5259788c57ca8986f6dee0b983459dd61cef1ceff2ac4c8f46546643580b638c

Analysis

user interaction
yes
max time kernel
22s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KGF1F6.html
Size 4KB
Sample260916-s31xtabe63
SHA256 5259788c57ca8986f6dee0b983459dd61cef1ceff2ac4c8f46546643580b638c
MD5 0c8f40d58d5a6e9b2c2265893716ba81
SHA1 be3ab0d5f689eef467e8504da91cbe6b6f8b4f02
SHA512 8506ab4569712dddf6a34aaf556179eb45f8dafc7861fb14ddf70b4403a5c6e4866423c29f659e525371104f93439f9e4a2499b38636856e0b009ffbf6c87524
SSDEEP 48:/9cbv65rJLWcqyFpZWJlBa5p60bmvR0NjVbDARip60bmDImU2PkE22W19l/qqKcW:/2ElBKBa5MzR0x7MHIoPkE22W9yqC
TLSH
T13E9108576CF1255620138151BAE2FB4D4FB4C853A1628DC8B1ED69864FC3FEA698770C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340467961562425"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{476622D4-873B-49C9-9E8C-27D2B74E1F65}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4200	3820	msedge.exe	87
PID 3820 wrote to memory of 2304	3820	msedge.exe	88
PID 3820 wrote to memory of 1604	3820	msedge.exe	89
PID 3820 wrote to memory of 1604	3820	msedge.exe	89
PID 3820 wrote to memory of 1604	3820	msedge.exe	89
PID 3820 wrote to memory of 2696	3820	msedge.exe	91
PID 3820 wrote to memory of 2696	3820	msedge.exe	91
PID 3820 wrote to memory of 1008	3820	msedge.exe	92
PID 3820 wrote to memory of 1008	3820	msedge.exe	92
PID 3820 wrote to memory of 1008	3820	msedge.exe	92
PID 3820 wrote to memory of 1188	3820	msedge.exe	93
PID 3820 wrote to memory of 1188	3820	msedge.exe	93
PID 3820 wrote to memory of 1188	3820	msedge.exe	93
PID 3820 wrote to memory of 2320	3820	msedge.exe	94
PID 3820 wrote to memory of 2320	3820	msedge.exe	94
PID 3820 wrote to memory of 3548	3820	msedge.exe	95
PID 3820 wrote to memory of 2320	3820	msedge.exe	94
PID 3820 wrote to memory of 3548	3820	msedge.exe	95
PID 3820 wrote to memory of 3548	3820	msedge.exe	95
PID 3820 wrote to memory of 8	3820	msedge.exe	100
PID 3820 wrote to memory of 3672	3820	msedge.exe	101
PID 3820 wrote to memory of 8	3820	msedge.exe	100
PID 3820 wrote to memory of 3672	3820	msedge.exe	101
PID 3820 wrote to memory of 1616	3820	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\KGF1F6.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe9639c188,0x7ffe9639c194,0x7ffe9639c1a0
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,18019508261601969701,475743339130811731,524288 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14876784951439155747,6552114696539447424,262144 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,12776917215483906113,16326891921531654027,524288 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2886874098426187149,3568958831045472883,2097152 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9493773890500607067,14160311258837133503,2097152 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,1890107849484734725,9378498652831036184,2097152 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,15615563317159230571,17472751234752220329,2097152 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,13684702038886793478,10912161249604840386,524288 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,3075845196069155929,961969425821712605,524288 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,11303238854629840702,9610364298826817586,524288 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,11303238854629840702,9610364298826817586,524288 --field-trial-handle=2292,i,9388870530694542050,12634561160499779155,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bd79a2d78ae6aab8d16eb5c37beb10edc01f2f358b5b6c4c6a33191e9cdcf44
MD5 7b2e9c5ca952f7caa1411da3e3008dda
SHA1 2c88644b3b002e6e8344534107bd99f5bcffb14d
SHA512 0a98da28dfe08b5d20aaab616ceb09696e8634bd13be10454215ffb77dcd9358bdbf8f06d27e2a928c4a24667a9edae639c733393298f889bdb3346ae7acba75
TLSH
T15F610AE5C58182EDF7F8437C97D13B877A38B4D8B1836D2200A2FC3B540E359A682074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5907a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5907a7.TMP
Size 3KB
SHA256 e4885f0c0277e36d5be54870233a80ab1d3543aeb77bfaa6343a00b7c73991af
MD5 a0fb9cc2bde7224a8ec957463d4bef08
SHA1 6f42543ea9d0eda05abbab59055afc942fd7fa37
SHA512 51a1364ef5e36cc342f77e3b9793706bf560f92a679e3153f4e035aadf7f61f6d153c22d9d016634036169e5745aca5e402d7deb303c31ce443ad70f2324617c
TLSH
T14B610AE4C58182EDF7F8437D97D13B877A38B4D8B1836D2300A6EC3B540E359AA86074
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 06284966f63e1a04d09e63682c748418c3861f6555cb748119b7d6d70f4722b3
MD5 924550248b0942dd2f5d60f73ee3d055
SHA1 7da9526836ad9d62dba346d7df28633b1781f503
SHA512 3d300d40fd26b743287a10aa31337c26f7852bfe17d13316d8a14925d12b9825e55963e21660e62977d8f164082aa8a567ff428d0babd14e8786fd0f43c2a7bd
SSDEEP 192:sxZwRriWp/fusU/IdpdNHW6+WNGYgUF1IgrJ:sxZwrp/fusUwPHbGC9
TLSH
T13712C8566E38A97B8CC7D21DBB15BF43D6F95032A1911E48EAFC861C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e839fba283703f6795eceaf71a66d8665f9fec4b15581cb542692e0bff2be174
MD5 ea258367469ed8e6f0d741039a460247
SHA1 fcfb1f90bbc1079394019fd863b8dd86ec2e3c22
SHA512 e041ea755ad55bf2f55a07c62dff65f27a95ce461763007b16c709a24fb516f00bd74a0d09775c8d1df1f2818928cc6298d199263a209f4d816e4609dfce79c7
SSDEEP 192:sxZwRriWp/fusdMIdpdyHW6+WNGYgUF1Ig5wJ:sxZwrp/fusdV8HbGC2
TLSH
T1F822B5566E38A97B8CCBD21DBB15BF43D6F95032A1911E88EAFC861C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3d14687a6baaa0586be7c52e0b6c81a4000a7f1f639ae228c91e47c77fbbe860
MD5 e219f9cfa3ef12cedcd754346a696664
SHA1 957184cd40eae3a5e039a631ff960301f74f07c7
SHA512 97d0e8b3688077cda36db8d7bc3b34a829064812f365cce122639751705ed05c9b25fb1c584507937f2707eee76f9ab99fdae930a64438f349848bdf51028743
SSDEEP 768:C7ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz9rodrGa:C7ichfPWvPZplu1jan+LKgz2t1
TLSH
T11EC2FA7B640CCA7E4FC01E9DDD1A6F977EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1e03f0e65867f98b92a14b7698d81628d086f5135e243d0431f21af7d648234a
MD5 86dcbf596ccd00f091b4182688cd5c3e
SHA1 48a69e77edd46cf071e37769fb6df91e2133698d
SHA512 2ac1059c04e21c8932b5e0960b1fad18b91691de7d612444978d720e91e3218abc3f86398a18b5cb8d99957252d9f5dc0c45f389bdbee1e6aa89a0684fa5dcec
SSDEEP 384:/ZcITsNGgQG5L8DuBGYX5Ejl83sIXHLl7O6R2Feo+h7Uvok:XTdG6kGYujToHLl7TRdin
TLSH
T121828E727C78EC3B1DE6A145B44A3A039FF85067A7C56F90D6EC5B2E01DA6D4130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c380f4323422f602f2b659dc08d2ad8855088f037a3af9828c32fb352353f89e
MD5 94cfb631b4475e93abbbc07426144207
SHA1 0f06e8b5adcf8216e78d76ce1812962bfbbc7d8e
SHA512 03e732ed0b309cdf73b05b3fe05042be09d3ab51d103688640067b600d56ada5df86f3a8a6047bc8f3312516a0b20388bae4adb993a8a2b6caafd84967b97d57
SSDEEP 192:LJONI6DphmqQmiUy4Qq8wGYX59ezKCpjzor33Ikk7N9U6:lONI619gRwGYX5Ejl83GDU6
TLSH
T12302EA35F8787CBB5DE3AE49B44B27139FE5212BAA946F40D6E81B1D01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 38d1bc1f0b12364eb1f393bbe2975b84c914b26aad9afc52bbeb8598bbda1eaf
MD5 46523ef9dfbe3307d7e59302f6040826
SHA1 2fe240e9c595f3d1311e8cd369bf0022f461da0b
SHA512 7c746237749657efe9f82239cc4ed000a83312827088bef07ab0d8ad0c36decaf49b481046c4c5e171820a7491feba48d8e6bf21f606c382d7ec050613980f3f
SSDEEP 384:QsNGSQG5o8DuBGYX5Ejl83sIXHVl7O6R2Feo+h7Uq:QfGRkGYujToHVl7TRdv
TLSH
T1BE625B72B878EC371DD7A155B00B3A139FF850679B852F90D6ED1B2D06DE6D8230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eaa9d14f1cd5dc875de1464b61591a4fabee7faf3f9d34483874bc98d671cde5
MD5 ddaa771df50c360ba180ce65a26da768
SHA1 5e5d3ff40e064f3ba67526446fd25f2634bbda86
SHA512 194c2c12eb73faaceb09ea0e3b4ab8fd420a511e89bd163213cccf89cdea9c0460fd68f813a7dafb7f2154236c179fc91765460420d61cf6b163fb113484c62c
SSDEEP 192:LJON36Dph2qQmiUyiQWwGYX59ezKCpjzor33cIXEEGkIIH/57U6:lON361NkWwGYX5Ejl83sIXH/lU6
TLSH
T184121A76B878BC7B1DD26595B04B36139FA4512BEB887F50D6EC1B1C02DF698230AC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6dce4448835838983bc2c8710532e1beb2259fffc4dbbe14c1d2eb8e86b9f1c3
MD5 94f654c0300561dfa6c50eddf997b41c
SHA1 e168203c238b04567f20ae4202b40f05df801ea6
SHA512 44ac1f5eac2b41553fc3b9d886913527377217a5408417de9eaed94d5928d3b6b841c9973193b54c5c5fb7a3b6228266f21b6ef4fdc74fb3ab2be3a30bcafe0b
TLSH
T1D0413958B6F91148B377AF5AABF3796E887BB9772E06D09D10010E4E0662B40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads