hxxp://akwaponics-ci[.]com

Analysis

user interaction
yes
max time kernel
46s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://akwaponics-ci.com
Sample260820-jmh8dsgm8x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316856397740216"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{FED38532-0BE8-4C1D-9EE0-10D78AA1C80E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1324	3144	msedge.exe	86
PID 3144 wrote to memory of 2872	3144	msedge.exe	87
PID 3144 wrote to memory of 2284	3144	msedge.exe	89
PID 3144 wrote to memory of 2284	3144	msedge.exe	89
PID 3144 wrote to memory of 2576	3144	msedge.exe	88
PID 3144 wrote to memory of 2576	3144	msedge.exe	88
PID 3144 wrote to memory of 2576	3144	msedge.exe	88
PID 3144 wrote to memory of 2868	3144	msedge.exe	90
PID 3144 wrote to memory of 2868	3144	msedge.exe	90
PID 3144 wrote to memory of 2868	3144	msedge.exe	90
PID 3144 wrote to memory of 2480	3144	msedge.exe	91
PID 3144 wrote to memory of 2480	3144	msedge.exe	91
PID 3144 wrote to memory of 2480	3144	msedge.exe	91
PID 3144 wrote to memory of 3680	3144	msedge.exe	93
PID 3144 wrote to memory of 3680	3144	msedge.exe	93
PID 3144 wrote to memory of 3680	3144	msedge.exe	93
PID 3144 wrote to memory of 372	3144	msedge.exe	94
PID 3144 wrote to memory of 372	3144	msedge.exe	94
PID 3144 wrote to memory of 372	3144	msedge.exe	94
PID 3144 wrote to memory of 4188	3144	msedge.exe	97
PID 3144 wrote to memory of 4188	3144	msedge.exe	97
PID 3144 wrote to memory of 4188	3144	msedge.exe	97
PID 3144 wrote to memory of 2424	3144	msedge.exe	99
PID 3144 wrote to memory of 3800	3144	msedge.exe	100
PID 3144 wrote to memory of 2424	3144	msedge.exe	99
PID 3144 wrote to memory of 3800	3144	msedge.exe	100
PID 3144 wrote to memory of 3384	3144	msedge.exe	102
PID 3144 wrote to memory of 5608	3144	msedge.exe	118
PID 3144 wrote to memory of 5616	3144	msedge.exe	119
PID 3144 wrote to memory of 5624	3144	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://akwaponics-ci.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8c69ec188,0x7ff8c69ec194,0x7ff8c69ec1a0
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,10090753260443184161,10080566864991803582,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,7246880933359137739,12216564092939933944,262144 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,9099322458411709150,5020165115160997371,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,16851417368523686605,15636417217984571311,2097152 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16534152519572277466,2235116128575792753,2097152 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13712037778333429475,1738917670500728779,2097152 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,13348511592739915856,9061072053990935830,2097152 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4596,i,10096591457393778895,2069722815924202510,2097152 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4211254929380073282,13761541846621384488,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16952399907177939018,2111345535031828566,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,18351139923978097763,17289749037453476321,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,18351139923978097763,17289749037453476321,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,4916934082037730677,13851388612170781739,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,2645161546123328645,4201378139387634663,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1135735187008371404,13898579910812228385,524288 --field-trial-handle=2260,i,17745321463755537239,14283138036823104368,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 36KB
SHA256 30550fa4a637ea4757699f4e41e716918ff5a365f7f27f8af84e49c4588b5e9c
MD5 126dbc2e3fd1c7cd7d5edef5e8537fe1
SHA1 4d9c9b47aaaa360fd1c686d06fdbff3ea8e5a121
SHA512 58f93d18c44533ef5eb559b42eb86ba4f146626bb1aaa13f36a17bb9c1fef32e552515b41ed81ae10ffdfca798f378a046a06f04c99e63084ca8e39e760f982b
SSDEEP 768:Wmdt0Ewnw8pJHKPYU+gFvFk/GHmHbgeX808A/cH/mxRE/lkL5EdNLxhZ4S:WmdtF0KPYU+gFvutX89joaEEdZJ4S
TLSH
T110F2F1C1F664D76BC3025071F97367269D4AD168AB2EEA123B3D1274E7130BCF426EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b350dee01828df4cb4e059ed5afc7169c0013b1e5e67c97cd4f27801dec2686
MD5 c4cf0ed748031e430e3b898e00f0ce62
SHA1 f8b0b9bcd49ad883fb2593183a7ef14efbb298bc
SHA512 4f7e23da90d98ae636d991ce98208a0b047a0b44708a8161f6e6b39b3fee86998682bb177ed15e1d95e3fb44d126684700335527264f0627419d658047918cf2
TLSH
T1EC71901B42B747A6F3A2367CD4D32A13F3334484197B8E73465045FE7A36B52A3256AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592c56.TMP
Size 3KB
SHA256 982a85e0047f7c23e9b89a7dc171c78e61f68e50f3cf1f3138e9a4099de515a5
MD5 127d2a8e662cbaa673d140517f06cbdc
SHA1 44452b90d33891bdc600666b991c368da99afa45
SHA512 317d5ac1bb6473350fe0cb6f86732b1a36eff66be48a976e2aefeb28defc836e6db41f2508dcd0ef987d6eb71aa200bc924b37c688d8a23d28c859ecf930481f
TLSH
T1AD61D52A42B34797F322323CD4E30A23F3738488197B8D77464405FE7A39B22972966C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c0cdf5ad092e7bab588da5021a608035d0f4ccaee47b882b7d179b1def173677
MD5 4955ee603a417023c6c987ff686834a0
SHA1 c04cc7c23d9f32793b4a295d6c2741205ad7118d
SHA512 cd0807c571715bdc3d53eecb4da85daeb3e2e354efbf5660b4d72646d27c6c417fbbb006bf39634f699cc83f9e86cc7becb6faec115d34b4a2061615d2af7c34
SSDEEP 192:sxZyRqyM/jK1Ml8Mk0/fkXs6G9IIdpjZ1HW6+WNKZG/YwVIAI+NIgrJ:sxZyIM0/fGs6G95vHbF/gc9
TLSH
T1A252F811AA34697BCCDBD209FA55BF53D6F54472A6900E44ADFCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 817e680eff56b9dbcd8b84fe0cf655a14f0aab0538955237cce58e18b254cce7
MD5 dfb95f83af81e020fae1a2ac3a239389
SHA1 f0404ecf1be02fae1e42d3e727d85d48da80c428
SHA512 df5e2cf127e61be09429bef41343bd329cc9226b4209957321959e61320e8245d1bae55e3b533cb96713e855d7041c0a6094cbecf338b170422d605033227c74
SSDEEP 192:sxZ/RqyM/jK1Ml8Mk0/fkXsQG9pIdpjZ1HW6+WNK0VZYwrIyI+NIg5jaJ:sxZ/IM0/fGsQG9ivHbTZyyJW
TLSH
T1E3520911AA34697BCCDBD209FA51BF53D6F5407296940E44AEFCCA1C05E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e09e4bab103700940a82c668536448a509c06e6aaa640d2fd060d0b2f2ba2bc0
MD5 96ab393a463fc51aefa3e55154d243d7
SHA1 142d0bb040035d38da529cd510fc1e9b701e7bd1
SHA512 a90aeb086c95dd7f0102080226ba7467c057171c6f9b3c62f50b22a959d995c36aab1e9ce0dc533a1d1deacdfefa9d9f87fc53cd3774cf87f98117aa7e566954
SSDEEP 768:ir4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dhrohycZaQ:ir4jeXmWvmKLEu1jacPLZQdajd
TLSH
T16FD20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 68a38f22fabcfb8c87c01b9a637d999dc5f2616a8c217dcf683867ff5b6b5ace
MD5 a2272ca935d461b99e2eded536ed2c85
SHA1 71baa46eba70bd01ba4e74a2c65737b5a996d3f0
SHA512 8f8538858b8b316467554097aa57422654ad97e7d975098de44c153f625dab7f1ae0cf431ede0053fa364d555cd33bf2cfa7bc2f29f8ff3ced5cd0de4da85b77
SSDEEP 24:KdKf9G3asdAc44o0+rIji4KibhaU41EioSmWM/8qVyXYof/sdaCdK6W4KG+dIjAq:KAzIhK0YMHy1JIhKa882XItKEUIHyc
TLSH
T17F91FD1773BA42412C3E2A1C82959A669E5271A37028E43B3FAD55B10E67F148FFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 42272a1f755fbddcbfbc2079bce3f723a07ed2d24807f03d55accb5b90a39cbd
MD5 7866e56a47b1a10545a978a639da8d0f
SHA1 a3b639af2256f43f78df4262a5cbceeef2084fc4
SHA512 6ed615e1a9eace76d213f8d11ae384d98bb1b8892b94d893ec4c3f83b10861b95580a98e15abea2481c6a8ff5d59fca1e67fba722a2e33030ab35c49e81c6366
SSDEEP 384:oZcIhsNB9+a+HqgxRf+2/d9Y45KFYiv6UUoh:WhwDWbZb8YiUm
TLSH
T1AA828E316CB86C375CE6E241F4472A134FF890379ADD6F8495ECAB2C00AD6AD1317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cde054bd1213fffea0fbecbee67ecf487a29c98aaa9e2762161f7a625aa9a140
MD5 6f05988854e541f8ed481b135da3d1e2
SHA1 d44ccc8f2e68b230f6656d614ad055910fd004d0
SHA512 cb385c5eddd878ea76d372d4055d45e94721293d73c6322cf35b4a3e55485530f974411e6ec72e08680228275e6f2ff8e9a74b44ebc47e12ead7963e3771fb97
SSDEEP 384:jZcIhsNBUbXa+HqgxRf+2/d9Y45KFYiv6UUoh:7h/2WbZb8YiUm
TLSH
T130827D316CB86C374CE6E245F4473A135FF890279ADD6F8495EC9B2D00AD6AD1317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e69684d9b8f180664f576470e75c8df1a72a5a397a1207f1a10a54536d52648b
MD5 e4050539375929eaad77f1ce39707a7a
SHA1 487fb3927d6ce1b59c131d06301fc4c4d4fd2384
SHA512 55c7f83236a140e560305e16efbe0d68e100e8e5841236dd0dfa8af5db51110573e6580e4496e5a167d0edaf4f658fab5bfaae8a07a1cf6dd8ff1003e3be04c3
SSDEEP 192:EON+V6hZ0QmiUy1Hpc/+jV40+Fd9YDJ5wOZteU6:EONw6oepu+2/d9Yk20U6
TLSH
T10302C835AC687C778EE2AE46F48777135FE4112BA9E56F84DAEC1B1C00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2f13de2e114114a16f8098ec7ca26ea4bfc2cfcac6fec851785631b3183c764
MD5 f8a46739e7bc982f63086b670627284a
SHA1 abd4cc457bdbd995baf74f13474cd472e9c6c723
SHA512 020ca16bc50c63f54beff962415681a2c4be6be2561cf266fd1d430f8fd1cff347d2b2a17bbda4dd859b5fb881a5454f06496b96801958f38a6399549c58d0b1
SSDEEP 192:bONE6hZmQmiUy8Hjc/+jV40+Fd9YD804Nj5cOqcrq2U6:bONE6+1ju+2/d9Y45e9YU6
TLSH
T14F12D931AC68B8274DD2B645F08736135FE4522BEED97F85E6EC5B1C00EE66C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e9a5dcb-c008-4b5a-b445-92f87252135a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9e9a5dcb-c008-4b5a-b445-92f87252135a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 39c11684376c018ec6599659c082aed8585e62b151cf66837a3b82e3ce050cfc
MD5 9ab6ef82d71bd10acf33af867a8e12c2
SHA1 ae7f96ddab88037bd1f3d21f11eab9c5c26b8243
SHA512 cd0b1efbc89c9082c3da064a28f0c0eb9b71f1bba6645cabb5a38841fac9719b492773956e6233f02508b9368f69e17568814ff0cb358f3b0b45c39d777118db
TLSH
T14D41475CB6ED1108B3B7BF5A9BF3A86E887A78772E06C49E10010D4F0A63A41D961737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads