hxxps://legal[.]totalcanna[.]com

Analysis

user interaction
yes
max time kernel
104s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/09/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://legal.totalcanna.com
Sample260925-w32qwstdjd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{D1DC329C-DA8F-444E-B4BA-45711DB2C0AB}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 3048	944	msedge.exe	81
PID 944 wrote to memory of 5132	944	msedge.exe	82
PID 944 wrote to memory of 5148	944	msedge.exe	83
PID 944 wrote to memory of 5148	944	msedge.exe	83
PID 944 wrote to memory of 5148	944	msedge.exe	83
PID 944 wrote to memory of 5124	944	msedge.exe	84
PID 944 wrote to memory of 5124	944	msedge.exe	84
PID 944 wrote to memory of 1236	944	msedge.exe	86
PID 944 wrote to memory of 1236	944	msedge.exe	86
PID 944 wrote to memory of 1236	944	msedge.exe	86
PID 944 wrote to memory of 1452	944	msedge.exe	87
PID 944 wrote to memory of 1452	944	msedge.exe	87
PID 944 wrote to memory of 1452	944	msedge.exe	87
PID 944 wrote to memory of 5224	944	msedge.exe	89
PID 944 wrote to memory of 5168	944	msedge.exe	90
PID 944 wrote to memory of 4656	944	msedge.exe	91
PID 944 wrote to memory of 5224	944	msedge.exe	89
PID 944 wrote to memory of 5224	944	msedge.exe	89
PID 944 wrote to memory of 5168	944	msedge.exe	90
PID 944 wrote to memory of 5168	944	msedge.exe	90
PID 944 wrote to memory of 4656	944	msedge.exe	91
PID 944 wrote to memory of 4656	944	msedge.exe	91
PID 944 wrote to memory of 1700	944	msedge.exe	92
PID 944 wrote to memory of 1700	944	msedge.exe	92
PID 944 wrote to memory of 1700	944	msedge.exe	92
PID 944 wrote to memory of 5564	944	msedge.exe	94
PID 944 wrote to memory of 5552	944	msedge.exe	95
PID 944 wrote to memory of 5564	944	msedge.exe	94
PID 944 wrote to memory of 5552	944	msedge.exe	95
PID 944 wrote to memory of 3492	944	msedge.exe	97
PID 944 wrote to memory of 340	944	msedge.exe	98
PID 340 wrote to memory of 3088	340	msedge.exe	99
PID 944 wrote to memory of 4524	944	msedge.exe	100
PID 944 wrote to memory of 3220	944	msedge.exe	101
PID 944 wrote to memory of 3704	944	msedge.exe	102
PID 944 wrote to memory of 1236	944	msedge.exe	103
PID 944 wrote to memory of 1236	944	msedge.exe	103
PID 944 wrote to memory of 4612	944	msedge.exe	104
PID 944 wrote to memory of 4612	944	msedge.exe	104
PID 944 wrote to memory of 5472	944	msedge.exe	106
PID 944 wrote to memory of 5472	944	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://legal.totalcanna.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffe59c2c188,0x7ffe59c2c194,0x7ffe59c2c1a0
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1872,i,5179992537910221359,5349343972154132847,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,10233954541260159172,14383377343301163602,262144 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2560,i,1534146754501438461,9372994783194608262,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,18323902635483470348,5125079659415082204,2097152 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6498352208688855092,15409368222922926932,2097152 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,17429146429020263756,12018362253772660055,2097152 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,10838951934879056825,7686396388585138953,2097152 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,17685710253236587029,17557605263402074987,2097152 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,14817446319187991697,2999254419455986059,2097152 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4356,i,10733840335849886848,5398058400821577528,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=1588 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3508,i,7351792058833919516,7529080424211749345,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6208,i,18300551463801665414,17961099147593238911,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6208,i,18300551463801665414,17961099147593238911,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6320,i,13447098635522782918,4056251840425881120,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4412,i,1696455536582389094,17286641414892565816,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4424,i,5216727352074134077,12274301178572923379,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4240,i,10703990252449205741,8392100580975591599,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2448,i,6317539371404750212,17218593070908414408,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5564,i,15158788866533772077,2847046551422613998,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5696,i,12389571851573469012,7258002400552981378,524288 --field-trial-handle=2212,i,9152073792431975540,5507733061032792265,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 635a17b62bc802a1d6d2ac977e63b5a2027aa2bf3d1b5551e63352afa4362fd9
MD5 7fe12d00d13e30949f1419fc02757c7e
SHA1 7fe9042bd95f9f143a17aee8b65dd97f8f4eb44e
SHA512 c9251c530a2927beaa3f58a69cd075267ab37b951ce23f2f159ff17f194ed9b03a08d41f5cce2d4dd1a091898135db5440df49406cc67c2f8fa1bd50c44edd4e
TLSH
T1B1D011A2FB32008CE0802238A23B2B282E00820000C30000AA2000AEAC882A2AABE028
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aa0ef8543982e42f2141a859cd78cf0f780a6b139ea99c1c2ad33fd4f56cb7b
MD5 cf1ef0f6a6585003596ad6b09c83cbc3
SHA1 80edf8da49bc458828bf3125b8b4aa3036814e22
SHA512 0c23492cf0d4ab37f4a7f42f865cc6238ff5b3cdabf212ce523b204513d6aa133d66ec3e381caf548455fba3f37294ba5fdf00ad1dbaac1945115047c226530d
TLSH
T198D012A1FB31008CE4801134613A1B281D00810000C301015510009D4C441D2657D024
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e555bf343e9aeebd1f8ee1308bb2953f1bedff5f3a96a870fa009d3ead672f7f
MD5 e6594e7ed15ce9920fc8711083da78c7
SHA1 7d896990afcf683b06f7cf14e19dff236074ad9b
SHA512 9879fee63b6028a4e678e673c7b7d774f440f32879e737d9da6162d90b190374a09a5b3daf05cc99bc30fa278fc4c6827473b3fbd4bc7c7098cf3e7b82c6bdc0
TLSH
T1C1E026CC64CAC2FFA3007487417C6B0C83903B0B92CC7F8A570087887842D40AA867A6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f59ee8005ed313c5d56de9e9904d743d1e5da6e11d3e57e2b1f7c19825e74dd
MD5 806ed335a478e875e41c9edd38d2b8da
SHA1 bec5890402fedc24933e2859893d2fb266570d47
SHA512 3b5810076eef6c6ef9da49b580910e3f82b1b12bb515a66730bb5e3abe8f79aa71f6c88371f32866a4e93009ba374bdf3c11cbc7bff7447c1a53d5cc526d2661
TLSH
T14D717681078841ACCBA463F9AFF757863DB7749B39872DD223D1E568481B76519CC608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591023.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591023.TMP
Size 3KB
SHA256 77011623438d955675f53efc8f6f0a1e6813de9d94ae4ba9bbddb138789ac759
MD5 5f1fabf9cbfc3b284d573569d246af73
SHA1 27cc83df4ab25dbe34fc72720ed2afeb94b9e900
SHA512 57295576cbd7863410b03490da8e791a13b7cb8a51a1a5635e90dee742f6dbbc999b02588f73e8dcc64dc0d80dc99f2cb2c8e3e158f139bc9deb8b71bebc7daf
TLSH
T1FC614C825B40809DD7A483F5AFFB63873E77B49B798B2CD203D0F874480AB2519CD208
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ecdeb4df135d04315e94e26cf35359c0044111d627eb7282762fed4c8ba4a40c
MD5 30df671707705c507e54c23a325c19c4
SHA1 3a467cf4ef2c727c1a20688bd55b24f9809d6535
SHA512 e206ac0b737025b54a07e925acb222a852506638b444991a39dea8a6f111b383f2b803fb5658f16a2aa61e81c69bc2b88a6506bb610dafa8dac9c0f3e23c5b8f
TLSH
T1B741DDB3C3E5866ED91196F09B086E2BCF6D0525036C7C6AC5D4EF5797F2062E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 98c03e31beb80821ab6ac86fca2ea1b590bbfa8b79ffa8e1382cedbd8adb0d5c
MD5 f41cfd40f20d8ec2170ec3b2d0299a3a
SHA1 c64af03238b784786a270c27cfe041802452a5b1
SHA512 9e417da73862bde4bb5ceab64ba6c62885fbebd6dcf44390ab5b4dc4a56295a44f54af143bb9cd929c880edccb2be62001d07707bbfcad8a11bfb82e14fc3f11
SSDEEP 192:sxZJRtb2/fbsT4tiMIdpo4/W6+WN7W1/Y0Hf1cVAIgrJ:sxZJH2/fbsT40l/b4/5/6C9
TLSH
T1B122C8566E34697B8CCBE20DBA15BF53E6F91032A5D11E48FAFC861C05E66CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1e4e6480a5636602b519f8688bed443e7af832e7c20657f232fa13ba5766218c
MD5 403a1c3ef4b85b1c0ca0490ed21c8a65
SHA1 19be4c3ce2da90c2ad07db0745a17ac9b9e2f2d3
SHA512 2bf2a1d5664c96f0360a9b6ea3519811ac7a0670057a4615381e8dad36b43b87de972eef8d89a51ed5eeb4c06be81684c0ee3d88f8bac15b74511e78cd89150a
SSDEEP 192:sxZJRtb2/fbsm4tiMIdpo4/W6+WN7W1/Y0Hf1cVAIg5kJ:sxZJH2/fbsm40l/b4/5/6Cq
TLSH
T16B22C71A6E34697B8CCBE20DBB15BF43E2F9103295D11E48EAFC861C05E66CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2a01d81caa32c8161b5e43916f02ee85bdaa64eaa9fd0912d6636ad7f919be2a
MD5 fd54ceccb4c935976dbb0062d1dbf0f9
SHA1 f89cb4a5e3f68606ab46dec4729e70ae41d9a2c7
SHA512 1142c0b0070fad660f64bbfdc2619ce4538b918769830bdc78ff27df56c4c3ef27a7c1b4edd0fa518f5acc4a575eae84016c2170efe5e41a14c6f7b1d276e22a
SSDEEP 192:sxZJRtb2/fbsZ4tiMIdpG4/W6+WN7W1/Y0HfEcVAIg5GJ:sxZJH2/fbsZ40z/b4/5/9C4
TLSH
T18B22C75A6E38697B8CCBE20DBA15BF53E2F9503255D11E48E6FCC71C05E66CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c69361e1e918ca477db4b73e47cc1bedc65e0544b09a7e528b4b163f13aedc5d
MD5 c9aba7ad27cbbb4ec5ec493f48efa526
SHA1 c094e97c346df87085ee02b8555467710dbb2d78
SHA512 ef6e4218336edda6e7d3eb6ec16ee1b1effad8d44bf3427dba5235d9f19c7717ad418631b5837c5a24fd5621ab979f1ac71a42d7332a273f0eb018219eb9f54d
SSDEEP 192:sxZJRtb2/fbsZ4tiMIdpo4/W6+WN7W1/Y0HfMcVAIg5GJ:sxZJH2/fbsZ40l/b4/5/VC4
TLSH
T14C22B65A6E38697B8CCBE20DBA15BF53E2F9503255D11E48E6FCC71C05E66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 96237725217fa8a762705385a98981d7785ae625d5f2cf3d69e986c9e19b9135
MD5 d486d0b10b919cd3f5d31fe36e45298b
SHA1 e1a122c76fef88acb307ae2ae670ad0d431737df
SHA512 4479423f584b1ebd1400090cf279b69bdfec9fd59af64df17d05a96abaf47d6cc2fab96231bcc5a31970d0fcac0cc878c62d31a59beef4ce6d7247eae31fc8d7
SSDEEP 768:vAY2I87M23TWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NyLl/cu0yNqroj6:vAY2I87M23TWRmjdQVxu1jaKNyLpc3yC
TLSH
T12DD2E93F240CCB7E4FC15A9DDD166F976EA802C7A6688D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 924eff87472a5fe1f7a12b404d66899700825f3d8364d6d2ddb0ff285a5df942
MD5 725ab90e05466831db3f155911ec9ada
SHA1 ba9b5bf1077ade147f749a2f8a4665cb4e725372
SHA512 ff4a37caa62eea174d97efaa44f97d95de46d5fec1c63166389563e3725d2dbb3002bef34fdc5c1115be3cd60d0cf8389478e3e469725a426b2294f0cb7a3eda
SSDEEP 24:Kr1ehMlIfKJhq1qSc3DyXexedE36tCcgIpKGh41iSv0pyXtCl829Lmf9ICF2KjVY:K8uIfKPqc7yp6HIpKw48PyOqIvKXqMi
TLSH
T14F91805135BA02403DBD691891F68B1F429131B73558EA2B3FAD04E69E37E190DFEAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b179300b-dc1c-4e97-8f2d-7449906307ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b179300b-dc1c-4e97-8f2d-7449906307ee.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6b80202-41fb-4eb9-9d85-77dc81a119ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e6b80202-41fb-4eb9-9d85-77dc81a119ac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 212d26db04b0f5ecdb50eef93a61b6709e2b5c315e902565c0637dda78812384
MD5 c929c6988d22b3b215912da5d08f4ee1
SHA1 7649a05376339e124dc1de25486d2ad9bc1b03a8
SHA512 bc566dfea441de9ad0192773b8a3944e4e809c4d2599363c27618ee756329a20690614c5b39d8a1a9a8663c7f5615213602359efd5da93e1f189283d0f773196
SSDEEP 384:dZcIh8N5H94johKrI8e9ckX5mV8f0yn5rBtgOIwZOyfvok:FhiCtsAyTnJBXsaP
TLSH
T184827D3A9C789C762DF7A145F58B37079EB8801B9BC56B8494EC5B1D01EA2EC130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 370a55aea68a8ef28e3f9a3193aabf166b085ea63e4920f9a1e96946b198c421
MD5 1f3abe53e51f51d7e46c73c3908781e3
SHA1 db337c4bef494c9baef5e974df7004d3f50bdb6d
SHA512 cb15c075ca3f198e5e2760ceecfd487fe4b23d581fceafa74d77d8d518d9fa6bfa1406fe656d4f851fa7ba952e0468a59cf85c21926df8e6d2c3234d28c841e4
SSDEEP 384:eiFiZcIG8Nb8TUNTUlIlo94johKrI/e9ckX5mV8f0yn5wBtgOIwZOyfvok:1FQGmwgcttsAyTn+BXsaP
TLSH
T19FC22AF648E7887ADDAE9747A77E2E028DBCC017B580A650B3984A1DCC961BFD307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4a64192fb8c24c507578fc5c8488fd9ac98dfbc0de2c9472014ab16b892d0b2b
MD5 294c7c6b9403670b2785d244480c366e
SHA1 fb087539d958df65362f495afeb1178a8b7bbaf2
SHA512 70a97845b92abcd8b5e3dbdda6ee504955fb124349363f4d2cf8475a350b2065cb814855180a0c3a39a435b3cabf058fea5b31f8a7be6ab578a58f834e950407
SSDEEP 192:AGNI6WLkQmiUyOmELEbnckX5m9r8f0poK4lmoyTU6:AGNI6a0VlLQckX5mV8f0yLYTU6
TLSH
T15202D839AC787C7B9EF3AD55B94637179EE5112BEA812F44DAE80E1D00D769C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8d349de61b98cdf6cdf0cc9b06041bc21e5d592c6b6a60f5b3ac29c0fb434e13
MD5 1598a82712033b1314132da5ae906068
SHA1 7447a75eb2b63c0d800e286c994248626eb40fc2
SHA512 dbf3bbb71fcd1d37ecc2456658aec5d1e5fd115396dbf26eeb22bea3ce57ae1d6e30f3321d222b2f3a49c7b077fad8da56639867e769dbee9aa0f4e5d3a23197
SSDEEP 384:LZcIh8N5o94johKrI8e9ckX5mV8f0yn5rBtgOIwZOyfvok:Th3CtsAyTnJBXsaP
TLSH
T1E8828D3A98789C762DF7E145F58B37079EB8801B9BC56B8494EC5B1D01EA2EC130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24a9fc0278ee7103bf28f55e26b1c44c5ce2bea0f15fbd7eda43c44102d974bf
MD5 18cc5904be2c646209283bfda472afc9
SHA1 a7e527248942e319e58ab83bd5b608c1fe72858e
SHA512 ca473128a9f46c8b928de1bb7f68228ec7ca0b167b894a5647774162cdeb785384c101a753f97fc0f69627deb866da4c20aecefa3f79943451cd5e7f2e144bd6
SSDEEP 192:AGNk6WLFQmiUylEdcEbnckX5m9r8f0pon5sMea/iU6:AGNk6ajNaQckX5mV8f0yn5SBU6
TLSH
T1BA122B3AA878B8775EE3A455B48736175DE5421BDB857B44D5EC1A1C00EF2AC230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads