hxxps://secondsightsafetyonline[.]learnupon[.]com/users/sign_in

Analysis

user interaction
yes
max time kernel
62s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://secondsightsafetyonline.learnupon.com/users/sign_in
Sample260910-wn234seq8y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335371305197135"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{6142FE3A-79F2-4546-A19C-FFF463EDDFED}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3352	1236	msedge.exe	85
PID 1236 wrote to memory of 3512	1236	msedge.exe	86
PID 1236 wrote to memory of 2572	1236	msedge.exe	87
PID 1236 wrote to memory of 2572	1236	msedge.exe	87
PID 1236 wrote to memory of 2572	1236	msedge.exe	87
PID 1236 wrote to memory of 2824	1236	msedge.exe	88
PID 1236 wrote to memory of 2824	1236	msedge.exe	88
PID 1236 wrote to memory of 4752	1236	msedge.exe	90
PID 1236 wrote to memory of 5092	1236	msedge.exe	91
PID 1236 wrote to memory of 4752	1236	msedge.exe	90
PID 1236 wrote to memory of 4752	1236	msedge.exe	90
PID 1236 wrote to memory of 5092	1236	msedge.exe	91
PID 1236 wrote to memory of 5092	1236	msedge.exe	91
PID 1236 wrote to memory of 4656	1236	msedge.exe	92
PID 1236 wrote to memory of 2524	1236	msedge.exe	93
PID 1236 wrote to memory of 4656	1236	msedge.exe	92
PID 1236 wrote to memory of 4656	1236	msedge.exe	92
PID 1236 wrote to memory of 2524	1236	msedge.exe	93
PID 1236 wrote to memory of 2524	1236	msedge.exe	93
PID 1236 wrote to memory of 1756	1236	msedge.exe	97
PID 1236 wrote to memory of 2568	1236	msedge.exe	98
PID 1236 wrote to memory of 1756	1236	msedge.exe	97
PID 1236 wrote to memory of 2568	1236	msedge.exe	98
PID 1236 wrote to memory of 2032	1236	msedge.exe	100
PID 1236 wrote to memory of 1672	1236	msedge.exe	110
PID 1236 wrote to memory of 2672	1236	msedge.exe	111
PID 1236 wrote to memory of 2012	1236	msedge.exe	112
PID 1236 wrote to memory of 1672	1236	msedge.exe	114
PID 1236 wrote to memory of 1672	1236	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://secondsightsafetyonline.learnupon.com/users/sign_in
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe590ec188,0x7ffe590ec194,0x7ffe590ec1a0
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,5186757356316995645,5987661381249207181,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11249386218749216546,13866220381532665255,262144 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,17327291288901244503,7056645487263640695,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,7265639367255305868,273367295857438551,2097152 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,4275067802968369433,14438220312082025654,2097152 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17584207763476445020,6017148931295228265,2097152 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1334854112331172409,8459319892174202871,2097152 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1451133504150989703,8146445047236045905,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11849925378259716025,11309538964175692500,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9075418595192857810,12830229760857877333,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,9075418595192857810,12830229760857877333,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1304123548102863290,11192790137057220713,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,7500419661023518203,13242560843210213018,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11539179394267622552,17405695459421669443,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,4168603985485574397,14604247914206696717,524288 --field-trial-handle=2480,i,13099827360460846645,5093050399981808735,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 82399217cc4702d23a255e22667ed797606debc822eeb783eb12c38d8d06504f
MD5 e1d9b651a03d16f19598e48172ac39a7
SHA1 bfd81c028456cc9c9180fdb1f29fdd324dbd5077
SHA512 419b0b63bae29f3e3297f5d248b7697b73d596e0fbbbf823f3cb0cf3900502c9318c951661b974e2ed36f4abc0bcaf852d1476e0812386e33c7233fdbcbff3ca
SSDEEP 48:dgG6xwqanivNh+LeOngyA7Adi4cit0hW6jKzr3x9esnXifcCyhWYFcYiJISk+KDW:dguDiVO8VjKnx9esX8cfriJDf
TLSH
T19AB14BA92295147BFBE1B0B2D3D11E8B37792C8B0A8F7F061354C83D961379ED53246A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b570.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b570.TMP
Size 3KB
SHA256 9f5aa57f02997ced5aa0ce8bd46b015da3899426c562fa7f83117777450e76a1
MD5 a8bc30fcabc58bfab1912ff22585892d
SHA1 f65f2644ca85fdcf0e210dfa11e74f24ea11eb21
SHA512 7ae014a589eeea595c2548e9760a697d2bf0e4f4f2bf598f23f6ead1784af4509f7bf32c6f467b39922a89909ad8ee5fcd51edfb241452ed865f4ec46a730a8e
TLSH
T15A712B283299158EE3E1F0B2E7D20F4937B44C895E4B5F561364CC7DAA13B2FC52157A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7796a7bf702b52bc30fe61ab6da03da6e608d8475ef12e3755a1748464b8f9d7
MD5 3a0126ceb3204105cd180830da48b7d7
SHA1 0578aa7889054f0e454f56ea846d9fbe5957243c
SHA512 dd8b2ed5b95263a25d41703ebb34badf403347578c3dfa805360252d95d2d9ce2d5ba19c3168024c219fc71062f0f43aa3f18600f7ed9f0998151eb777182944
SSDEEP 384:sxZUPVbgu5s/fZnslUPCvUHbklX/ETe3D+9:sEli/fk2HbaI
TLSH
T1D242D812AA34AA77CCDBD209F9557F53D6F94472A2940D44AEFCCA1C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c6e0bdcf9113eeed11ee872c74cd356f2918061aa01410c553fcc023a813473
MD5 358dae1b018496c3fab50597eae9fb66
SHA1 95131ae6034066ba101929186145fe13ffbf1e15
SHA512 82cce90709e4642e9bda55b9a41a8bb6232bc6326ea7a2e5440fff0e08672d5e3a97c79bee4710ce32db68f6d3878301f7b0b1f3e84731be2648c1a8825228a8
SSDEEP 384:sxZUmbVbnu5s/fZns56/UPCtUHbk7hdEv53D+oG:sBai/fb4Hb8p
TLSH
T1BA52C812AA349A77CCDBD209F9457F53D6F94472A2940E44AAFCCA1C04E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4dee6dd33f7d4858282f948f6a7202f97939e855570eb28d09a06e9072577f21
MD5 8b437debc4f745458e3608fcff5ac1dc
SHA1 af55e43d8b4b8f7171589a309277d721c00b6934
SHA512 2cf6c030509f49d1bc9f75d8c62d54d076d5a4fbdadaaddd9b84b6c658fc7c49283d43d73ef4e9b0b16b97a7839981f82b60fef477a4652498c3419839d5615d
SSDEEP 384:sxZUPVbnu5s/fZns5QUPCvUHbk8wXEa03D+oM:sEai/fr2Hbah
TLSH
T12242D912AA349A77CCDBD209F9557F53D6F94472A2940D44AEFCCA1C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 938c18f6e527b4aa25cafb942184d29fb2608ac0892db3de82fbd46f2af770f2
MD5 60aa687a51b5c1bef2bcc03557bffbd0
SHA1 3538d01b63315dc3d9d47187e48806f8a7fd5eab
SHA512 763d2eca5a15ae0299155627b3b84b5c47ca1a713f1507609cbf73f370df7e8d83451e293c5e866e39c61fba12ba92782542aff6ac94c044236c606af14d5cca
SSDEEP 768:eI8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdproikyUns:eI8iJPNWvx76ru1jahALocdC4Us
TLSH
T1ECD2FB3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e594dce943a2893df020d624576c9327891261747a91d1c3e7f0893ded0c907c
MD5 7a5c4fda420d940bd314bc1e5cc3f030
SHA1 ac29970e42e331bea6e4f2145a9621352a1def72
SHA512 adeee31cc4f1c21e60fad262767035ba69c93ce38d0ff6684bfb1a6a90df2c52563d3bf5b67e62e4cd4b039f4743489c124d152152de621e9c8c69d20fce2d5b
SSDEEP 48:Kvp8j3pzTxuXesIZvxKM4kJxYBhLWvTSyZII9KwLGIPKf68jyNnI1KO:KUacKL6SqIKKwLGwKf6q2nqKO
TLSH
T125911111367F42423CBE3818A264D76B478672633519E52B3BAD01724E2BF281DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59452d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59452d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2b8e313a66c5f8c72f8ac08ee2e4e9914358084ada4290422f5bc821e7b4e466
MD5 54a63651907b915ea7f1ef0117ddfed5
SHA1 63a602d22a859c4b13adfc7f4aba95f429b713db
SHA512 f2dfa6530b82ef0a89bdb227a5d029cb69a095e31dd9df57b699a77821d03f46d7926180f91e3fb1ecdecd75cb1d47d809e08592f78866a5115025dafdb74312
SSDEEP 192:uU8vLsNiQvoQQFBLS3mWXPsQmiU1UvU4IyE4k03/irbNXLIXZq/U8:KDsNiQvoTFB7Wf8mM4Iy7kWOpsXmU8
TLSH
T1EF322A32A878AC7B5DE3A654F44736139FB48527EBC92F94DAEC5B1C05CF29C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1d468c0da08de2abf7799e36807e88bf26aa718b8ebd39a8a8db3127c1d8b4f7
MD5 4dedaebfb79f9e7c4eefaa62062c7c51
SHA1 8963a9d3b0d9e3f5491eed68e99dc9f2e0127fc0
SHA512 90c41102f51aff75e3b5b60c287bdb2ba32080d6ca41dc019d662e584c9f6a26dd31f95d0559f7f13a0001d371a505df11f2fe2f293c0099e70eedd6be7a089d
SSDEEP 192:uU8vLsNiQQoQQFBLS3mWXPsQmiU1UvU4IyE4k03/irbNXLIXZq/Ut:KDsNiQQoTFB7Wf8mM4Iy7kWOpsXmUt
TLSH
T180323B32A878AC7B5DE3A654F4473613AFB48527EBC92F94D6EC5B1C05CF29C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01631e4d8bf654e94eedd86ac8dd52f5842468c2972e309ccce3649269280037
MD5 416db9a82eae20da40b20c691a43fbed
SHA1 fa22bf5fd1f3f000672b2398c952723b06a0c873
SHA512 3eede7e261bd4f88a9e68e235c254bfae01ac275ffad2ec37c83a35cc2c0f70461a16d4c69e62265c8c7ea6b7e60a9b7ab477f24b52e81dd05025b7ceff5e663
SSDEEP 96:ZqONk7QsjpfmUTmDK5ih/cIPURHl8h4otop5UP5DUsBhPwivh50xy0SFYKDAxvYb:gONz6kDfQmiUyUhUgZ903/i+QiXO6aU6
TLSH
T1F802F93568786CBB8EA3AE45F48777275FE8213BEAD52F84D9E81A1C40D724C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 042efd4cdca74d789b1704aefeaff42a0f1c9a151f63774d35c1927876a25718
MD5 92b0ad4f348dfd65fa519382ab2c4d74
SHA1 e5f2af4329a8cef22ec40cb9d9d47c7b3c065672
SHA512 3f7597fcbb4260c366a32ef431a14b0fd7efbed745b44c5c42d804c3ebc6fb701c6db6bbd88dcc77d8b70622c289c77560ebc55db0d78b05be477d9078804cad
SSDEEP 384:OdcZcIdnsNiQQATFB7WfmmM4Iy7kWOpsXmsa+VY0mQRxo4k:VlWFz82hgXm+g
TLSH
T177828D7268B8AC7B9CE3A251F84736035EB4C067E7CC6F94C6DC9B1C04CA2981303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ab63515d69bb39a21c17e2ebcb004a326829f1fe226126914c2fc7d4ac24ea6a
MD5 98e26cae9e6da35e8d18948292d74e73
SHA1 09c926d681ddcbd6b6b586a9c64b5bb397a856b4
SHA512 686977737cc816987717f50d3d9309ef9d2536c99fefe0ddcac4e4f735148c19f4e3b9da72f6c4d97106ab16b1819953b3011f5232cbf20a0bee18bc42ff94d1
SSDEEP 192:u5u8vLsNiQQoQQFBLS3mWXPsQmiU1UvU4IyE4k03/irbNXLIXZq/Ut:OdDsNiQQoTFB7Wf8mM4Iy7kWOpsXmUt
TLSH
T1D2422A32A878AC7B5DE3A654F4473613AFA48527EBC92F94D6EC5B1C05CF29C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4a95cf8b63ffac57cb48aa72ae7804f27361676e5f274a521e0400642126a50
MD5 048ceeb4a2137e4be69acf3336ab4542
SHA1 02a44b764ed9d97516886646ecdb26f5601555a6
SHA512 0089697d36cc715e6b4fa28facd00309573acb391018b657914949e3a398a349edba0818fc7caa9465fbc9d7a507e3fe8699159531cc1a3c459f031c3cedc795
SSDEEP 192:yVON2t6k0jQmiUyUUUgyZ903/irbN4cRXZq/U6:yVON2t6XVvtgyZ9WOpxXmU6
TLSH
T1FB122B32A8A8BC7B9DD3A555F48736139EA48127EBC96F80D9DC2B2C05DF69C1307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b624eb25ca2c7208527385513540e51f5f34a8fe1f575c42bbe986e49a7810d
MD5 23d64a014a58e3d61377ae4a921fc088
SHA1 18e7871e6091633c64f6d7449e2d5828f2b9f299
SHA512 3dbb289c8e5bd5b2448b2ea2441a81c3f60efd76be636e0a241e97a39ced55e6fcc4547f9c19c3c5d10ea8a201373351ac89c55a57a0ede7e064232122bfbe4c
TLSH
T13F41D858A6FD1148B3B77E5AAFF6A86D547EB8372F07D55E00110D8E0A62B44CC62B33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads