bf8bebace017c35f6f1ce83cece94c1189fa04506d82c29ff73280367523c9d7

Analysis

user interaction
yes
max time kernel
70s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
profile.html
Size 94KB
Sample260909-bddbsaam91
SHA256 bf8bebace017c35f6f1ce83cece94c1189fa04506d82c29ff73280367523c9d7
MD5 7968ccd50f90ab09fa9aca07aaefe996
SHA1 3026f96d176b4e2819b228c7bbca15204b4c07b2
SHA512 e9777eca93550b2d328dc51713048c7353e9d02c4d2d9704f3da1a3a00de1580591ca5518f17066dd1bfd30af6b0f29b9bc373011fb521445140c59c27e840a3
SSDEEP 1536:oIsXuO2NRZVtBUgwUlmmpH1tUF+NW3szoG:1sXuFts8D
TLSH
T1BE9365A3BBB4E433E44F97F5B010AA04C542E657C909D9C4F0ECB7742F99AE26E43952
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333892908625778"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{049D1093-A4BB-46B3-AB84-95A7089FFA98}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2032	3440	msedge.exe	85
PID 3440 wrote to memory of 4596	3440	msedge.exe	86
PID 3440 wrote to memory of 5108	3440	msedge.exe	87
PID 3440 wrote to memory of 5108	3440	msedge.exe	87
PID 3440 wrote to memory of 5108	3440	msedge.exe	87
PID 3440 wrote to memory of 2496	3440	msedge.exe	88
PID 3440 wrote to memory of 2496	3440	msedge.exe	88
PID 3440 wrote to memory of 4400	3440	msedge.exe	89
PID 3440 wrote to memory of 1436	3440	msedge.exe	90
PID 3440 wrote to memory of 4400	3440	msedge.exe	89
PID 3440 wrote to memory of 4400	3440	msedge.exe	89
PID 3440 wrote to memory of 1436	3440	msedge.exe	90
PID 3440 wrote to memory of 1436	3440	msedge.exe	90
PID 3440 wrote to memory of 4608	3440	msedge.exe	92
PID 3440 wrote to memory of 4552	3440	msedge.exe	93
PID 3440 wrote to memory of 4608	3440	msedge.exe	92
PID 3440 wrote to memory of 4608	3440	msedge.exe	92
PID 3440 wrote to memory of 4552	3440	msedge.exe	93
PID 3440 wrote to memory of 4552	3440	msedge.exe	93
PID 3440 wrote to memory of 1188	3440	msedge.exe	97
PID 3440 wrote to memory of 4936	3440	msedge.exe	98
PID 3440 wrote to memory of 1188	3440	msedge.exe	97
PID 3440 wrote to memory of 4936	3440	msedge.exe	98
PID 3440 wrote to memory of 4248	3440	msedge.exe	100
PID 3440 wrote to memory of 1320	3440	msedge.exe	109
PID 3440 wrote to memory of 1320	3440	msedge.exe	109
PID 3440 wrote to memory of 1320	3440	msedge.exe	109
PID 3440 wrote to memory of 4016	3440	msedge.exe	111
PID 3440 wrote to memory of 1684	3440	msedge.exe	112
PID 3440 wrote to memory of 2168	3440	msedge.exe	113
PID 3440 wrote to memory of 3024	3440	msedge.exe	115
PID 3440 wrote to memory of 3024	3440	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\profile.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffe590ac188,0x7ffe590ac194,0x7ffe590ac1a0
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17671594065644201499,1225135519646962181,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2593908119879150234,10275995628376683900,262144 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,13892871015919956261,11806619782932257267,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13313480068082389185,13868758287033396191,2097152 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,389075486350595364,9712527803137278301,2097152 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,9231196521360350648,11240701750627158423,2097152 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3667675811633188087,3958609867853101866,2097152 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,8106218324968138084,15007586914853806387,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15421618229291882596,13488862917537285407,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7294405548466994900,11372745441110402046,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7294405548466994900,11372745441110402046,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6268,i,11464974275319764877,11535501874282152802,2097152 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,11418018548747745959,13181896322964701663,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,543004888567598575,10881382347335775114,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,1207124634121778189,14273888104945277363,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,3479703684840737484,16581626698227542418,524288 --field-trial-handle=2228,i,13224859396500252776,15325145079807931488,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0482d4b1bbb68edc2348c6efd1cd076bd25e71098b329c0c23b7e5e5895158a3
MD5 a3c66bcb4d8a6e58602d27b359d3ff40
SHA1 41d643a3dd15caaf5e74d0bf496cf855eba0ff85
SHA512 f71cf9d5d5ae397d6e2a3950848d774f88f81d8bd186de77f21667ebae7944af1302a93c4e754e660f971035fb7c1c9efa69727dba9fd33cde5750cda2fe4260
TLSH
T1A9714B283298158EE3E1F0B2E3D20F4937B44C894E4B6F561360CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a94b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a94b.TMP
Size 3KB
SHA256 b082db9607070d3676a41452b5517f0ff0e709c66448fa27dbc6448da4fe75ce
MD5 62077f03e964c8ae51eaf32ded6cca9e
SHA1 b382f6b1e3fa94ed728989d53e47784266b59273
SHA512 2959a94e23b5b2b8151172c92b3b238463b0660e13411bd3473945da413b74885112fd02d25fb2545a2765e5f8c84c27fcabd464802220e60ec4a35756500ef6
TLSH
T1D0712B283299158EE3E1F0B2E7E20F4937B44C895E4B5F561364CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d9480944ad8de3db41ca3ce613072ec317f3e98eaa29f24f35a6b1e9ae5fed7c
MD5 24212a6ac7c5604e6d13d30f8b2c9fb6
SHA1 aef7db18d62277597b252e1db212aec9f0545e06
SHA512 7c9d80265edf8219ab46fb3d9cc6d50a902f93240c4289bde5cdbdcad69527fa53968fd1dc636f1d5c38b6c3e55a415f4a35502a8d8c716c99e6ff50caa69813
SSDEEP 192:sxZdRHyM/jK1Ml8MWP/fpsS3IdpdSHW6+WNGY4wYI+BIgrJ:sxZdJuP/fpsSYUHbGM49
TLSH
T1D942D811AA34697BCCDBD20DFA557F53D6F9147392900D44A9FCCA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8efda60e92b37d76844b4a41a39e3f78be718db18218d8a77b81eef6c6b76dd4
MD5 40efc1776ccbd85b9262ba1f352b5466
SHA1 e605a6324dfc356cf1fd00371f8f92aa8ebc2f6e
SHA512 c24f4dba9920618b144d078a39fc0b0b2d8dde7f10096783eec5a25e5a01c7e0c16032932b61e31f6b20d1153749e225a08fd05554eb0f0f4975d90fa47b0d06
SSDEEP 768:SEnH8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdnMro4kMUnV:3H8iJPNWvx76ru1jahALocdX4UV
TLSH
T144D2FA3B680CCB7E4F844E9CEC266F966DD801CB5A988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6ac78d267f2de983ffdec5f3c34d8bb5d8ed388660872c24ca808ed8049aad0e
MD5 c11ac98a09b6e2705d934493302881d5
SHA1 f9ef41768e0ee473a7e934f4ff79f8e3206c8af1
SHA512 c386ae2c4fd97f559dfa838b9055756c76181b51011e1649cbe0ba37e9174f985c2fa0af2b2a0af8f4552ac917e9352729711734e062878fc2be51e5c76c1482
SSDEEP 96:KUacKL6SqIKKwMuX6OUcsWWc1dMOWKkzMgWwmutwuHT9S3jNTPPW3EGMLPKkeMJd:q3MydP2
TLSH
T12191321172BF0242387FB81CE258971F0A427A573159E52B3BA801724F67E582DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5944df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5944df.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0df3179a32bc4b40e1483e6b1be83ab1a45eef3afc5de6115f7cef56c84cda8b
MD5 e828d3727533fee52ac96cba669df37d
SHA1 e4d831ad32d65cb366c25a607a91304eceb70fc5
SHA512 9c28d2a485398ab17649864f2a36d5534385d10a5148d5632ac1f8d77900a39f6cd560282aeb3be0e972d44cef571f0d4ba8780aaa1f31b1ee3bb2c9833bb32c
SSDEEP 192:u1m+xasuheOwQxMGsNiUtQG+zZmCFQmiU1MyS4k03/irbNPLITqPqva+4LcYLWA+:FZcIhsNiUtn+UUVdkWOpEYsa+VY8GDop
TLSH
T112828D722CB86C7E98F3A241F54772175EB89067E7C86F84C5DDAB1D01DA6D8030781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 05c150b50190b122dbe4057d4a70d81108c89a94abe532323ae7e02255d2c050
MD5 5a29393021146af0bc858b090104056c
SHA1 7868f56911ac07feff953246cf0787a10cb2be06
SHA512 65a1675fa32b49adfe058a0890b8101d6ccb759cc663f5a9a361af4efcbfeef61c3cce3290f5187c10b96d3cf3d446ae317ef901e37ec588e0491cb2291f2bd6
SSDEEP 384:fiFiZcIAsNH8TUNTUlIlAn+UUbdkWOpxYsa+VY8GDop:qFQAawg7/UYhgZQW
TLSH
T18FA26C735CA89C7FADB79B81F94A32139EF490A7D6C8AE94D6D99B1C00DA1D80307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7effeb5aca3991ed137d0fc3e432dff7cc9158f6afa594cd9e0fa8a41388cd4a
MD5 5ed21b88e994ac21940748f8eaa47f79
SHA1 3c1403043e51584fbaaadb50e92ac8058320f47e
SHA512 2574ae7b885747d5eeadda644e31ca41f12f0a309e9e22eb9aaccfcfbaa28fb11ec16fba092b9cedc2e4194807ffeaf98f3f431528a6b14dc098e237cf353b2c
SSDEEP 96:ZqONk7QsjpfmUTmDK5ih/cIPURHl8h4otop5O5DoBhPwivh50xy0SFYKDAxvYebI:gONz6kDfQmiUy4cZ903/i+Qio6aU6
TLSH
T19602F83568787CBB8EA3AE45F48777275FE9213BEAD12F84D9E81A1C00D764C1343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 da1ae5a1f2f4b9b8f4b0ae3791afb67db86b4cbbaf697972c4e20863f2e1295b
MD5 7b85bbfa89f3c286eaff29e9bf1e7815
SHA1 5d6e61bfc4b5d3d739de1324d4cdc86c27698e9c
SHA512 0c2f643d402f461169af94f99ce304ad2a8f0087ea835e9b01495fefe09fff099dd9523a168ac243ef0490ea81f0d33e7c9e6975bafd52271521ebdd14e5a4bd
SSDEEP 192:u8m+xasuheOwQxMGsNiUAQG+zZmCFQmiU1MyS4k03/irbNPLITqPqva+4LcYLWA+:AZcIhsNiUAn+UUVdkWOpEYsa+VY8GDop
TLSH
T10A828D722CB86C7E98F7A281F54772175EB89067E7C86F84C5DDAB1D01DA6D8030781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1863ec16f4d57655e727fd857e7e059a25fc84470c1217da16c67dd4fea4c82e
MD5 06fddce9cf27830d6ed9ce9d4c01bfae
SHA1 e6d1eb1c0b2df0b4b833f2bd471f5c06b61742d4
SHA512 cc3418462af1d2ed38ebd26cce545275b7f4482168a0edd7f661639aff048372cf977d2e56c79ac5fa8e7c2a0a04799069a8020c1170aff1dbb24538b0baed7f
SSDEEP 96:WgqONk4QsjpfmUTKZK5ih/cIPURHl8h4otop5OoDoBLDPwivh50xy0SFYKDAxvY+:gONg6kHQmiUy5c/903/irbNCcRTqPU6
TLSH
T10A12393168B8BC6B9DE3A551F48736179EA45127EBC96F81D6DC2B2C01DB69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10d63838-298b-4b93-93aa-aa3aed14ef22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\10d63838-298b-4b93-93aa-aa3aed14ef22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 66674c1f7c632facdca4bcda7ca3a1aea68715ce98f4930f87d12c7910bb81c2
MD5 eea9b992f277d35d26d3840057efc289
SHA1 32cfc6f031d09d77c62ca98e6497bb8308670fd8
SHA512 848e9edb6b69d09208aed1609b6e39655a73b91a2ea5e878715b8fa296d61fe24f37adb9a8d0a3d3dd2ce80fe771752d7a723753c4034bebc0924267862cd8c8
TLSH
T12B411659B6F91118B3776F199BF7A86E487F78732F07D49E00110D4E0A62B41C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads