hxxp://cyberleek[.]info/up/CyberLeekLuncher[.]zip

Analysis

user interaction
yes
max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cyberleek.info/up/CyberLeekLuncher.zip
Sample260824-bxgtbasapc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320086865053875"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B53B81E6-A65B-4088-999C-0ED8A5AC4C43}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 688	1508	msedge.exe	87
PID 1508 wrote to memory of 4552	1508	msedge.exe	88
PID 1508 wrote to memory of 376	1508	msedge.exe	89
PID 1508 wrote to memory of 376	1508	msedge.exe	89
PID 1508 wrote to memory of 376	1508	msedge.exe	89
PID 1508 wrote to memory of 3400	1508	msedge.exe	90
PID 1508 wrote to memory of 3400	1508	msedge.exe	90
PID 1508 wrote to memory of 1428	1508	msedge.exe	91
PID 1508 wrote to memory of 1512	1508	msedge.exe	92
PID 1508 wrote to memory of 1428	1508	msedge.exe	91
PID 1508 wrote to memory of 1428	1508	msedge.exe	91
PID 1508 wrote to memory of 1512	1508	msedge.exe	92
PID 1508 wrote to memory of 1512	1508	msedge.exe	92
PID 1508 wrote to memory of 3316	1508	msedge.exe	93
PID 1508 wrote to memory of 3316	1508	msedge.exe	93
PID 1508 wrote to memory of 3316	1508	msedge.exe	93
PID 1508 wrote to memory of 4984	1508	msedge.exe	94
PID 1508 wrote to memory of 4984	1508	msedge.exe	94
PID 1508 wrote to memory of 4984	1508	msedge.exe	94
PID 1508 wrote to memory of 3120	1508	msedge.exe	98
PID 1508 wrote to memory of 3120	1508	msedge.exe	98
PID 1508 wrote to memory of 4056	1508	msedge.exe	99
PID 1508 wrote to memory of 4056	1508	msedge.exe	99
PID 1508 wrote to memory of 1340	1508	msedge.exe	101
PID 1508 wrote to memory of 2516	1508	msedge.exe	102
PID 1508 wrote to memory of 1340	1508	msedge.exe	101
PID 1508 wrote to memory of 2516	1508	msedge.exe	102
PID 1508 wrote to memory of 2516	1508	msedge.exe	102
PID 1508 wrote to memory of 1588	1508	msedge.exe	103
PID 1508 wrote to memory of 3768	1508	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cyberleek.info/up/CyberLeekLuncher.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7fffe1c8c188,0x7fffe1c8c194,0x7fffe1c8c1a0
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,15856887058746107386,12504456522198799480,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8408478736371908980,9782993546594920053,262144 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,1430928143122911614,11285431315160440443,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,10136244380178053632,8777682968424305630,2097152 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,9432459292138332936,3519907507285923854,2097152 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11642029941796263606,18055292773076037784,2097152 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,2883107780629786159,18156631968384496237,2097152 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,14960942784513124756,11693582459435072389,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,6946036183030809289,5672021664445174437,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,16289225347677386974,14159404573934885536,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5648,i,15539779076766469482,17593937775985130134,2097152 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3188196454834454997,9569417682983612722,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6392231473924440082,9212740947363892726,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6392231473924440082,9212740947363892726,524288 --field-trial-handle=2240,i,5615697307192181663,1519193374686343656,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec8f92a3d8d1403ec9e58dc7556a94b133fd4e7639f5789f82c2675434491c96
MD5 c0458a642c1d1e665e048b83ae95b2be
SHA1 c200c38c9b47f6c78be5e6efded8b58eb527149a
SHA512 3bf0e79fd8c08d489f1993db08659cf0dd61ff9aa9e7990fceaab1a47c80f86f60ea44e227b4dddd1a1918fb36ef6b1dcd56bb99053974d6e771afafcbbf7398
TLSH
T1AA6191380F8601A4FBA2037157D1D252B47D86E7FC93DE96D3B009F44BF57228A1978A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5892d5.TMP
Size 3KB
SHA256 868091931ca7094e37401332e96d47647da78ec439bffa2edfbc6ef5fd7f7052
MD5 a0dfcb02f75b54d8f3b3eaa0693bca96
SHA1 36e59d280a44f74ccd61066edd496e5a0534e08b
SHA512 f9188e87a0c40d049163525643e0866f5141777e1ca6634ee7fc6c37dfacf11404f9294b6619697e2e4824c59b4328bd44b11bfaedf0ec4602c0205443a87e78
TLSH
T1936170380F8605A4FB62037197D1C252B47D86E7FC93DE56E3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2109086ef6013446ceeb50e702db580762e835098117306db1aabcaca1cae09c
MD5 2bdfef31c28f558149ed9bb4b34541bd
SHA1 d766b87ec25518f6db912beacbb5506604b450ed
SHA512 7b9e477d65b4f3546ef1dc3abc4b6ff8fac9703a1a8369ba22458ba6fb3c08351c7ef10e5ae7efe706096842ee4ceab37b5b7c816b13d18fa4b85fb1d628d11d
SSDEEP 192:sxZWROyM/jK1Ml8M9C/fEsLEb1LIdpJHW6+WNGYzczTiIgrJ:sxZWM1C/fEsLEbaJHbG89
TLSH
T1FB42F7116B34A9B7CCDBD209FA557F53D6F9147392901E44AAFCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 55bce4f6502836b24421812edc0575c1418e5027be4fa1b1e543ad7011cbcc72
MD5 6f6040c749a013872069e9119404e269
SHA1 7d46b089151fbd8265f07c489708ba10789504bb
SHA512 174ff2550d1279cc20702d2685c46826f0cf0cf3e4a557ebba160688ab8a9b26f8c95d936937cd0326526454835694ecc197aba28c0da1d7578c5109f3636488
SSDEEP 768:8rW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjXroIyiyYS:8rW7kf0Wvqidau1jaa5LA3jEOS
TLSH
T1F1D20B3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 761579ea627185016b802c970e2fd7eb6cdc8134da82af1e907d726203063bc2
MD5 c92721073d0a62cd9cd09db2d37bee2f
SHA1 ef209364d6d14b4a3da5d0a681da5368225d642d
SHA512 6492dc7d71f0bea130f148a7a1c3b94cf3c80aa7295b1d211a298c035a1c1fdd66320ccc873e92bd0efdb203a07dbf8cf1180a842c26d582b3181905878d358d
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzkw:s2F6JN
TLSH
T17DD1500AB0364601387D389DB2A78A365F4675A3751CA4EF7FB900A60D67E210DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e2dd2d780d6b96f59f308473d709874514c123b0a8cc355a0d43c9ae1348cb92
MD5 94894b3fa81008f8e99c13548039535f
SHA1 cc79f7a3a1b0f9b0ada888162c091b570748b412
SHA512 20281349cec325d9a26e4068fec4cb88e3fe241af1a3d26bbff6645dcf15d001cbc0811e3ded6d31e598082b122647e1139740bfd1e25639dd0c73ea0bc384f3
SSDEEP 384:4ZcIhsNFIsbPX2u7dEh+CEJrbpsAkMf1eKQ:GhubvWuhbpeMTQ
TLSH
T152828D715C756D2BADA7A141F8CA3A035FFC41379AC86F50E6F8EB1C01EE678130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46e76b472100ae135f70b3036ae9cf662d368e20b1de263e0d41fce4f8286b0f
MD5 b89481b5254b431a3053bec6f74f277a
SHA1 b1cfa5bdf6bc6b76413221421bf6dfee559e77b6
SHA512 1185339f9ed75d2cac8866831c9c51dee1fb03c02ba1691f9c36bbea071ec1956f1098ee51a3d2ffb0732f3b6d22a20631c56275e66b13c11805b99154c73ffb
SSDEEP 192:MON/64BAQmiUyk1LW5GBPKlt+FdG8PohIaDKqU6:MON/6eA7FWAdEhx9U6
TLSH
T19102F9346D796C6B9EB2AE45F48637175FE8103BE6846F44EAE85B0C00AB75C2343427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0db0650b54118e11ede4e76163f9297ddf07f6e373807e972e6bf2ee02eb9f29
MD5 abdaeddfd8689eeb8ec1242c9f8e4dfd
SHA1 9ee04df23feffa01bf2d531be439283fab2df615
SHA512 7644cf2097d9d8069432e4e168edba612648431d33e50fd03c3a135837aa4f6a4c13fb956be9307f2bbb37ffd9287070352ea8804c4775302b85e5f7e860763a
SSDEEP 192:FONY64BKQmiUynLp5GBPKlt+FdG8PohrGFC1SJr6WwaqRU6:FONY6eGSpAdEh+CEJr4pU6
TLSH
T16F1219356C75AC6B9DA2A191F48736039FE84137EA857F50F6EC6B1C01EF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4ed6ba64ebcfc6d88b23971971a3e0e9252c72cb517a20ba48e2b5e876edf002
MD5 1e453b17c1c01ca058b9d25847fe0bd7
SHA1 30a978b3608a7fbc3036f907bb7dc1dc1daa5b43
SHA512 e37df463b48f82f9cd3babd9b6f909e2400c6a29284edf536f74baf64aec881a97663e3893cacdf1507a36231b19609e4d98f879efb31d75305d6599978cae00
TLSH
T1E141D35CA6EE1148B3B77F59ABF2A96E447BBC772E0B946D40150D4E0B62B40C861733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads