe
SHA1 aa424f6cc844e3cf6a3a3280b06940546c741acc
SHA512 1c8dc32b181f8973aa94aa710136de94db6a20c7d1fe5c92924d7039450a047eabc01be0df7127be6b39cf89c9066ad10dedd861b2f5c5e57f347919fbd25fd1
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+0e:Ect51j5H
TLSH
T150D1075270F622013D7E3B0882A497575E45F163311CA96B7BAC10B64E2AE25DDFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b062783be51f3503811dbffb2a85ca6c72156fb84984a5c50e57545947a449ba
MD5 441fe36b933b1bc7420ebcc68b9dbcf8
SHA1 4afaa6f01b7372619164b577f5540d4b5b6f8f10
SHA512 21bd4f0c80d0db013973168049edcc283628ab365e0215d305119ae3d71ff5e56f097f91a672d0187dd42e502cf5f8e42a00a4d67e634bfc54b0d769003bff7e
SSDEEP 384:0sN38B563rrZzX5od+W8yLXh8OOPrXLpe8C/Qte:0LknhOth8Oi9P1te
TLSH
T10B726D31A838AC57ADE3FA55F4473203AFF84497E7882B84D6DC6B1C01DA5AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aaa096f1956c987e15f2f184948749ab03c77fa10b9b5eb3f0758ad7c97b9a51
MD5 cb0c3856b1f4a5dfd776a8b76f24081c
SHA1 ec4f98316d4248f40a45e29953ac7d9b3c2ecb21
SHA512 56243b3599684c42832358158f72c6a5099cf134e16272d1236518adc875e594659fa2a8a608f57f14b705d1e011800f2ae63f2fa6199c2b1ca3f21b24f351af
SSDEEP 192:yON861VWQmiUy4ZgGX5Obd+j2jzoryXm0/aY3mDU6:yON86WbgGX5od+W8yUhDU6
TLSH
T18C02D935A8687CAB9EF2BE49B48737135F982067EA552F84D6E81B1C00D765C2347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9be256f5daa590bc44eb1f6ef53658e740fae0b2c0b7dd777d6c68ba87c1e53f
MD5 c492173bd7676381dc78d0316e10c83a
SHA1 bd406c7cfeb28e0e0ee48b0a8f93d8c89828d5e9
SHA512 5ca494aabaf749f9025ef71d4d198bec5abd8fdd683c52b9fac68258b50b9db95cfefa77826b0e90511bfcedd218394fa610abee58798965024296c3e8dc6885
SSDEEP 192:zONC61OWQmiUyuZbGX5Obd+j2jzoryXmOXY7OjJyqDwU6:zONC6nPbGX5od+W8yLXH8U6
TLSH
T102120932A468FC675DD2B585B04732139FA95167DB487F84D6EC2B2C00DB5AC531BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b0bf7f5a1a074c1bd84822adcfdff952f50c821ec18e68d9a86f6fec46ef0b8c
MD5 603f7f77773aa2b42b44bb77c9384a21
SHA1 f024cfa72081eecb155323a57b3964146bb6195a
SHA512 fff04a4839e1c36fd859cf337cdb9a3a6c36afcd5572072e83ada1aeb59722ab1bcf60e66f0d3a57fa1f429dbfd6b8dfd0aeebc984d3ff291e8b6c965b052d6e
TLSH
T13D413B58A6EA1148F3B36E5AABF7A96D587BB9772F4AC45D00010E4E0B33741C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads