hxxps://lumina-relay-worn-hawthorn[.]s3[.]eu-west-1[.]amazonaws[.]com/GynlXL6

Analysis

max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lumina-relay-worn-hawthorn.s3.eu-west-1.amazonaws.com/GynlXL6
Sample260916-tl6bms1vdv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340485891138769"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{9AB79A79-A860-4C1B-8FD0-E3B9888CA091}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2288	4120	msedge.exe	88
PID 4120 wrote to memory of 1044	4120	msedge.exe	90
PID 4120 wrote to memory of 1408	4120	msedge.exe	89
PID 4120 wrote to memory of 1044	4120	msedge.exe	90
PID 4120 wrote to memory of 1044	4120	msedge.exe	90
PID 4120 wrote to memory of 3704	4120	msedge.exe	91
PID 4120 wrote to memory of 3704	4120	msedge.exe	91
PID 4120 wrote to memory of 224	4120	msedge.exe	92
PID 4120 wrote to memory of 640	4120	msedge.exe	93
PID 4120 wrote to memory of 224	4120	msedge.exe	92
PID 4120 wrote to memory of 224	4120	msedge.exe	92
PID 4120 wrote to memory of 640	4120	msedge.exe	93
PID 4120 wrote to memory of 640	4120	msedge.exe	93
PID 4120 wrote to memory of 3852	4120	msedge.exe	95
PID 4120 wrote to memory of 3956	4120	msedge.exe	96
PID 4120 wrote to memory of 3852	4120	msedge.exe	95
PID 4120 wrote to memory of 3852	4120	msedge.exe	95
PID 4120 wrote to memory of 3956	4120	msedge.exe	96
PID 4120 wrote to memory of 3956	4120	msedge.exe	96
PID 4120 wrote to memory of 3376	4120	msedge.exe	99
PID 4120 wrote to memory of 3376	4120	msedge.exe	99
PID 4120 wrote to memory of 4556	4120	msedge.exe	100
PID 4120 wrote to memory of 4556	4120	msedge.exe	100
PID 4120 wrote to memory of 872	4120	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lumina-relay-worn-hawthorn.s3.eu-west-1.amazonaws.com/GynlXL6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff82b3fc188,0x7ff82b3fc194,0x7ff82b3fc1a0
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,11284786303765474692,1827141341629225160,524288 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,2811055430814772741,17926074060248186947,262144 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,16642812274765163558,5488290159460394943,524288 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,15945747427718738491,7114447247638097684,2097152 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14838078330014228561,13462246171450834164,2097152 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,15791940371342071564,2136089839944747622,2097152 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,7791388935259067039,5253887632833070448,2097152 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2438977956690889213,2540642143825428626,524288 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,9615191605790051293,5213937580162030279,524288 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,706826865731236114,4469725776945370570,524288 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,706826865731236114,4469725776945370570,524288 --field-trial-handle=2272,i,620198895355171303,7281029642804686633,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 afd6460b3e574f1cc4d6644f0fea83e3f46049d39e82cfcfb845964962a8966d
MD5 803684f161d502bec8f4fefac3dad2ee
SHA1 bc4276f7642971783610af1a78bb1109fc79a120
SHA512 feb1fcbfef7b363c557409e15ba8c34cf9c29dd8202fb0867b9c36062e904a6add711b30f0df5eec2db4a726e8fcd4481767c3fed44f75631173aa729d8fda91
TLSH
T1E261958E6951F4D5EB64E1B89DEE18BBB53A65F0504B5D32125CE8BD3F0E7CCB208061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59383d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59383d.TMP
Size 3KB
SHA256 059496fa584f4ce231ffa2a3e3164ade3ef7a4e036c46dd3ee4bf7c6a1c47f4e
MD5 b0fad763bb143de1c595d9b81eec6b37
SHA1 62b49171955cebe5c8b1a3c336574b7c104d7f48
SHA512 a0422c109d9b493091dfa93e9a63dd8c553f6de90dafe0c06f998053fa679686fc2a171a08c1597dde6bc58b95dc569936f58fe0f93a9eb13a2e79e9bf355d90
TLSH
T19061B68E6950F4D5EB64E1B88DEE18BBB53A65F0504B5D32125CE8BD3F0E3CCB208061
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 10da2a3544c34b390174122804a968aefceff7f731910d060d2c2d2593640e62
MD5 bd5d301aa401a17706adc44be092caa3
SHA1 607312223d0cc96d41d7d2d371e2eff3c4e57b41
SHA512 a3243ae87596722070f2990ede4b73a8fc93449d2a9c7e5d384b13dbfea245ad5ca909c1c645c75ea12eecff3b4709bb93bf1f3d6aa5fbadeadf5c516954e945
SSDEEP 192:sxZPRKWl/fKsAWIdpWaHW6+WN1pe/YYBjb+AUIgrJ:sxZPLl/fKsAXFHbO/fHS9
TLSH
T1C622C7166E38A53B8CC7E209BA55BF13E6F9503291D11E94BAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 eb0d40a1aef66335df7fb9b4caa9e7bb7a93e41f051313ed1b31e420c28cfd2c
MD5 2ca8552bfa4fe92400d555d6ecc4dca7
SHA1 bb2de984a9fda058ddf827ee2d22f53e97af3c4b
SHA512 0ab000cae74d5b1f5f751845a2eb76de8b92b79428db60f87abb9666102dab060ba81754ed0327b12534f3576be8aabcc87df787ffd304f88e785e8be408c24d
SSDEEP 768:e/yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX5rop5B4z:e/yYR7jWv3NpBu1ja/CL8OXyhu
TLSH
T157C2E92F640DCB7E4FC01A9DDC5A6F9B3E9802C7A6548D4047FA994C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0e9f9b2-7a7a-4822-87eb-bd8ccf6cac1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0e9f9b2-7a7a-4822-87eb-bd8ccf6cac1a.tmp
Size 10KB
SHA256 21f16ff9cd42fd136eb2748b67e16b4e5add30d5338a9141be32d8b66c10378e
MD5 c71b71a71c085a22ea1261f0d4abeead
SHA1 b0261162e30104b2a0c4e0d39dc0e2fcb990e3b9
SHA512 a115a813cb01f8d9b38fbad4853311a236dcdcc10c04093a09f2a0b2f39b8446590b32e77e51a77783f8b6d9cdb146c818ffc7298cd442caa3671f9efd22bfc6
SSDEEP 192:sxZPRKWl/fKsHWIdpWaHW6+WN1pe/YYBjb+AUIg5kJ:sxZPLl/fKsHXFHbO/fHSy
TLSH
T11922D7566E38A57B8CC7E209BB54BF13E6F9503291D11E84BAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 765B
SHA256 a6476604e3d295be0120688cb2a6809c0d32efd0ea8db4a3fedd644871d9a905
MD5 a68d790d914e998bfed565da03c1a618
SHA1 159f968eb5da522205757b452a621128bb72b169
SHA512 8d34f6e937c4dfa2850184e51cf326a46b4c37eea83761b4b6c344c30174a5bf1d4eab5c088ab6dda083ed59b784554112595c79e2052a669b388920d7e85bf9
TLSH
T15901E180A3D620947F89AA85C10E5A4750F13A76120D5B71731D44F4DF89C1D4FDFD55
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b6be1daa46f869e40d0c9ff1946bd691fb42ef4a28f88b5d7f72deba9aec9337
MD5 3952301adb4bcc188f88264f10ebc4ae
SHA1 9994bc92b15497255b576aa93d96c44e3311bf76
SHA512 05af37dac757ad01bac522a34a89b05eef6d7f07ddeef51c40e450f6f1731207e44bf7326c17233d910c36d7045234a439442b48e9473d19e589908e8d096bf3
SSDEEP 384:5ZcIrsNNUzRix4iQjWQX5+DtyOO/Hq89yKbysa+VYXl8oM:RrXzdkDIOUF9yKbyhgpj
TLSH
T14D827D326DA8AC7749E7A2C6F58636039FB45067A6CD3EC095DC6F1D01D9B9C1306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 8a2582b895b2c56747b7a0349d310cf22e011b3c8ad01f34a817039db94907e2
MD5 dc1175b0fc8543aa40a862a196de10d4
SHA1 16e7b1478c9c890b4df2056b0f8b9a2727eed061
SHA512 6d7197aeb6a9392f4349939e8331b42e538705874321eda1023c02bd4e1d8dd9de6e60b3e0409a1f95f186aaecf65e066e8ca883a9533b7c57fb477d61eeae7f
SSDEEP 384:CsNNUSvRix4iGjWQX5+DtyOO/Hq89yKbysa+VYXlS:CQdldkDIOUF9yKbyhg3
TLSH
T143624C3679A8AC374DA3A2C6F58B36139FB450A795893FC4D6DC6F0C01CA79C2346C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ad71a5db77991da3fef0085272a943d0f71f490e1ab9c6fb4dbea450c931025
MD5 95fc67acb8c54692e033187463a02e31
SHA1 14958f4992330c9729a4f534957341323f69aebc
SHA512 6af681b32a878e823e81f5be44fa16c1c9d6a24b3ec7fab9ee147d297069a9411265c21943e82f3a0313ee54770e33a64dcbe39525b6a75ae67249ffecd3b799
SSDEEP 192:EONs6nnHGQmiUyXRQYcX5hQDP1yOO/FMcaWU6:EONs6nCWQNX5+DtyOO/FVU6
TLSH
T1D002EA34BC786C778EF7AE49B58A37135FA5203BA5956BC0DAEC1E1C00D765C2306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 03133a5b228d23a7e1e401e2e9e0d9c9c3056c376c585239dfedb0ddb9144620
MD5 e8485f0c733068e180a43d599b328050
SHA1 02f83c9fe3d3f0abaa82c9fd530f622acdddefa9
SHA512 9ef25fcadb6c435244d2feed27bf05b219d852a087069f47af11f65ae1ecf3a6e30336542855d2aa283ce7bb6e87e64ba59b3492e199a3262940e8ee8b212b7c
SSDEEP 192:EONv6nnHuQmiUyvRCYcX5hQDP1yOO/HGFfE9vg3o/5byU6:EONv6nKoCNX5+DtyOO/Hq89kKbyU6
TLSH
T1A8121C36B8B8AC374EE2A595F08735135FA51127E5497FC0E5DC2E1C01DAAAC230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6095b74d0832158bcf9d220b3e8e2fa36bab29a43697faaf37885da901b8e8be
MD5 3e8632eec53f239561e671677331ebf0
SHA1 cccd10d10149d61d22225fc288e1c76b7d57d0e6
SHA512 db9803474f3d2e78f9037cb390f3fcde8ec014175fe80768acd4e31eec3e111232bcace35a85b0453dd106afcdc9990e012e8f4a55473a9a0825a48c7536f33b
TLSH
T152412648A6FD1158B3B76E5A6FF6A86D48BEBD332E06D09D00020D4F4A22F00CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads