hxxps://cdn[.]discordapp[.]com/attachments/1469078005820428343/1508760460973834331/Matcha_External[.]zip?ex=6a88172d&is=6a86c5ad&hm=5f99a0c8af873a41edc49e3b592e07d854131c87f57f13fa36607037116d45bd&

Analysis

user interaction
yes
max time kernel
209s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1469078005820428343/1508760460973834331/Matcha_External.zip?ex=6a88172d&is=6a86c5ad&hm=5f99a0c8af873a41edc49e3b592e07d854131c87f57f13fa36607037116d45bd&
Sample260820-ryzzaaygmh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3768	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317102175480861"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{C8696224-3E86-441B-BD60-F4191F070A08}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4984	4700	msedge.exe	85
PID 4700 wrote to memory of 3768	4700	msedge.exe	86
PID 4700 wrote to memory of 4232	4700	msedge.exe	87
PID 4700 wrote to memory of 4232	4700	msedge.exe	87
PID 4700 wrote to memory of 4232	4700	msedge.exe	87
PID 4700 wrote to memory of 1536	4700	msedge.exe	88
PID 4700 wrote to memory of 1536	4700	msedge.exe	88
PID 4700 wrote to memory of 2516	4700	msedge.exe	89
PID 4700 wrote to memory of 3364	4700	msedge.exe	90
PID 4700 wrote to memory of 2516	4700	msedge.exe	89
PID 4700 wrote to memory of 2516	4700	msedge.exe	89
PID 4700 wrote to memory of 3364	4700	msedge.exe	90
PID 4700 wrote to memory of 3364	4700	msedge.exe	90
PID 4700 wrote to memory of 968	4700	msedge.exe	92
PID 4700 wrote to memory of 968	4700	msedge.exe	92
PID 4700 wrote to memory of 968	4700	msedge.exe	92
PID 4700 wrote to memory of 1196	4700	msedge.exe	93
PID 4700 wrote to memory of 1196	4700	msedge.exe	93
PID 4700 wrote to memory of 1196	4700	msedge.exe	93
PID 4700 wrote to memory of 900	4700	msedge.exe	97
PID 4700 wrote to memory of 4900	4700	msedge.exe	98
PID 4700 wrote to memory of 900	4700	msedge.exe	97
PID 4700 wrote to memory of 4900	4700	msedge.exe	98
PID 4700 wrote to memory of 3528	4700	msedge.exe	99
PID 4700 wrote to memory of 700	4700	msedge.exe	100
PID 4700 wrote to memory of 3528	4700	msedge.exe	99
PID 4700 wrote to memory of 700	4700	msedge.exe	100
PID 4700 wrote to memory of 700	4700	msedge.exe	100
PID 4700 wrote to memory of 4724	4700	msedge.exe	102
PID 4700 wrote to memory of 1056	4700	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1469078005820428343/1508760460973834331/Matcha_External.zip?ex=6a88172d&is=6a86c5ad&hm=5f99a0c8af873a41edc49e3b592e07d854131c87f57f13fa36607037116d45bd&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe6ef2c188,0x7ffe6ef2c194,0x7ffe6ef2c1a0
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,10073371858767153666,13366888408501763908,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,12763847120190377074,14496232585827956025,262144 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,11357313581497545838,3697988560422035622,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16475526884979313330,11440527677586745354,2097152 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,7839288856471941690,2385372536503622910,2097152 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,6348277111184195647,6056571013313657782,2097152 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,12675606946031576780,11662866969430091865,2097152 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,379453561925847834,9879271282751314450,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,11561899577677950098,611868568297055573,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,15617179455506026796,6589864856159360563,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,14135518247821290027,13370081317538539734,2097152 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2158866773262869967,2046867988238874834,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2158866773262869967,2046867988238874834,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,15186075385868380987,2792010272777289211,524288 --field-trial-handle=2272,i,9174551642556413144,17911211823633751198,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:996

C:\Users\Admin\Downloads\Matcha External\Matcha External\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External\Matcha External\Matcha External.exe"
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 808672f14296b04df293c3e185a70b626c4f9187d586574837ffdcb84f0f83ed
MD5 99d365e71486a534b82180c5d6636c48
SHA1 815f2a2c6e02f3a3e4be1d48e83daed5a835def7
SHA512 66ca632e7baee0590eb9c37c4e509ee7e956b62e1c263a061700bb08942c34170fbd8a79b67dad2181a243235ae0462829561971a3fca809a755bf6414c31d49
TLSH
T104D02310B82CB7D2F123003D00304702344C8177B223B301B020040D8E300C3B2CA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31efc7ac3078f38b382081af4989fa1311b94bd6c4deb26da976a45d38573cb7
MD5 d4b775ee4c42397f786ec6c6580c93c4
SHA1 4b3db6180d88691725b8b9aa2f29812df90d565a
SHA512 674f587f8053873090fd7881b89ef9082c1cb2ee50babf18bb660474719106e8675d2b92a6d31471872b57b2312f57a517817c822d6b094568fa6777c2dac744
TLSH
T1CE711B302206C46DD3B3C23274E22EF3B47544CAF99FAE755164AD743581B51AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58508c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58508c.TMP
Size 3KB
SHA256 84eb6a49535b847a624fd29c3d4baf054480de8bdc98a66a02b2bb4d20bfd012
MD5 2a581237651d9df08d802956d9376537
SHA1 8d492e6309b168210bd8a11817fc3c54a554d815
SHA512 0cada021b17e50e818399e86a6a72f1e56ac38ba84a63398f07ee3c921fb18b48bc7f290e48113914eedc3015589803fd07c40afb46b8fcca460328ff67a599d
TLSH
T19E714C302206C46DD3B3C23374E22EF3B07540DAF9AFAE7551A4AD783481B91AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 63a27f97a89b71db2afb37b12f4b79fbcce026f647135e4941fab0de19bb4a36
MD5 ea73de3c3cb9535b3d426c3b1ed4a728
SHA1 1040b4847767793723864f97f81b5a48290e7660
SHA512 9a5a91162ca1566d1d4df4c2d2334160d8bd0a0135f761d67b5876022b4488c70a8f96e480fb4be1c5f4febf65dbecb24ce3c2144a4ded0bac45c6ebc7bb8045
TLSH
T1FA21AAF3C3D58A6EC90516F06B14AE2BCE2D051543293D2A89D4EF6BD7E3076E001A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9f9696c0364ef40364b5fe866c6b4739c817053020578c49f7940da3fd8d6001
MD5 c0f1187478c9cab38d0a5e42c040b6d9
SHA1 c5359a1f79b5d9bdf94af064d5af1946059f3143
SHA512 af14df0d7a115c8788297b07e9c3924a6d3ad7c5b47b61840f3cd0b331388450a4ed756fddf3907c4edb07391a7db4033a59cc454b5c75cb794d7c4f7fb6fbda
SSDEEP 192:sxZHR9yM/jK1Ml8M9p/ffsES5NZIdpJHW6+WNGYIwkGG++zIgrJ:sxZHV1p/ffsES5NyJHbGX9
TLSH
T12F42D6116A34697BCCDBD209FA557F53D6F94472A2900E44A9FCCA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 738251016956273608e96c3df62f484ddaf67a91b333995a724ea94c3bfc96ac
MD5 b78c217112ef20a6d0fd8fbc2d719979
SHA1 1d12b64687c294bd37b204536c1f0b1b4d7fb823
SHA512 e241c799249064a5cca1f4f1b793cd7816e1a2d21e8e5804743b29d0b5846638f5b72deb4b708144dc52a27f02c95692bc514c930071482e7e382b7663648e8b
SSDEEP 192:sxZHR9yM/jK1Ml8N9p/ffsZWpVlS5NZIdpJHW6+WNGYImnGZQ+zIgbtJ:sxZHVap/ffsZWvlS5NyJHbGNb
TLSH
T16452D5116A34697BCCDBD209FA557F53D6F90432A2905E44A9FCCA1C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 475515c1a8fed57c8a1f57147210eb8157c841c83c12784a5b1ae5892eb84fdc
MD5 56e75e1b8279888d9d7e630a29b6baa3
SHA1 45a7e2064ccdc6362fdbda96428eecdd45adc1d5
SHA512 4a2333c9a772f5d8a6296c735e062400ce13ad0ee3a530e67eb77f8ced0bde65dbfa2efb3c59dc12118167cd9bf4d65715a36f950b8e3e9f89c60cde8fb7af7f
SSDEEP 768:acsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9vro0H4S:acsqxXlWvJD6Tu1ja54LAs98cr
TLSH
T1ECD21B3B694CC77E4F840E6DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 9KB
SHA256 f9cf00b4ce40164d3b29b160385a2a8c32ca41f3621cf245c6503cf309a5feb7
MD5 9a86c1451789ed53db407ba9f9d8c17b
SHA1 8d8fbb291501b5595944e709e50b5f80c8eadee8
SHA512 50dbb2339c9df53562a6d725a9916d3a5becfe6445f6f26b9ba239c7b503402229680409f8fc48570ae6c6e1f149ad2a6805263f883ce8fb449d3f8660efd37c
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhmiisK3quiG4Kf6u:ExTjHOJzKLfd
TLSH
T1CF125116317A06223C7E285CA6A6997B5F4231633148E46F3FB840B54E6FE225DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 25433053da04aa389b1cda86151af1120f7ebc2a9cb1d8ee742307c38307d3cf
MD5 0d48c487fa12c5da3dfad996158803fa
SHA1 ee9ee1a1a19b4daa202a797fd974defa1affc9bb
SHA512 ff0ab1be08bd0209cd9c71138870f670f8516c8a64d4ac27aaa7b9f01cf2073e8c79d23ecf6599ff3a70ace359bea073afb0d37dd2b3cd43d6a7c4d8e9b069e2
SSDEEP 384:mZcIhsNn4yZOfbKvnVRNEOz/9aO9ivvUFoC:0h2bVHEOj9aO9i2R
TLSH
T13E828C716D785C761EE6E245F947260B5FB89027E6CDAE80C4DCAF1C01EEAD8131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1acc41a5de9aa7b5d195e053bd3bfb8ff48cd99a3184d962e0b58c517fb88fe5
MD5 3b3944667440d9b0dbf16ffe631431bf
SHA1 d4d11e0cfb32a41fcf3d78b81e8a5e920eb9a698
SHA512 ee258599298b493f30ec826491f18558f2687ca686989666d93d9936a1586b04a5975876f45bf5a52b8451e1cc82aad84461cb1808a085815711f85578062a14
SSDEEP 192:tONnd6JkRtQmiUy3NW+RNEOmAeR1h35RAU6:tONd6UrOW+RNEOzooU6
TLSH
T18D02E835AD382C7B9EF3AE0AB94B27175FE4106BB9856F80DAD81F0C01D765C1346936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ab7b3f31720cd5510bc69991712053154db8f524d53fa477964ca9ec3a308541
MD5 b4f61e94ea3bd00f19dc0f25f4225f03
SHA1 170891ccb582b7da74432bf64c5f8fa6de6b279a
SHA512 ce398fcadab4bd84f18184decfa5427f8af3be0d94e2ebae21a1176eb657f64fe3f20d7d7c2d876f3a63499a1e38a0407f17b9f97c7ddf3da7d63f680ca70af2
SSDEEP 384:uZcItsNn4yZOfbsOnVRNEOz/9aOuhvFA8Bvt/oG5mkcKivvUFoC:Mt2oVHEOj9aOs68AG5UKi2R
TLSH
T17BB26CB0D8B45CF704A5E1C9A586E5072EB85037D68D5A4CE2F8BB3D30AF9F81316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c275e6c8163211badf93d170320f80fa084c04066f66594e3b6946435e28b45
MD5 c12235fad5899c2e61adb1d228e2c91f
SHA1 835a067d2db1f7611d714fa3fd7177d2f7fe9b9b
SHA512 d1009f544301420ffd16beeea0b576d755a6491bbb27580535e9a95335ca3df3100483a6423f5e287c6d1d2217b2c707632e96e876388ba0f18c4544c3edade6
SSDEEP 192:mONK6JkRqQmiUyXNV+RNEOmAeRi99awVcqDqoCU6:mONK6UmmV+RNEOz/9aX9U6
TLSH
T14312193668786C7B5EE3A845F48732175EB9512BEA897F80D1D82F1C01DFA9C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca9fa1210267b2e301fa1cc51d1ef34df23f19eb2cc9a501cbea8ba9d77a1264
MD5 5f5cb43daea448d60ad915da6c00e7d3
SHA1 9ddf1cc83aada25619874ef0e8cbf4bcd4b31d14
SHA512 d193120f3c2c983b62ddab5581c3d94aacb586fe3f324c79d8c4e78856100eb8e623fe0470b7fa198acec78011e69e8b6e71395395ea325dbbc387215f9ec2af
TLSH
T152411798B6E91148B3B77E5AABF6A96E487F78372F0AD05E00110E4F0763B00D961777
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads