hxxp://tannenhof[.]com

Analysis

user interaction
yes
max time kernel
77s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tannenhof.com
Sample260819-npafgsshld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316128382099563"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{F0CC6648-D4EC-4E03-B7DD-AEE1EBC05D20}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1888	1368	msedge.exe	86
PID 1368 wrote to memory of 4544	1368	msedge.exe	87
PID 1368 wrote to memory of 980	1368	msedge.exe	88
PID 1368 wrote to memory of 980	1368	msedge.exe	88
PID 1368 wrote to memory of 980	1368	msedge.exe	88
PID 1368 wrote to memory of 3632	1368	msedge.exe	89
PID 1368 wrote to memory of 3632	1368	msedge.exe	89
PID 1368 wrote to memory of 2080	1368	msedge.exe	90
PID 1368 wrote to memory of 3352	1368	msedge.exe	91
PID 1368 wrote to memory of 2080	1368	msedge.exe	90
PID 1368 wrote to memory of 2080	1368	msedge.exe	90
PID 1368 wrote to memory of 3352	1368	msedge.exe	91
PID 1368 wrote to memory of 3352	1368	msedge.exe	91
PID 1368 wrote to memory of 1076	1368	msedge.exe	93
PID 1368 wrote to memory of 3052	1368	msedge.exe	94
PID 1368 wrote to memory of 1076	1368	msedge.exe	93
PID 1368 wrote to memory of 1076	1368	msedge.exe	93
PID 1368 wrote to memory of 3052	1368	msedge.exe	94
PID 1368 wrote to memory of 3052	1368	msedge.exe	94
PID 1368 wrote to memory of 1720	1368	msedge.exe	98
PID 1368 wrote to memory of 1720	1368	msedge.exe	98
PID 1368 wrote to memory of 1720	1368	msedge.exe	98
PID 1368 wrote to memory of 4428	1368	msedge.exe	99
PID 1368 wrote to memory of 4428	1368	msedge.exe	99
PID 1368 wrote to memory of 1232	1368	msedge.exe	100
PID 1368 wrote to memory of 1232	1368	msedge.exe	100
PID 1368 wrote to memory of 2660	1368	msedge.exe	104
PID 1368 wrote to memory of 2156	1368	msedge.exe	116
PID 1368 wrote to memory of 4912	1368	msedge.exe	117
PID 1368 wrote to memory of 2436	1368	msedge.exe	118
PID 1368 wrote to memory of 3236	1368	msedge.exe	120
PID 1368 wrote to memory of 3236	1368	msedge.exe	120
PID 1368 wrote to memory of 2444	1368	msedge.exe	122
PID 1368 wrote to memory of 2444	1368	msedge.exe	122
PID 1368 wrote to memory of 2444	1368	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tannenhof.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff715ec188,0x7fff715ec194,0x7fff715ec1a0
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,443055533940601001,14768962962713292211,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7272198281148376969,9219890709768723400,262144 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,6719263145727020027,5333681542760504503,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3359607343373387649,12815862883415226275,2097152 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,1165742737457494403,11397805155012823076,2097152 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,16875341091643416508,1805974227296293876,2097152 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1800325561317945900,5769453421200073886,2097152 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,2316009839486838937,521880037116985469,2097152 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,4214992720968197615,17917871630081057273,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,5811190328580830505,4935102873575620499,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,11993754340663282366,7292893498671620032,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,11993754340663282366,7292893498671620032,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,7406238618979465738,8204334628224582486,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,14528787845589687191,283542879611208582,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8552211501528920346,18371251735870171254,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,4931501323978935386,10684553799929168611,524288 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5972,i,2345167757618267267,17663144144586892057,2097152 --field-trial-handle=2220,i,12353929667107200725,18255322529033245938,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 22KB
SHA256 a8dcaefd6c243a1985bb66f508625fa000947a2af22a36541c41b2791fb337bd
MD5 e7ea56a7749fb6370ce178c62dfa0d4c
SHA1 77845cb9560a2884de7eda02494884863e757f35
SHA512 d39616695e0decd20b23836f90e42b05393ffbdd46983cdda88ac1c718e43925fbf4df6f546cdee24764d254386d86129d7ba1b9043b2ac0d9d8a70e48253282
SSDEEP 384:Fw1JkKH9QAfveJszKLPfQkRIbo4/zlfSsD8XhbasI2Y/2IqLOCNATKDeezMM3Mgn:F+JTQAfW3QkRIbo4b9SsEbm2YeyYIM3r
TLSH
T1D3B2D147D61FCB84A7E748FB637255F4D5B611E4DE707DB5180CB2E001E6E08216F626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 111KB
SHA256 f46348e25762c92d110ca2baf94fecef5b8324b00d8a78f29d9d41bcee0e806a
MD5 aa5c635fa9d1d7d854b8e8dd7f247825
SHA1 25c388ca6419a059e0e099adb317582ebb34479d
SHA512 9b4aba2e09061ffe7b1cdaf76e0cd9dc18728bb07aff0490e80335a1b74e4412d5f17921f1471c9c9b8b8a6bbebdadfdc33dce724cdd3f0087c91a640b9bc8a4
SSDEEP 3072:K+LsJ0fFaNlmP2y0OKLYlNMgjgumREqf9S715:pLyzzy0OzNMgkuUEW9SX
TLSH
T1E6B3125C472146AB3523FF80A131E344B2BECF752263A2A8F7C9A56FB71103A7163179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 98e5b114904e5142e932cf126fa38ddace723b557f4142deedc796e83542189f
MD5 f0b4bcd90d64d808aa5146148bb8d498
SHA1 5249826f4b9260ef03b31c2b32fccd0bdb31adc3
SHA512 e647abc581b31f612c9614eaed49f567033a52ab23b6c5867fc257a7e71a93986d269a8f6385dfcdbe3f785db2e7e80bc8946d0098906c95d4344b1f7dba24f6
TLSH
T11781FB364A424062FB56037162D185097CBCC1DBFD1BEE0293B4BDB91BB63934D95387
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f19e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f19e.TMP
Size 3KB
SHA256 990d16b502dfdbcf89d9314431e4541dba1e56ce1d0cb3e7cb46bbb95306653f
MD5 f881683ec84f5be14f0cd8e1b1e32aa1
SHA1 72e0d4b8660f4113ef15f6f306e6909682034a34
SHA512 95bcf8d3aa729c585e3b9f5289bdb10dddfff5bfc88b308ae79f13e3f124d23ed1586eb0f74241021a0194f94f148e57ccccdc649662f0271d8adbb321349674
TLSH
T1EC7151354B4200A2F75203B162D0D2067DBC81DBFD23EE41D3B4A9BA5BBA3534D69387
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 dd57dcfd7e4dbf238eb90a8c514a204f341e532287de578bb55a8d1cbfae1f9e
MD5 a7898d7dba40df2e85fe6286350be7e5
SHA1 d1c9dab7aab8a15fd4d666318cf2f097ec315ef6
SHA512 74b6462eb3a655ba7bfb48f5658fee3c861aa79ac945f1a8bbf2cb07318c5a27c9d5b824c87677f817291909461adc059ff1e337fcfbbc908b7377522017d746
SSDEEP 96:DLOUPx/oMfzyvDGwSxEpUW8Vyy4EB8pgu:DyUPx/oMf2vDG7xJW8VyyxCpgu
TLSH
T1E5B16BB7C3E5892E891119F05625AE27DF5D0A14C2283D1A88D8BFAFA3F3471E61164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 37202781c68988b6fb8e71bb8c31f8af54b8eb348965bb3bdfaf0ee5365d48e2
MD5 c863b9d1cc2b7723b634e9d461512ca3
SHA1 46500fd8a3c1356fc7225d216fd76b72da326ff4
SHA512 e4b4c0f261589e09a57940187f214c3e6d64a479cdd77f92dd063a52ab0086ee5838de06c60fdb0bbd9685f327f43fbbccc476cc3b1d836058031bc7e2a31f19
SSDEEP 192:sxZvRCyM/jK1Ml8Mkb/fqsFOB/yiIdp9kHW6+WNSQI/YzI1t+pIgrJ:sxZvEMb/fqsFOB/W2HbC/tW9
TLSH
T10E52E8126A34A97BCCDBD209FA557B53D6F50472D2901E44AEFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7bda5fe124c30265d83da096ea39765595203680663791fe4de75471d268a52b
MD5 3d338e5da26611e790b8cd040c74b44b
SHA1 0dd7b887e3e825bc21ad6175740e831d0e5737c2
SHA512 9af6d20284b5e48da77bb943c4910a52c19c865d0b63f1b9ec3301329237b4f47b36c247bc8e616fd577f244b9a130c302dc0d958c480f66cb9f787e7b88de62
SSDEEP 768:QnW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj7roIdiMYO:QnW7kf0Wvqidau1jaa5LA3jIfO
TLSH
T1B7D20A3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 187be5e2159919e51059b23dc2fe5ae9edccd0e2ec35a844815f0ef1430a8f06
MD5 3f54f5ea367f9b20b65d360bf8489ef1
SHA1 8ac8a4f8ce75d99fc787c8e5b12595720d2ffc4d
SHA512 918b354865af7b6486f27af969e595c0930e50538140d64bb8819b585c60fd6ac19ce28977bab79f3167faf637ab1153e60230f65e6f824c5df87d55684d1e7a
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTnnIFK8sgHyNzIhKowUwLIxK4AELyD:KIbCKcnnGK8siGziKow/LSK4Aig
TLSH
T164A14F05B67602013C7E2D5CA1BB9A275F8735A37018A5AF7FB814A60E66E114DFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595a6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595a6b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83fd437c09bc00a84823294b1b675b060e5c06cd9476d0e5056ed03fadcef89c
MD5 578d66abdfd1793479cd093bafaa0d6f
SHA1 045729dba81cb40e97d32c4031c574043ed87a3f
SHA512 e9f337a25ca70b66122063b96d859a612075e5a2594d693cf6dd26f90a81a494cf509844fb6b10c7d60a8499cd30fc2a6b8747f1c9ced45f3c4de6f0a9c402d5
SSDEEP 384:kZcIhsNtUDiHbWszLdXm0CEJrMhvLT7k1Bu3:ChQHfnvhMhzABu3
TLSH
T17D829E711C356C376EA2B246F4473B135FF88167AAC87F90E6EDAB0D00AA1EC1316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b02a07464ee521f7b774da1241859648a1855d919bd8f9c82b8423e8af38760c
MD5 7674f436da0ada4371dfa05540684086
SHA1 d0b497a46e9caa85f851d816bc657df4b05a3aae
SHA512 2b466ca6fab9d18d32c1ad379852b0d33e94977dc250741da0451f07aa385bb4c562488b9e229ad9c0ed16e3e9092cf0da2dbceaec031a1c878b609656a88163
SSDEEP 384:JZcIssNtUJDiHbeszLdXm0CEJrMhvLT7k1Bu3:BsmHPnvhMhzABu3
TLSH
T13E828E711C35AC375AA2B246F4473A135FF88167AAC87F90E6EDAB0D01AA5EC1316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cb212be4a1fa6187e098d93d53f1a4d5e8e68fcae167d1e4d6371ffc07b92de1
MD5 35eeffb35b9e8186320f14436a1415aa
SHA1 342aa590207748ed3f5bf119712c9eb73d311a22
SHA512 b1bc4a0253b7d1c454bd77c2096162486ba03fd07d4af4755a4151908fde7f05013c51a6874787b705897a121b9c994f33d247eea3205953c5732a297f70fd60
SSDEEP 192:MONq64BAQmiUyL1UW5GBPKnX+FdG4m0+aD9OU6:MONq6eAkyWMdXmg8U6
TLSH
T15002D935AC796C7B9EB2BE45F4863B175FD8113BE5942B44EAE82B1C009774C234682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 297e634b2ae354070cb128ec91d3c8a0365ac6a791de39873e646600169bd7c1
MD5 c5235ba6772d82870ffa807474a56be9
SHA1 dad2d135885286b4fa373e7eed82a1838b87ec55
SHA512 8a716ef61120b1dd9929ff1c4391e2d6baf6624431bc1491d3603c01e0e7b225f9a1833878667c63a91f0b963963a2631d39d792aa44d25dc53311b6afb40bf0
SSDEEP 384:kZcIssNtUDiHbeszLdXm0CEJrMhvLT7k1Bu3:CsQHPnvhMhzABu3
TLSH
T1CD828E711C35AC375EA2B246F4473B135FF88167AAC87F90E6EDAB0D01AA1EC1316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 863b61a90f6a14e235dca352c5443262f7142ef15eb88e589d562f87237071de
MD5 2f7c2fbcda11ac0ac77d89ced208a4a9
SHA1 398e3a097bfda72710d9c5cd5d9bd20ca7d9e82a
SHA512 8678dcf760a635616676cbcaf604c14476df1b3b7c338c3a0b8d05085392f504c55074a8a424a3af03be4ad29ae9194861640ea4aef226837c786e2ebf1e1a73
SSDEEP 384:iiFiZcIpsNe8TUNTUlIlJDiHbeUzLdXm0CEJrJhvLT7k1Bu3:pFQpXwgOHHnvhJhzABu3
TLSH
T19EC22AF208E3983BD9AE6747B77D2E024EBCC067B9846A50B7D95A0CCC561BFD306851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a9790e3cefa5c2b18381dfdfdd3e9c39dbe0b330d3fa403bcd2b3ff37d6fa53
MD5 5742df65287229e745c0e4058896dc48
SHA1 a4de2be789adf11d2f7de9b89187a8d70f9dcace
SHA512 d5e3dc912d31ca1bc327c9e6dbcffedcc29e6001163c526fe30ebcc91e6352a42b9dcf12744a4606832cc0ae8a0f95344a4901fc28ac23b437472a3959f4e6dc
SSDEEP 192:dONX64ByQmiUyYUh5GBPKnX+FdG4m0PbFC1SJrE0Ww+qdU6:dONX6euehMdXm0CEJrDhU6
TLSH
T15A120A31AC64AC2B5DA2B151F4873A135EE5422BEA897F45E7DD3B1C01EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e668d343f21d77ea198890352cee00cb321f6505c745f17ea9ee99149ce9024
MD5 7e0f703140ce48fdb9ee20e176273ec2
SHA1 e8d5a59896ced78ebf0c1edd211167985e48967d
SHA512 5682a6a5e7f4d53421428247b4408b112fdd0408313ea12d8c808b89ec951e2aafe53f64ac8be89f80c6eb580e98bdef5c13666e3d1042a91e2896b61c970716
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe598e2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598e2d.TMP
Size 392B
SHA256 d4c066dd36cd3e27422176fa58f24f02575aa4ddc5a5d79adbd73f6de826c93d
MD5 45ba4ffb91a69327155d1106e941d64d
SHA1 92820ca8fb200133e970ccd3c8cb6089b4968959
SHA512 bdeb04108a824ff308d6d16488040df339dc4fa57b042114ac42ec34d8a48a07079647d25f7ca51e099b022f09a3640f08bcf4d07764908e32c630f95234d74a
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d6a244e2e66060c33a21f7f91c76c10811d7a218843893183f1b407f2208e18f
MD5 40c8228a682da76d98575373e70e5270
SHA1 c3c8edb58098c26f9e5424d344825b5809ad2eea
SHA512 b59316ff2cae1757cbb976c3669045f29f8fb0723d863e8028090343d0ec0190f4f0cc04ebf98dcfb546444ed88a3dac567f224c5c3d530e8db3a4d62efe4374
TLSH
T1E8412C6DA6FD1148B3B76E5AABF2A86D48BFBD772F06C05D10110E4E4622B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads