hxxp://gbcu[.]org[.]il

Resubmissions

27/08/2026, 04:30

260827-e5bttazanb3

27/08/2026, 04:28

27/08/2026, 04:27

27/08/2026, 04:26

27/08/2026, 04:25

27/08/2026, 04:23

27/08/2026, 02:10

Analysis

user interaction
yes
max time kernel
90s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gbcu.org.il
Sample260827-e336aazamf

Score

9^/10

discovery

Malware Config

Signatures

V12 C2/lure/stage-2 domains, IPs and stage path 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000000433-460.dat	Omegatech_V12_Network_Indicators

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322785522077869"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{89DFC800-7E3B-41D3-9EF7-5B604B8EC788}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2392	2780	msedge.exe	81
PID 2780 wrote to memory of 2616	2780	msedge.exe	83
PID 2780 wrote to memory of 1616	2780	msedge.exe	82
PID 2780 wrote to memory of 2616	2780	msedge.exe	83
PID 2780 wrote to memory of 2616	2780	msedge.exe	83
PID 2780 wrote to memory of 392	2780	msedge.exe	84
PID 2780 wrote to memory of 392	2780	msedge.exe	84
PID 2780 wrote to memory of 1748	2780	msedge.exe	86
PID 2780 wrote to memory of 1748	2780	msedge.exe	86
PID 2780 wrote to memory of 1748	2780	msedge.exe	86
PID 2780 wrote to memory of 3304	2780	msedge.exe	87
PID 2780 wrote to memory of 3304	2780	msedge.exe	87
PID 2780 wrote to memory of 3304	2780	msedge.exe	87
PID 2780 wrote to memory of 1828	2780	msedge.exe	89
PID 2780 wrote to memory of 1828	2780	msedge.exe	89
PID 2780 wrote to memory of 1828	2780	msedge.exe	89
PID 2780 wrote to memory of 1868	2780	msedge.exe	90
PID 2780 wrote to memory of 1868	2780	msedge.exe	90
PID 2780 wrote to memory of 1868	2780	msedge.exe	90
PID 2780 wrote to memory of 4600	2780	msedge.exe	91
PID 2780 wrote to memory of 4600	2780	msedge.exe	91
PID 2780 wrote to memory of 4600	2780	msedge.exe	91
PID 2780 wrote to memory of 2180	2780	msedge.exe	92
PID 2780 wrote to memory of 2180	2780	msedge.exe	92
PID 2780 wrote to memory of 2180	2780	msedge.exe	92
PID 2780 wrote to memory of 2928	2780	msedge.exe	94
PID 2780 wrote to memory of 2928	2780	msedge.exe	94
PID 2780 wrote to memory of 2928	2780	msedge.exe	94
PID 2780 wrote to memory of 1704	2780	msedge.exe	95
PID 2780 wrote to memory of 1664	2780	msedge.exe	96
PID 2780 wrote to memory of 1704	2780	msedge.exe	95
PID 2780 wrote to memory of 1664	2780	msedge.exe	96
PID 2780 wrote to memory of 3344	2780	msedge.exe	97
PID 2780 wrote to memory of 4592	2780	msedge.exe	99
PID 3344 wrote to memory of 4532	3344	msedge.exe	100
PID 2780 wrote to memory of 644	2780	msedge.exe	101
PID 2780 wrote to memory of 2132	2780	msedge.exe	102
PID 2780 wrote to memory of 3320	2780	msedge.exe	103
PID 2780 wrote to memory of 2832	2780	msedge.exe	104
PID 2780 wrote to memory of 2832	2780	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gbcu.org.il
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x2b0,0x7ffa613ec188,0x7ffa613ec194,0x7ffa613ec1a0
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,2934773704450434150,9344400547687615833,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5289827473989953526,10178183967832555150,262144 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,7501349387325602175,4755938247040419526,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,13352148448142791023,7072253699608071322,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,4516870526675689157,2829289903765136378,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,14451933991815282201,10614726599747136296,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,9368105208818305658,9372133816857962060,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,17826146744092785281,12510378974751636250,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4404,i,14689317623383888313,11224041377820054869,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3500,i,7668451438766263719,1504853239133558452,2097152 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,17757019723793159894,15449649509078432191,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:14
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,17846961799729878187,15569335706484239168,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,13455316159194488577,13670909812399652968,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1116
    3⤵
    PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4649894059662195571,16101212415085176721,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4649894059662195571,16101212415085176721,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,10985244755813115657,8484330585094962125,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,11296722113674520061,12128807073757654531,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1771568019002200958,13914035654483545751,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,3721525056718114367,1358097584781304563,524288 --field-trial-handle=2684,i,15189032445648970473,1932251737112033920,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e73b202e6181db8d042be0dbcad25ae56d7c55700473eb867f2f5790d3bae8b
MD5 935a2a72966d845be6e649f502df8d27
SHA1 f1d378fa1720d8c807445e209174a1408c064e46
SHA512 15e08815442544bf0cb5cf3937f301390be9f1075eca865768988d0a8552cbf7115f47dd86f4fcd205e04f85ee79bee8a7e33a1ea4cb1ed4da42d2786aeff8bf
TLSH
T126714009CDD27461FF680235B0F3320333BE829A794F5E562ED048B52F197E25D36448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4bf8bc434c3d323754a2aebad1cebc525a8e999a28793e7f92dcdf2cf926a318
MD5 80154ddc6ab0c6f6c02614ecde34fb04
SHA1 cf402222e36e1219d33225639a68cd70870838a6
SHA512 c4e4fc4bacc3f0b1d0e64b9823c5e3f4c0cecc626dbd2998ec5d95e81cae3f71b703097f9836a1741543db184200a0044f1ed4f5dcd515791057acffd9683760
SSDEEP 96:MuEXPTbTInRKtaPenYqwmJkLqqlTPY0Rn+EXVKDNREjYkMdk4:MfXLYKtaWhyfTPD+EXVKZRE5Mx
TLSH
T158A19116CDD33561FFA42A7A70F33A82327D81A9790F4E961FC068B12F267E28D35044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a553.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a553.TMP
Size 3KB
SHA256 849dcf4ebbf27f445cdac1cb389409a2e3a9c49a8dfc256d890b2947a1a58281
MD5 42d0bbec233a716115815fdf5544cfa5
SHA1 50aa28d85123107b6d03e491928a2329455f2923
SHA512 461ef76f48e096855dd5dcc87bf4165b58b326f153c66847abf2da4b901a8af7b71ac7c486c26b6ff3afce6ec6e57deb70177886a5633435937336a593827eb0
TLSH
T192713019CED27461FF680635B4F3320333BE829A794F5E562ED048B62F197E25D36548
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ed45acc33ffe37fb96cb9d97d10d3a0cd89b131ee3fb51ee907c26b9b0b51cdd
MD5 4870d8d7c9150a7dc02511c7ccce59e6
SHA1 ace7e4b87e9363ed1bb95a4b9f77e7ef09bb38c4
SHA512 9e03c5ed9406b3b25586b5dac46f2738e6d2703be8b44ba81f4c0e6cfafaedd64f45b486d580028ba8adfb853aba49d455871cf8d6f7d73805075bd8962fddc4
TLSH
T167516CB6CBE5961DDB1155F5AB147E1FCE1D1938432838358AE6AF0BE3E28B4E10160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5b37c5e54184a34ecffcc6b8c6731927d41798c5e82eb5937a6d2d331e9771a5
MD5 344cf682ea9a07f0507d21a057564cc8
SHA1 239a6af5eddbadeea6dcd1388bc1e59a89e28fd3
SHA512 47d1261eef4a772a7de27dc5c5e112c77eb763d8839e2c53f5d83c254007dcb31a7bb11e2fb96e10837cf0293cf7f83d43f687cca1cd9e7a5f0ace80ac05c9a4
SSDEEP 192:sxZWRjyM/jK1Ml8MFJ/fIszZC+IIdpso/W6+WN0J2fY05w17oIg5/J:sxZWRdJ/fIszZC+51/bBf55z
TLSH
T18952E711AA746977CCDBD20DFA45BF53D6F9057292901E44AAFCCA1C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 75f44c8fd6216411bafc72e16caaced91e6704200c33e267255fd4e113693e40
MD5 b1ce8c09f819be516e7fe2ad370e52c9
SHA1 154b553891271ba5bfd9e3d5ee870c7ad072c552
SHA512 a52512997bdbdfe2ca997f72f0b2ad41c08914385de8afec68c29ff6d6180bb990f0b8aed3dc1d3fdeccf1d91c8795fc773bec3c30e4a011099b37b3d138e5fd
SSDEEP 192:sxZhRjyM/jK1Ml8MFJ/fIsyZY+lIdpsC/W6+WN0sU/Y05or7oIgrJ:sxZhRdJ/fIsyZY+WH/bc/5p9
TLSH
T16F52F711AA746977CCDBD20DFA55BB53D6F90572D2900E44AAFCCA1C01E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 1fbf70060cd287f0cd0f4b95dd97baa7874607f1b8193a725163a0a9283eccfc
MD5 6059c7e644204605b4b7c78ec2326bbd
SHA1 5503a2b3ddc313cdbfd35c6e4d6981e1e044afef
SHA512 e83c01780ebcee4ab696fc98b5cc4b2164cf56eb057964d3070cb243b77033fd2cad3ba116005b06fdcf2d752c417bb445a5c9849ef35acd38c0b12b62f53052
SSDEEP 768:xUzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hkaro03:xUzXl8pZ221WRmsYQL0u1jaKu/Lpd8hH
TLSH
T13AE21B3F244CCB7E4F844E9CEC266F966ED802CB66984D5447FA494C03C67DB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1fe527ddc4fc33f03b8349906d0925073c61849f8312fdbbc2613a124aa898a4
MD5 08b02cec2b514c663efcb25a9993203b
SHA1 6958dcda18d526f6090e86f86d0836dc3e24b593
SHA512 14d5ca8d80856e08b68682830a734573b2bfd93c4a4db60f23f70d56c86c2d90b9a1c2f9cea69528e9be65cdf12e8430335d3a8dabf9f8bbae67dab5efdeebf8
SSDEEP 96:KokF6+UOSvR6bmjmvKb+jYvvMkTKik6uIK/6CUBIVhTbb+hrClDB+K7LDX+vJBai:IZ3vvs
TLSH
T10591048271BA12232C7D350C829687174E4277B37258FC3B7BA815BA5D66E521CFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97acd2ac-5836-420a-9acc-0e8a73d73628.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\97acd2ac-5836-420a-9acc-0e8a73d73628.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 92a71c7a7e059435f9e92454ea302e05a97e25997429cdd2593ea23acec65d80
MD5 c28cdf6ec3e09acf65d3138fe613a846
SHA1 0dd8279041b18b627afb81c8be6ffa70866489a7
SHA512 18bbc6cc16d247a1db879319454bbf7f54c395f1a1e574577e580509de7468f92bffd54d1a34f77f48dc2bdfff43685ad4ba621191cf39dc68fe3fa3b2bf5abd
SSDEEP 384:ZZcIh8NyO5F1iEnNLfuK/Kd++2DctXr65hueSZ:xhIHh//lQtb65hiZ
TLSH
T13A827D325CF85C3A8CB6E558F88736074EB89067D7D86F95C5FCAB1C05DA5A8130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7e6c5b52e4cc5b6f49db501f1c09ce953a9df9642e2839aa567eb3e55c316d92
MD5 410cbc2c3799f6413a9909aa30a07c14
SHA1 1572892eea0b45902989cb1ad6e8851f3dbb1b1d
SHA512 c2cf85f02c4da5904caf367f3dd8635f65a158d836fbfb06b63c9bf075d4ab4f8567b23b3158367853354042db735e76431b3fae9f46675ab85bd759ff8dbe2c
SSDEEP 384:GiFiZcIy8NK8TUNTUlIlR5F1iEnrefuK/Kd++2DWZXr65hueSZ:tFQyzwgDIh//l6Zb65hiZ
TLSH
T16CC219F248D7883AD9AD9B47BB7E2D034DBCD063B6846A51B3D85A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f02e4db311b6597c31fe245657af1af5df0b12af3906ee8cd80d85d82412832f
MD5 83ee48abebc67b5cb083aac79c369c84
SHA1 c3c2210e6d950932ce1a609df77686a658d90d42
SHA512 12bb02ecc88c53d0f937fae1020fefb8d9260ac8c9adfcf700f2448d116eb5a779aec745fe05cb123ce576b756f4a406e7772572148a9cb7e45fdff9473aa7a6
SSDEEP 384:lZcIh8NyR5F1iEnNefuK/Kd++2DctXr65hueSZ:dh3Kh//lQtb65hiZ
TLSH
T1C0828D325CF85C3A8CB6E558F88776074EB89027D7D86F55C6FCAB0D05DA5A8130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b15f0badfccf2f850f387c5946d042e0d43b884e10b5f260d816ba2aafbe45aa
MD5 fc5eaa5aeb643ed23548a746a8695cec
SHA1 cd55e2a9b42e6e6e1f8c2f1d6c6c8652093be493
SHA512 66d30f31df18b43e327c7c210887c8b44b2be2ecad1eb2259364b22efc4bbf81156d82c790357708d2c77afa8c4fef4fead635a69793673f2155bd17d9b4d021
SSDEEP 192:7GNc6fNNQmiUySzHIPL/GPTUXRgfV7qT4U6:7GNc61L9zoPL/KfUsU6
TLSH
T1E5020935ACA86C7B8EE3AE59F9873B179FA5206B9A951F44C6E42F0C00D759C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 850d75f08c6cb9866d4bb8903d0aae86d7c9291f56198038719be0d171a6c61c
MD5 97aa82ed43494a1b72c13ec08fae3e30
SHA1 5055e641fdc1f6c2b9ee4aef8b6cd544c3f15faa
SHA512 de6124b3edca8a058ef1c5db6e9c3b79ec97a03c847fc1a899d8f30c12101a1fb16a818269528f2a0508e78110b009fbf722746d08cb49bde3a99f05e354d78a
SSDEEP 192:+GNz6fN1QmiUyASIiL/GPTUXRgd++2DkV3ZrqgrU6:+GNz61ThxiL/Kd++2DkLXrU6
TLSH
T1C7120935A8E8AC3B8DD2A568F44736179EB51167DBC96F54C6EC3B1C01DF5AC230B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21392d1f0bdc45b2b70f0af5df6a7010e8263d97f7453efbc7ccc6c862ec82fc
MD5 51492683356c378e6a4519beb76e54eb
SHA1 8c2268a90950ae5f74f1fd1ecc9efab9ef9fc5a2
SHA512 f8eb5bce38a37f64051767c093a82f11545904e3b29039c23358bbb8eb3f431c1c5d9966185223d98c9892209b15050156fa26b90d8edc44e0250e6996f39f13
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58b428.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b428.TMP
Size 392B
SHA256 e346b3b0238f2ed80b8ab9246e27adfa5ca934c57a2915b7b737d0a5861bf7d6
MD5 c412f750c3ce58560c9c7b83ac65c869
SHA1 e750304b732cf111c864acf19f12c22763cfb635
SHA512 2d8b6db2cc68dc0ea2e52de1e21334a93161f74bfacf5a33323ac8f8153c740aea4c2fbe8acba9ffb776874841629b0835f7f4fc80cbeae06a16c1bb82e6a336
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads