a220fa24fc391cd9dc9d055becce53696c8eeb97bb2841ab3b71f70a6f310b7d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Signed_Copy.htm
Size 28KB
Sample260913-pg6pdsba94
SHA256 a220fa24fc391cd9dc9d055becce53696c8eeb97bb2841ab3b71f70a6f310b7d
MD5 ed1e337019592b4b34ddd8abada21ab6
SHA1 e10411373c90f91d0ae99e2079bfddefb6dd7def
SHA512 83f6bf093326dbc9c93aa0d0338a439f598b23dace1dc10da279185f5f625ea5c75be25ad531d077d8f3670887cf438641f85ac55e20c01f9559e97a8cb3767f
SSDEEP 384:10mYpTaxGDx8V6MO7lJnyDZNq4xNRmEDiQn23f4aYWu:1eZax/mf0
TLSH
T10FD2822AA25108419D37A7B4BF738746F7A28027D602836E7F9C87844FFA950D563F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
44	ipapi.co
45	ipapi.co
46	ipapi.co
67	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5948	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337756039719176"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{254FF692-07C3-477D-83A5-712E33D19931}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2708	1240	msedge.exe	87
PID 1240 wrote to memory of 4556	1240	msedge.exe	88
PID 1240 wrote to memory of 5948	1240	msedge.exe	89
PID 1240 wrote to memory of 4556	1240	msedge.exe	88
PID 1240 wrote to memory of 4556	1240	msedge.exe	88
PID 1240 wrote to memory of 3824	1240	msedge.exe	90
PID 1240 wrote to memory of 3824	1240	msedge.exe	90
PID 1240 wrote to memory of 5212	1240	msedge.exe	92
PID 1240 wrote to memory of 4744	1240	msedge.exe	93
PID 1240 wrote to memory of 5212	1240	msedge.exe	92
PID 1240 wrote to memory of 5212	1240	msedge.exe	92
PID 1240 wrote to memory of 4744	1240	msedge.exe	93
PID 1240 wrote to memory of 4744	1240	msedge.exe	93
PID 1240 wrote to memory of 808	1240	msedge.exe	94
PID 1240 wrote to memory of 808	1240	msedge.exe	94
PID 1240 wrote to memory of 808	1240	msedge.exe	94
PID 1240 wrote to memory of 3400	1240	msedge.exe	95
PID 1240 wrote to memory of 3400	1240	msedge.exe	95
PID 1240 wrote to memory of 3400	1240	msedge.exe	95
PID 1240 wrote to memory of 1380	1240	msedge.exe	97
PID 1240 wrote to memory of 1380	1240	msedge.exe	97
PID 1240 wrote to memory of 1208	1240	msedge.exe	98
PID 1240 wrote to memory of 1208	1240	msedge.exe	98
PID 1240 wrote to memory of 6000	1240	msedge.exe	100
PID 1240 wrote to memory of 2844	1240	msedge.exe	104
PID 1240 wrote to memory of 2484	1240	msedge.exe	105
PID 1240 wrote to memory of 1352	1240	msedge.exe	106
PID 1240 wrote to memory of 5848	1240	msedge.exe	107
PID 1240 wrote to memory of 5848	1240	msedge.exe	107
PID 1240 wrote to memory of 4520	1240	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Signed_Copy.htm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff946dfc188,0x7ff946dfc194,0x7ff946dfc1a0
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8626315191732579393,1184207134295417648,262144 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6516504506909687123,4881246568291997353,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,7699108165185154571,12502074119274037216,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3680,i,1922992380121997060,12322054654844659843,2097152 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3696,i,319684772395180367,1389084190400508987,2097152 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4392,i,15104760959066954593,13718948215892498182,2097152 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,5534364046842212785,2672321357166352072,2097152 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:9
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,10879432107268213555,15375606047904591894,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4342668233504872410,12895163196693989556,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12239034923617110172,2040998154426538389,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12239034923617110172,2040998154426538389,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3402602879076559445,11259768598633302867,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10549050402400634630,14737677354295269416,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,9664676327277218908,9962377698040587545,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,1233075118508872266,6824572608620609571,524288 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6436,i,6321581774785857799,17279691644970099500,262144 --field-trial-handle=2580,i,14414020274767440479,16243295090536972530,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:10
  2⤵
  PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7c660ab1f155d7232da0f5231695287a5b973a8050d83e6d4480f871c753ba87
MD5 3b979f3ad22b31f7ae5514ccd7498781
SHA1 e7c47e02c459861e503a3b41b2c93cb790ee7d02
SHA512 d27549f3099f9e26dcfaca2dde665dead5f5855cc153beb19d657e65c8a255993ab5d5c80675462edd5c3b154207f841fee74f0fe24f5390e94487daa0660f65
TLSH
T19551A6896661A0B4E7A719704DD132C37B34867ED7FB2E9E0DF8F4B51B4E350601103A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a2ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a2ce.TMP
Size 2KB
SHA256 ed3b85fae00a594fbf40a55b64deccf54d8144887a5a16fcc93c5e23b9a7c5b9
MD5 acc7f8f18cbc8582c98f30fa933fc658
SHA1 47d7306a6dd21c37dd9db40b06d8ca95477b5c59
SHA512 8f5605513759d730b5f52aeaa56c9df0ccdf5c50613d508c594bda8e0d505e7d8ee4c5ae630d4a11a8e9bea4c0ed5d67c370f37cb51fcb2fb57fb202bcd9a298
TLSH
T1F051A6896661A4B4E7AB19704DE132C77B34867ED7FB2E9E0CF8F0B51B4E350601103A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e9841f75928e3fd07b52137a81c9335bf4f982b28c8199d888745e8e8ee70acc
MD5 412ab704f14565a76731b48b4d334948
SHA1 eabc23c1156e8304802ff20a999d88fe229e4f64
SHA512 113561c831639bfdc78a868f916e94b0c8bb2aec7357612915a2bc543f89897f40cdeadf77b3c4b90dddd02ec0075d54dfd3a00734b06232c9245af46ad7f0ad
SSDEEP 96:D2OOFbnu0kVf0iejhazb91ZTdBJoGKzwQ:D29Fbuv0iejhaP91ZBBJoGGT
TLSH
T1CA81BCB7C3E8837D881156F0AB287E2ACE1D1916522C3C5A88F4AF1F63E24B0D14169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d98e6d393fd2d3a28a5399dade51ff609d047506d1a06768950bd32dcd61ad9e
MD5 16047bed37c9f1dc5b66b3379a0c8753
SHA1 0d15b773885c3b83129e0a3b180e5d4fbec52980
SHA512 c93b6417f850c2cebcf0f8c45d314b12c844d0c594728a994fd985f32f1ca53b749e59cc7013b5c0eb575cd66ba25447cbf77f96cfbd4bb44049d592350a5512
SSDEEP 96:D2OOFnJnu0kVf0iejhazb91ZTd5KK9jGwQ:D29FnJuv0iejhaP91ZB5KUjGT
TLSH
T1BE91BDB7C3E8837DD81156F0AB287E2ACD1D191A522C3C5A88F4AF5F63E24B0D14169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 002e719d323945d7e073692b9a59958802aa688a74d5cd79f1beaa74ba96215d
MD5 4b92d388f857a785fcfa6a42214d6887
SHA1 caee2eb50170b5d85a8bccd921b46b2c95dd239e
SHA512 0aad24ca0d09b0decadb3289e2a3707a0e712f2d38079ba1341851df7e3b234ef56fd238932c17c07db1d65bac42b923c1ab6fe8554d478b6db5864267fb7c78
SSDEEP 192:sxRvRAbE/fdsuKHRA8zoA8p4G/g6+WNIYE2vGSIgDzqJ:sxRvYE/fdsXev/5IIW
TLSH
T15732B815AD28A93B8CDBE20DBB55BF13D6F95032A1D41E48B6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7fe4f2e8b49e81b13d88bbd0deb40a06e703d3a1678d061e1520438b89db5876
MD5 6ad4b7464fea0cf3a419368f7670c89e
SHA1 4a48baf7baa674dce0fe0e6861b9ab5b4f261c85
SHA512 bc45be5b5842c33a930e49c10370188da4403a1b71d23e754714aa32ab95512c60d9ef140af40660510e331657778e71e7be602524dd17f9ac182a6b032ab60f
SSDEEP 192:sxRMRAbE/fds+HRA8zoA8p4G/g6+WNIYEIvGSIgIJ:sxRMYE/fds+ev/5I+s
TLSH
T1FA32B915AD28A93B8CCBE21DBB657F53D6F95032A1D41E48F6FC8A1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ff8fa7d72987a1dbc9ce421d9fa7a6064864cbc024392631bd97370fa17072cd
MD5 4e0c0a465b04e425be92fc0093723701
SHA1 986cb48a146d378bbdd5f6ee8f05a5560fd78885
SHA512 e85cf09bfe348f5e57a8aaf0a2dcdf24891c7becb1da4a652feb2cb35f2fdd8a3191564bba6e91f0b3b09311c64325181b40be4784e92c6cad0fb8d521c629f2
SSDEEP 192:sxRvRAbE/fdsucHRA8zoA8p4G/g6+WNIYEIvGSIgDzYJ:sxRvYE/fdsxev/5I+s
TLSH
T1CE32B915AD28A93B8CDBE21DBB557F53D6F95032A1D41E48F6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3b96b369c90658b043a4027177060a5c78d332464862b69e409bfbbff9e1ef75
MD5 f7ea3627ebddde7fcff18c0f31bbcaea
SHA1 a653a03f7d02d74d1f4f6d6ff54aa704283a51d1
SHA512 9323792374f34cda6a44082b444a4a84e4d6e1cac84dab32c9521215a9ef9908b73e75a33b0ea85d0d437ceb6eaa231609b15014d16d8df6aa0e70bbfa921358
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXTroJen:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0Va
TLSH
T129B2DA2B640CCB7F4FC04A9EA8196FD77D9802CB9A588D4047FE995C02C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d65bb4aea4e91ab1166011a559dc9432680e0f79335e781c11c7ca9751bdf751
MD5 0505158b0a514df5e2f8d51056ee217c
SHA1 8a317fc531e966559a7c59ff1ef7a7912d5e15f0
SHA512 6fae76e56c82e0747f0b8de3641d14d5b4630f00ab7683fad90d44f2a0d95db740e030ef37132b48c5f28282fc47d8be72355a297e84d90f6bc983e14764d182
SSDEEP 96:KYLSKYQaaZ8lJXLPkfLSPFhkKNBFvkRpJyX/kYKxiSv:8J/4vv
TLSH
T160914B01717B460038BE398890B6972F464273737559EA7FBF7C40A28E2AE051DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e712ee46-634a-4ae8-828c-d8a760907168.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e712ee46-634a-4ae8-828c-d8a760907168.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 134f2cb7165d6a045d2ebc01cf47fa3eefa3e0ced4c0f356ea514bcfcc1b8c6f
MD5 3d9a9d14bd0b352618a950c4ed094f7e
SHA1 765848b511ed6b46f1fa80d4dae4d393b8bd08e7
SHA512 466c05770a728ae69995011bc577e3e3865d7bc3510d63e113e182f5170ece7d3243a0e51c09bc20a53cabecf298d556e7b37ad64c7ad6dec203730261bda1e4
SSDEEP 768:d/UxvxjgC+z38PkXFvc7fZrKTHyHOp5XSwQs88uBkiT2Hc/P:AZj3+z3mkXOtrKSgILNBmc/P
TLSH
T10C03C039F8945C73ACB393817A5E3717AFF05113D4C40AA889DE6A0E02CB76DA74B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 232afc97ffa606b73346d357b9181e3a81d37b5f79186f12fc4d57390a91ab5c
MD5 816d460268f04ef3f6cb079a4e80611d
SHA1 d77005b850cb6179b08f76d40b3e92ced0c26b28
SHA512 ca208ddf3887f64376f6286a46c2b5af3ab38ea6937ef058c32007c878837be6e5c60572d1916161c1cffa11d72a5258b91b30641ec1564728e0fbe6e2442610
SSDEEP 768:xG38PkX5vc7fZrKTHyHOp5XSwQs88uBkiT2HMgKJ:xG3mkXStrKSgILNBmMgKJ
TLSH
T1EBF2BF35BC9098B7ACB783C27A8A37065FF09143D4C80A98C5DDA71E01DB7AD674B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c87f481172ead983343a56e88124b30cf8f531d1b1d887d63ff192f5f04294de
MD5 f9fd0670072588617a8ad4cae005445d
SHA1 d535578132612acd67c41a42d2c37453f955804b
SHA512 2f0c1d4c9a580ed931b3192b1fadc08d53eeeed39fd52a145fbc3d975cd9708b21bfae8fccb41f243625027693b89c512b2f9dd9d7fd56f70dcf12f052c05daf
SSDEEP 768:R/UxvxjgC+W3jXxc7fZrKTHhp5XSwQs88uBkiTCQ/P84g:kZj3+W3jKtrKvILNB1Hg
TLSH
T16403C039F8945873ACB3D385375A275BAFF05053C4C41BA889EE7A0E028B75D670B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c6b570cf8b473f734b746c0b70158b0815ec37f8e1df842e4c78a00b3d5bce1c
MD5 ff625ae31f818f51c8524134436712db
SHA1 408e415f7cb9b938a6f13e1f16b42c8dfdaa5fbd
SHA512 7d8a06d7b8414f4617473d5e07bb4e5837a4c36cd812c86661bbaa2e81078d9727f7655ad94e1e42d7da0cbb8c4e5f08090bc4af38c7d79a3afc98c50aed691d
SSDEEP 768:RKaFQD30wgKPkX5vc7fZrKTHyHZ/p5XSwQs88uBkiT2HMgKJ:RKBD3JkXStrKS5BILNBmMgKJ
TLSH
T10CF2BF36AC84C8BBBCB787C2BE4A33069FF05157C4C85A94C6DDAA0E019B69D134BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48a39805-f64b-455c-9319-a91b39f9df34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\48a39805-f64b-455c-9319-a91b39f9df34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads