hxxp://tommy[.]parky

Analysis

user interaction
yes
max time kernel
20s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tommy.parky
Sample260922-zh55csscjf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345834552310387"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{076028DC-2C12-4F3E-825F-828F1B7751E2}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4056	1028	msedge.exe	86
PID 1028 wrote to memory of 3704	1028	msedge.exe	87
PID 1028 wrote to memory of 3560	1028	msedge.exe	88
PID 1028 wrote to memory of 3560	1028	msedge.exe	88
PID 1028 wrote to memory of 3560	1028	msedge.exe	88
PID 1028 wrote to memory of 5072	1028	msedge.exe	90
PID 1028 wrote to memory of 5072	1028	msedge.exe	90
PID 1028 wrote to memory of 1968	1028	msedge.exe	91
PID 1028 wrote to memory of 3456	1028	msedge.exe	92
PID 1028 wrote to memory of 1968	1028	msedge.exe	91
PID 1028 wrote to memory of 1968	1028	msedge.exe	91
PID 1028 wrote to memory of 3456	1028	msedge.exe	92
PID 1028 wrote to memory of 3456	1028	msedge.exe	92
PID 1028 wrote to memory of 3940	1028	msedge.exe	93
PID 1028 wrote to memory of 1664	1028	msedge.exe	94
PID 1028 wrote to memory of 3940	1028	msedge.exe	93
PID 1028 wrote to memory of 3940	1028	msedge.exe	93
PID 1028 wrote to memory of 1664	1028	msedge.exe	94
PID 1028 wrote to memory of 1664	1028	msedge.exe	94
PID 1028 wrote to memory of 3968	1028	msedge.exe	95
PID 1028 wrote to memory of 3968	1028	msedge.exe	95
PID 1028 wrote to memory of 3968	1028	msedge.exe	95
PID 1028 wrote to memory of 3256	1028	msedge.exe	100
PID 1028 wrote to memory of 3256	1028	msedge.exe	100
PID 1028 wrote to memory of 3256	1028	msedge.exe	100
PID 1028 wrote to memory of 1392	1028	msedge.exe	101
PID 1028 wrote to memory of 1704	1028	msedge.exe	102
PID 1028 wrote to memory of 1392	1028	msedge.exe	101
PID 1028 wrote to memory of 1704	1028	msedge.exe	102
PID 1028 wrote to memory of 4668	1028	msedge.exe	104
PID 1028 wrote to memory of 4348	1028	msedge.exe	109
PID 1028 wrote to memory of 4348	1028	msedge.exe	109
PID 1028 wrote to memory of 4348	1028	msedge.exe	109
PID 1028 wrote to memory of 1440	1028	msedge.exe	114
PID 1028 wrote to memory of 1440	1028	msedge.exe	114
PID 1028 wrote to memory of 1440	1028	msedge.exe	114
PID 1028 wrote to memory of 2500	1028	msedge.exe	116
PID 1028 wrote to memory of 2500	1028	msedge.exe	116
PID 1028 wrote to memory of 2500	1028	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tommy.parky
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff805ffc188,0x7ff805ffc194,0x7ff805ffc1a0
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,9159313019038477812,6429251561001410574,524288 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15738881394292056109,14441365662298606343,262144 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,14459796501253739615,15667558760796720659,524288 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11900925706406982898,7749869732646076748,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,14082712011905972784,332666229904888864,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,12551632964158597533,2849440136163075794,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,3373034948632709855,10672991945743680223,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,14239104385874124809,3400054021821654339,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3704,i,8260327848759345092,1523154546780112194,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,13184567423614912923,18060516838237231605,524288 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,512881774303065745,13550085267566167112,524288 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7441460127679469047,9611924991261092526,524288 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7441460127679469047,9611924991261092526,524288 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6328,i,8226811406164857051,11735503258246503981,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5984,i,8670639645122340802,9319475306257442588,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6376,i,16366683805096240936,12236473021669789898,2097152 --field-trial-handle=2232,i,5005336588571812774,336886794300744155,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1c8b0d45831466e38a88d95ec8a2ced2f5e9856311bfb1a9c5bbf35d8074a410
MD5 8f309adae4512cd060caff75bfd342e1
SHA1 f265ce52f4bea0b6e1c4aed940e5cbdbe859c7da
SHA512 2a3dca693d1609006750b4e79c6a34407cce586ee1f1436e0262a79b969933467f229a7e6a11483f9a8a56c1ae3289d4e31d2d6b3987bd6e4271d06aa841e779
SSDEEP 192:sxZuR6W7/f+XsfyAIdpLVHW6+WNGYYBaq+IgrJ:sxZuj7/fosfyBZHbGfu9
TLSH
T17C12B811AE38A57B8CC7D219BB657F13E6F9513261901E98E6FCC61C05EAADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d89986c0d56a76915bf523fed46bd2bce50ea12e503d93762e7da7c3e0fc0aec
MD5 ca9b983255d2221dae1fa31f0dcacda7
SHA1 9d782a22e4b83b8d986baf7fb53d7c528a1cfd35
SHA512 2a4e0f5afda6da9ec9feb8d3dff917420e1dccdb488cefac3291ee85bb5435499f713550dc8b4df44980744c79b72858db3c175d1a2df03ee61655a0e6e67057
SSDEEP 192:sxZuR6W7/f+XsGyAIdpL+/HW6+WNGYYBaq+Ig55wJ:sxZuj7/fosGyBMHbGfuQ
TLSH
T19822C811BE38A57B8CC7D219BB55BF13E6F9503261901E98A6FCC61C05EAADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 40125a8143b5b8004e66a4bfa6955525e6a138537ac9c621693d3a1a5d787f2e
MD5 d994aa0ba731c758874c009f233fe514
SHA1 7b285bb5c36840e4883a80eb54fc453d28f6f56b
SHA512 dc7e66241d7788fe6646d89c509e6cf19249381499bb2f0db16f83342002fadf6d8c7ded1ccae7d4fe6f2e6757397f831b559ac960b4586c871ea5c0e9bd4135
SSDEEP 768:sdyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXXropKVU:sdyYR7jWv3NpBu1ja/CL8OXET
TLSH
T1E6C2E93F640DCB7E4FC01E9DDC5A6F9B2E9802C7A6548D4047FA944C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 9cc10f7919e32895dfba769530aa461130413e83ebe4d529f914ce853931241c
MD5 f8a7c99bec79964ded7ebcbd4efc65d9
SHA1 25a1cfde9656b192d7600b4e8f711b3d5fdc0a64
SHA512 9abfcedb0da68aa3a85c8cdfcb93eac65ae628d8c1dd4105cc2c4c8973967235e06d84bd4d0786efa8c74695ead2ca2a6301f8cbd43b0d6ddb7a4cedcd547c70
SSDEEP 48:Kgfir/BhBab5UpISPaK9v1lax/KYstvTyLnKzHJp5Sbx8hISXSK9X19SxXCY0lHs:KQsAKVC+ikAKR+uRmKKoS+ROK6Ei
TLSH
T17AC1B01571B7020038BD759880B69B1F6282B2B3311AE63BBFBC51A54E6EE544DFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6933bfeac112288031cf8af590dd620c5955dc63aad89955842b67fd61bf66d6
MD5 bfd7391062e38a2dc2f254e2e4051897
SHA1 3ebc320b9c473649156e007af1d351a6b8bd34bb
SHA512 0c8ee017c985357ad2465110b869190a2756bd9f84f9d4247d17eb9a91cfe817216ea22676229bad9a592942a9421584fff6fb836c9b8a18b054764be18e46ec
SSDEEP 384:6ZcIhsNmHAFyigul4QX5+DtJOnIqNJrDkywTeUCiYou:4hikxOrkDzOIqNhDkyweiYB
TLSH
T1E2829E365D749C3759F691C5F88A35139FB49123E2C46AC0E5FCAF1D01DEAA8130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b683315a17ca86cb01e4fdf8e813b51a69f52303cc2890ca2eca5593170400d2
MD5 adacbdc4f2f32b0ae9e3be9d5ee16276
SHA1 df9016e67a2c681d403e13aced461a515fc6aac1
SHA512 03cf21a9cac5521202b947be82e049c1ac71039dbef5eb056886c966c706f75db8bf946d576378f03081c1e699dfd8caa901d2c69e9c3ec556bd570d8d911c15
SSDEEP 192:EONq6nnHGQmiUycqQYcX5hQDP1JOnHodMcp2U6:EONq6nCSQNX5+DtJOnIN8U6
TLSH
T14E02D934BCB86C7B8EF36D45B48626139FA5217BE5956BC0D6F85E1C10DB76C2306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 468f195e53da19fb1f6c8ee93b4f30aee6d8f2b76de97948c8369c281839249d
MD5 3810daaf43b82b30f29d8025d5263586
SHA1 270677ec90c168d67e90aba0004ab09d580548ac
SHA512 1433f44afa486c5958aac806caee341cc2e909219bc36e47212fb1e912f16a31a30a96b9c88f1caea3d9bf12d1002a613fdc718a764bd6237ef836d7fd791463
SSDEEP 192:EONn6nnHidQmiUy1qIYcX5hQDP1JOnHoqSSJr7g3K/5v6U6:EONn6nCbhINX5+DtJOnIqNJrAkyU6
TLSH
T1C6121B35B9A4AC374EE299D5B48731539EA45127E6857FC0E6EC2E1C01DEB6C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e0acc39724667f1b5948cfd4c9f2d345a6ebe94c253e835870ae4cf10bc63c1
MD5 406db97e18f6301a97ce623f2912ccde
SHA1 fb4f3d52c374ea4b446d6b53ce2d1a04410ef708
SHA512 b3fd35488cfc1099b167525bf9e61a90717bcf86cf2b2acb3c7727b7b04e4311eb579c36f87eab05632263e9d5452fbf310bdfe3e09daadf0576bc583e47f26a
TLSH
T1D9411C5CAAF91158F3B76F5AABF6A86E447BBD371E06C45D00110D4F0A62A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads