hxxps://www[.]neothane[.]com

Analysis

user interaction
yes
max time kernel
74s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.neothane.com
Sample260909-sp1d5axdkf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
748	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334407366691939"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{29ACE636-DF19-4D42-BF60-4F27D3AB3159}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 976	4152	msedge.exe	86
PID 4152 wrote to memory of 748	4152	msedge.exe	87
PID 4152 wrote to memory of 1368	4152	msedge.exe	88
PID 4152 wrote to memory of 1368	4152	msedge.exe	88
PID 4152 wrote to memory of 1368	4152	msedge.exe	88
PID 4152 wrote to memory of 3460	4152	msedge.exe	89
PID 4152 wrote to memory of 3460	4152	msedge.exe	89
PID 4152 wrote to memory of 1796	4152	msedge.exe	91
PID 4152 wrote to memory of 1796	4152	msedge.exe	91
PID 4152 wrote to memory of 1796	4152	msedge.exe	91
PID 4152 wrote to memory of 1664	4152	msedge.exe	92
PID 4152 wrote to memory of 1664	4152	msedge.exe	92
PID 4152 wrote to memory of 1664	4152	msedge.exe	92
PID 4152 wrote to memory of 4844	4152	msedge.exe	93
PID 4152 wrote to memory of 4844	4152	msedge.exe	93
PID 4152 wrote to memory of 4844	4152	msedge.exe	93
PID 4152 wrote to memory of 4364	4152	msedge.exe	94
PID 4152 wrote to memory of 4364	4152	msedge.exe	94
PID 4152 wrote to memory of 4364	4152	msedge.exe	94
PID 4152 wrote to memory of 3276	4152	msedge.exe	97
PID 4152 wrote to memory of 3276	4152	msedge.exe	97
PID 4152 wrote to memory of 3276	4152	msedge.exe	97
PID 4152 wrote to memory of 4948	4152	msedge.exe	98
PID 4152 wrote to memory of 3396	4152	msedge.exe	99
PID 4152 wrote to memory of 4948	4152	msedge.exe	98
PID 4152 wrote to memory of 3396	4152	msedge.exe	99
PID 4152 wrote to memory of 2448	4152	msedge.exe	101
PID 4152 wrote to memory of 1096	4152	msedge.exe	112
PID 4152 wrote to memory of 2972	4152	msedge.exe	113
PID 4152 wrote to memory of 2136	4152	msedge.exe	114
PID 4152 wrote to memory of 4032	4152	msedge.exe	116
PID 4152 wrote to memory of 4032	4152	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.neothane.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,9646950673958474357,9114000700641469114,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,3209859382288849274,9197668878069091115,262144 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,4420697564809203604,3495754063108715238,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2701885359133347150,6973944271295225385,2097152 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,7956796684192761795,6697961747999035903,2097152 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,12508317254290560416,16766117167044204772,2097152 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7377115296752531494,4371663101826980182,2097152 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,14313151493217450340,2122941526664946550,2097152 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,10256493644280411188,12538949181660016310,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11969459678159723204,11231008165393600154,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13625996472466173790,1421818789894398502,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13625996472466173790,1421818789894398502,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,14513517507927439761,12371197153196175498,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,14540914242761821694,9262808191851687536,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,1190892108593671266,4500457411844524940,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,13643967386629844387,5724955953048085599,524288 --field-trial-handle=2140,i,7638093146893122327,13014587883921705631,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 85KB
SHA256 4102993da7514af07356b7dd6559cfe6405a06053268e38bc24bc9ec2e4843d0
MD5 c185f31fb44b91683689528eec05d4e8
SHA1 17929d2161478d25812a99384640e3e69d521dae
SHA512 0397c0711919473c1013fc19371ebc7aa4fd9d48ad702921b0719851083297a84f85bda6c5fcbfe6884baccfe70af0212d27000732d320ec5a735dd0d262d74a
SSDEEP 1536:R1fXv1XH24FrRo1SGXqaTAxbMWw1tbvT9WuAaW1LAH46vuEt:hXW4dS1W8AxbMWStv9IaWlavuEt
TLSH
T1868302AC6C8C567380339781675CD5301413D948F869B9DB2AE3373197E8B2A2B339F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e4ca22b834e6a5fb4398f8c2f901c17e4f0cca1266f0490e1b83172ae9ecb850
MD5 f517268eed4a949bba9a1d4ae2a7dac5
SHA1 8e38579f8e85d10f7c17a3607a5320a56e1ce7ec
SHA512 95840bfa8d44929f84d5282004223a9fcf647fbfed287100808553f95244f8bd50ed31d522dee9bd5ccd2bf8c6e553a48c1c15f78c049ec77a6ea9b92a50aeae
SSDEEP 192:DMCPMfMQeM1MvMrMqMCMDMwMVeMKM4MpeMKMWuMUxMgMJV6MArUMBGgMzMk4MB1f:DfPWDe4gIhpeTsebHqeB9uRxJAV6zrUx
TLSH
T1041203F3C7E49E2DDC2152F0A61A6E1FCE1E091593287C2EC9E59F4BA7E1071E60194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cb28c57efe4a784e76e013798b1a9d64a7620ce4e594f5ea1db989b9029d3399
MD5 769a22b95ce2ef3d039bb98058b0403a
SHA1 2d33e74c21f98517fb66fec997ccb475f97034a9
SHA512 1f82c3cd7d0cce0a8e910dac3836ab62d783c3616c7e87b61db5ce57bbd476f343967d4096ef1f02e2b1b4b03c205014f56fbaf663b95ee3060ede8012b97b09
SSDEEP 192:sxZKR9yM/jK1Ml8MWK/fJsKTIdpsiHW6+WNATP/YHiDQJIgrJ:sxZK/uK/fJsKMXHb6/s9
TLSH
T1BB4208126A346977CCDBD309BA557F53D6F90532A2910E44A9FCCA1C04EABED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 87ce085b8a083081d114570e8c9b109d637cff72f4a144c3785b893c72c03003
MD5 87791fcb2d597e3e591514dd92d8df3e
SHA1 e6ec1b169b087ee8a628956ce4e6059aba2e7e5e
SHA512 521df0f9d86d5743389d4dc9d724dabbf928903bba58f47ff9fbb7206b58212a203f377ca06d68b3a5a681df5b0976c91b5920c0d827029b040b6f4562ee459c
SSDEEP 768:yJUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RTroVs0f:yJUZYTMWvg0Pou1ja7eLZmRgxf
TLSH
T12AD20B2F280CCB7E4F844E5DEC266F863ED801CB5A584D5447EA894C03CB2EF112B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 7537ad7f99707b146a382d023b9de685ae34106559b6fd7d77f596bcb6a5df62
MD5 85fc731b2349055630e32b58fd2c6450
SHA1 6ec07cfd12138b833aaff62e6c7bc40efa09328f
SHA512 6dfb95850feddd05242a4a54386ae2fd2b6cb559a8eb330766d5e08109f1d54af6906a4c48b5a29b4adee75e7fd6b0063cbd1ce05ab8cc193df217879bf05570
SSDEEP 96:KA1eK2A8e8KziWa+EKLqUy8K7iSiKkKf6E:EWDXgfnz
TLSH
T1D5D1099671BAC2513D7F2B088794C75A8E8173633418E52B3BAC40B65E27E249DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 78B
SHA256 772a1c7f48aa5bc47eba3a5e244b72f13f547c53b4c3a23c42a5d80f90aa0e29
MD5 1a5c9a8c52954b0aedaeb72155c68c93
SHA1 59e3cbcbe2e20c98683bcba93b44ea4000c64efb
SHA512 02ce26bf4b906f4f6995a42fd202d26940448dc9866062cb54daaf4543008b28a03ed01196e94a5f4a16fd0aa9967b2dfc6588abcfcb226815a7623648cbc608
TLSH
T1C8A001B7281481DA5AB1A8E82025B21DE14B829D8CC0CDF09858A0422628A7211028A5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 ecf6928762504f1589bb07589540750ee1b59de7d9e001ad44d6d2010e74f549
MD5 3fe0431d1535d06eadc1891b239cbd7a
SHA1 99be31d69a6238d5297561efd7c292e853ffda20
SHA512 958df5fac2967c6e2dac31a363fb11cff4f230bbb6f08622f8366e37a7069a1ee8d7e394e998b6aebab064193459f9570e14ed192109ddb54bd741bf7f389b5d
TLSH
T102C04CB7183456CF4B7166D46128774EF15B4D5D8CC0CDE4A44971466534A238605579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 152B
SHA256 079bb215eba7704729e42cf9fddb309ba133a1301c1342703e9ebe7cb44d2877
MD5 056a9776787450c18119f9935a634f35
SHA1 e35e0c9688ffb4b4e187932bd825c9ab88b8aed7
SHA512 e8040b917a2a5be0baf66b3a217715826b1fd43654aabcf6c052ae62c43cb300f410284134b3663439383b88e2061fa8bc31da58460443291ba52b0503a9c2c1
TLSH
T1F4C04CF7182456CF5A70ABD86018771EF14B414C8CD0CCE4A44461462534A234506579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588c6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe588c6c.TMP
Size 159B
SHA256 5059111edbeaedc6e9fcf0d0bf308e8ae99b06c58efefb509572feece5f96772
MD5 9cc18a5cefef95e3ca4a33e4bf332a5b
SHA1 e6d01d65d41e0c8936a78941897c3a6ab47c5c80
SHA512 966eaf3bc81f6fd5cec2ffd3140ecddab6daed7a7d66e787ee469693ab87a17a543e1daeb13e8081c4b52b26696370d59e4561e8bb5b6b117f54723bbd1466f2
TLSH
T14CC09BE7153045C6DB729AD56025770DD51F4F5E8CC4CEF8A465B116323463357015FE
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

03c469fb-94cc-4680-b5f2-810f5d2ffc67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\03c469fb-94cc-4680-b5f2-810f5d2ffc67.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 057fafcc83d0debf796a172ce1d3c7cf20e0e1dd3307f9be7a6ae35062a43694
MD5 a6f75677b38067e44389685d9bdea52c
SHA1 fbe506fde36cacf2b8f5ff1315d86e45aafe8de7
SHA512 cb9488d14ed9c89dd94e3be3e849f996d0b3ff0c748a46942de32f2a36498ed2dec0d8770b8c6eae2341a1b5d780b618f57f7eb07652f3ccead8bda961f733b9
SSDEEP 384:bZcIhsNslS2NU/LduzX5od+s8YxiXLO7O6R2Feoxh7UJozf:DhALgOlaLO7TREgcf
TLSH
T180828D325878AC776DE7E255B44B36039EF85067DBC96F8191EC6F1D009EAA8031BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1649c5d2feacbb70f02601de783e6792db3e5421e08adb3adecfdfcd6053e555
MD5 60837341fc0f845b273a00cb8a128331
SHA1 de993bc974829ee62caf494d794350beefe3b91c
SHA512 b2fdcd29ebb132d73f15cfe48ac573a33775b9c4f1c832afd2b058334889a3518f37568f6fbfab393715d661e8364f9a2219f7c141943d6905d9e8e6ed5731a8
SSDEEP 192:yONn61VWQmiUy1rgGX5Obd+jgjzorYyRNF/a93PmU6:yONn6WQgGX5od+s8YB5mU6
TLSH
T16E02C736A8687CAB8EE2AE49B48737135FD4106BEA956F80D6EC1F1C009765C2346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3cfeaea31bb3dbb04c86dfce0fac82a93a53da975266a79d9a8ce7f5731c5911
MD5 3b989c8c22cafef086cead29ad427ed1
SHA1 3deaa825fa2455943ebee4f953c9ef719fc3b3fb
SHA512 bfbf434f2d0ad9a62709bd5433b9381e425ad731100da8b0a3641c154bdfb1eb9a6746050973067e2aa0d5e3cf45e910a07a519fcbe240ab17545e65619a5123
SSDEEP 192:+ON1613WQmiUykr0GX5Obd+jgjzorYyRNMiX1BjJjqRU6:+ON16AH0GX5od+s8YxiXROU6
TLSH
T14D12E732A468AC6B5ED2B554B48B32135EE5512BEA897F81D2EC2F1C00DF69C131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 01cca8f0b5884fa96a87d102ef782939a4b596569af5d1916991d59ef358ff96
MD5 563573f164dde14c13116c7292bc4aab
SHA1 c07aa03312b5bf0a538710a80d939ac4c77d48cc
SHA512 28c91c056230afb4eeec3f4a8ca2cf51e1bc588a70c1add6ba7ec824cf2aa4e0429ef7a0e9e8c770694f4e8f0d5a44a1f8ca290b32f2f8a4a7cc92a6f97a5359
SSDEEP 384:rZcIhsN4QS2NU/LduzX5od+s8YxiXLO7O6R2Feoxh7UJozf:zhLLgOlaLO7TREgcf
TLSH
T193828D325878AC776DE7E255B44B36039EF85067DBC96F8191EC6F1D009EAA8031BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 20aa2fb35fb6c70c7de562acc5480dd2c5bd9bc85d5f17735dfdccd455399bed
MD5 0499d3abe305ed9453f024d02e7cabfb
SHA1 d22b43bced8055605e44a418b8429578e4b5f43c
SHA512 b3451cfd4e0103f967352b3ddb5e67675ecd49aaf2c1bc9add29401bd49d748b652c1adc862766e9893a30bf3f9dc47f5ba78b8d37eeb079520eda970773ee12
SSDEEP 384:KiFiZcIesNe8TUNTUlIlQS2NU/LduzX5od+s8YxiXvO7O6R2Feoxh7UJozf:BFQezwgNLgOlavO7TREgcf
TLSH
T1FBA26C3358A8DC7BADB6EB55F94A32039EF54067CAC5AA91E2DC5F1C009B5DC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c196f84b181543bc56eb36edb81f4b46e307f48dfad961113d8f4fb11941b017
MD5 8ff82c9d4c10859401bdc02d6521d39f
SHA1 4fbeae16855fd23bb40a536bd6afbe8896aa008a
SHA512 1452c62b05b17963169e7b5ec1719e0a009f6cff2d13221f066c61f60a6e482b550968ae289cd2991ddf04abc50b9dda256c17bffc789e13862356f4253204d9
TLSH
T136E002022200401BC425037010431F201EE19150017242959B71015C0D337013A10B90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59987d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59987d.TMP
Size 392B
SHA256 737c85220e3a356972a0f13627e4173075bd60520f0008f4e0e44564a7e93950
MD5 b56de604ec7b0bb6c28f43565d5416c9
SHA1 90dcda332f7683ffd00b75f72398cb38657411b9
SHA512 2c79f205982e659fcb36257e55c6eb12e9cc8a29183d71696f1b1bfc17755eff12632039de45d15657a3f74a5aa9aa80f8be5e5b190952b50157b07b912fb3e6
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 50be505c9d780312e37f4f3dff30fdf5bcc71230f655d47cec857c48ae044003
MD5 1f3000fc033bff4bf4001528b7949246
SHA1 a4db99fba3f5febce12a5f9cda34da81538faf57
SHA512 53c50f1efb58a39447d39a97a52e1a6db8c6c84b3d1573ea00b05bd50dc999a15f450ce7c0064618a3427fadbb91e40e0d88bf23f30616ff293a510719db51f7
TLSH
T1FC412C9DA6F91148B373BF56ABF7A86E487EB8772F07D45E10010E4E0662A00D871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads