50e89f503062540de74cb9dd4b795a101e5dbffd9383d3cacfd179b8813f9e3b

Analysis

user interaction
yes
max time kernel
21s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 3KB
Sample260901-148ytasvhw
SHA256 50e89f503062540de74cb9dd4b795a101e5dbffd9383d3cacfd179b8813f9e3b
MD5 f15debe9b0285a9819c823449c27a24b
SHA1 4f3c1319f90eeccc71a6687b2eb93e880cb21e8b
SHA512 ca6e13883fe8125be21eff7543e0301891875a7b9a6f4d272d6abefddcd813fc6db7fd794f0944de4c5f230c41f0a306229ed8d8715f1190740a549ab44140df
TLSH
T13F811072A0C0693F5033C6CEB4593795F896D407DB89248177BE53AB6FB2D90A40749F
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327744195874814"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B524D6C6-2123-4FEB-B961-984D31ADA5CB}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4656	3696	msedge.exe	87
PID 3696 wrote to memory of 2040	3696	msedge.exe	89
PID 3696 wrote to memory of 1636	3696	msedge.exe	90
PID 3696 wrote to memory of 2040	3696	msedge.exe	89
PID 3696 wrote to memory of 2040	3696	msedge.exe	89
PID 3696 wrote to memory of 1080	3696	msedge.exe	91
PID 3696 wrote to memory of 1080	3696	msedge.exe	91
PID 3696 wrote to memory of 3324	3696	msedge.exe	92
PID 3696 wrote to memory of 4900	3696	msedge.exe	93
PID 3696 wrote to memory of 3324	3696	msedge.exe	92
PID 3696 wrote to memory of 3324	3696	msedge.exe	92
PID 3696 wrote to memory of 4900	3696	msedge.exe	93
PID 3696 wrote to memory of 4900	3696	msedge.exe	93
PID 3696 wrote to memory of 4628	3696	msedge.exe	94
PID 3696 wrote to memory of 3792	3696	msedge.exe	95
PID 3696 wrote to memory of 4628	3696	msedge.exe	94
PID 3696 wrote to memory of 4628	3696	msedge.exe	94
PID 3696 wrote to memory of 3792	3696	msedge.exe	95
PID 3696 wrote to memory of 3792	3696	msedge.exe	95
PID 3696 wrote to memory of 3600	3696	msedge.exe	100
PID 3696 wrote to memory of 3600	3696	msedge.exe	100
PID 3696 wrote to memory of 3500	3696	msedge.exe	101
PID 3696 wrote to memory of 3500	3696	msedge.exe	101
PID 3696 wrote to memory of 4756	3696	msedge.exe	103
PID 3696 wrote to memory of 1340	3696	msedge.exe	108
PID 3696 wrote to memory of 1340	3696	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fffe1c8c188,0x7fffe1c8c194,0x7fffe1c8c1a0
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,2351107760665557274,6584836015094959874,262144 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4950856759940993347,17071073071021641470,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,14473365327256292638,7818297873137913781,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1756788901870810659,7194881415112207771,2097152 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17300553274925477709,18183679021469737705,2097152 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,15327065813111169796,5252376631889711949,2097152 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6674189884645781406,16426277512582766780,2097152 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,7139056287669984754,1992096060591010870,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4391029132159710513,1935527788948840499,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,17520522190230896686,8549835474326684156,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,17520522190230896686,8549835474326684156,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3455158020556853974,17657978398110191003,524288 --field-trial-handle=2976,i,15374661510532012390,11388639270872098626,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a194f2f8a038fed406694b4a2d29f69e56536827b3d538f15b1d6be975ddb13
MD5 c47b952eba032951b7b54ac3c431bf68
SHA1 6f9cab98273d2ffd7435498ba39996eeeb2fc78d
SHA512 e5cfae5bc3b16e0617080ed01a09d257c8688443c58ff8e31afb09c3afcab1bcece041e69d050ad0c0cc1c456256424932c0d48b57245d3a7f6e58942921e72a
TLSH
T19E6180380F8A05A4FBA2037157D1C252B47D86E7FC93DE56D3B009F44BF57228A1974A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5892b6.TMP
Size 3KB
SHA256 69fe648495e0c74d8f14f28584908f46e9c903be9be8c59cb964b48a5ba230c0
MD5 25db217de9a1bfc3efe274a2710b1dc7
SHA1 73c9ce545531abaf0e0b6d3beffd4319ddd35606
SHA512 2ae49ded8d41f932fc612b98746c1690531c556b7e34333fadf772411dbf2e56614296236f21c6d4c96e46360a70d03e1051239db8f94455cc27a583dc81ce75
TLSH
T1166180380F8601A4FB62037297D1C252B47D86E7FC93DE56E3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 728416d3370bb475dcd949b59cb38fcc1db84ade0098ec8d12bf3bb0c5758265
MD5 5fc4174fd6918920d1fac06520abf480
SHA1 beaf3d999e87b76754e620cc548d2f684c8477ae
SHA512 e9d4637792313eb3c5714d67b65b09ab5f184a3419902ca3b866edd41bc0b9d9ffd43f6236d3f735e15395c81f8fdd31ced6e356bd17c8f773d27d5058b62524
SSDEEP 192:sxZERgyM/jK1Ml8M94/fSswEMVIdpdTHW6+WNGYzQsLxIgrJ:sxZEi14/fSswEVVHbGy9
TLSH
T11A42C6116B34A97BCCCBD20DFA557B53D6F5147392950E48AAFC8A1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a2578e86fb1b5f8189a95501fc5e390dbc850a491ced71c653337a2e97e5eae9
MD5 cf538e1d1833cc2b28359e005f768883
SHA1 a43cd5c200fcc664b8355925b6113d89de16633e
SHA512 c81dbc317cdd2d8de1de9a89bb878a7911a8806db655e01c3b52a18467c9f4f30e6b4102579ac5192e49fcdb97840189157f5d882b6a2867b3e105325d06050a
SSDEEP 768:n2W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj4roIUiGYV:n2W7kf0Wvqidau1jaa5LA3jD0V
TLSH
T1B1D20B3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9c6640f947614b6f297cfcc53b3938d21c05a9405239eb6205dd87db8fa89a14
MD5 09960d23b42213adb2b3d01c1e30a0d5
SHA1 6f4dfe3420985f11d7c9430af93faa783446347c
SHA512 dc413efcbb50a5bd7244a6cf33380b5efbf28b6f87b8295d1cfd68b933c10df95b3ce097d9ae5bb286f171b21ffc0ff1ad1dcf2d643c0f74e9ac40a89c4dbc81
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzkI+da+Qwl:s2F6JJ+da+Qwl
TLSH
T1F0D1320A70364601387D3C99B2A78A365F4676A3751CA4EF7FB900A60D67E210DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a946a19cf98af9c2dd7cf69265599877c0ac58ccd88fbfcded7111230af173ad
MD5 6cb4ad422c7267ad2bc0aa07aca4863d
SHA1 262192d577d775489906495f9270dbc0ea121cc0
SHA512 fbeb25af455bb190a5ffb5d07b081b9281dbf59973400206b087c87bf72cb3e26ab0c9dfafc407ab41cae997dfaac71eede289ccb637a829ceb548970a10e749
SSDEEP 384:5ZcIhsNJJp6eB0NCby/Z7dEh+CEJrYY0X1puLaGJo7:Rhq0QQVWuhYYsyLFM
TLSH
T1AD828E715DB45C7B59B1E185F58B37078FF88037A6C86A84F6EDE70C01EA6A9130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c58e243b4c7bde6f22d75c614bdab6026bb8259f8f0102af8316432a38e29ce1
MD5 e7a228d549b5604b9187869b5deb945a
SHA1 59addc01bde1647512103a057d6a85f777371d2f
SHA512 59dc9a64de1649ead90325a1214a69b9a906e2191fb21004fe2bf1f6ce7ba27129aee8f49ea3ceca542c972baa8f21e0c74ea0f0bf509c32d6a1e8162dd05615
SSDEEP 192:MON/64BAQmiUy918W5GBPKlt+FdG8PohIaD0qU6:MON/6eAS2WAdEhxHU6
TLSH
T15502F9346C796C7B9EB2AE45F88737175FE8113BE6856B44EAE85B0C00A775C234342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e29d1dbfcfb204ec84eef08555f6da8bcd20ace4022228b7fdf3614b395c64a9
MD5 b1b8457ff8abd4f3f8bff475f5b1b953
SHA1 4fbb33c18dc00b18a5b6dc64ddb73ee107fcaef2
SHA512 07f3fb456d9a49295579bb205e809f09c42f583063fc184b211f719c15378058712f057df872eb11cd3aa8d7a9ee5410bc3a8f09a01a0b6697fe5575ced2c759
SSDEEP 192:zONs64BgQmiUyk8b5GBPKlt+FdG8PohrGFC1SJr8WwwqOU6:zONs6egybAdEh+CEJrSYU6
TLSH
T111120A356C756C3B9EA2B545F48736039FE8413BEA856B44E6EC6B1C01EF7AC2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9817c8ec20f707aa639bbb3bfb206d7781344a0832377f17d474e02605ea6861
MD5 d1227050e537de0e42c3cd0d3bbe0a42
SHA1 56d81955b3bfce8fd6ead2c4ecccd3ed8626761f
SHA512 0b45f039ee8e36644e25b2fdf0686432ac6f934f5b835d6db65439c2d3e76870dafd62803771bc410071e027830f92f44daa1c98b6d03dc91461e1d46e9b7430
TLSH
T12841F958B6E91158B3B76F5A9BF3682D497BBC772E07D49D00110D4F4A62A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads