hxxp://trendoras[.]online

Analysis

user interaction
yes
max time kernel
76s
max time network
81s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://trendoras.online
Sample260928-n7kn6sshkb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{A4BAB80F-9FC2-437B-8DCE-0B1384B63529}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 5960	3324	msedge.exe	88
PID 3324 wrote to memory of 1608	3324	msedge.exe	91
PID 3324 wrote to memory of 4756	3324	msedge.exe	92
PID 3324 wrote to memory of 1608	3324	msedge.exe	91
PID 3324 wrote to memory of 1608	3324	msedge.exe	91
PID 3324 wrote to memory of 1352	3324	msedge.exe	93
PID 3324 wrote to memory of 1352	3324	msedge.exe	93
PID 3324 wrote to memory of 4700	3324	msedge.exe	94
PID 3324 wrote to memory of 4700	3324	msedge.exe	94
PID 3324 wrote to memory of 4700	3324	msedge.exe	94
PID 3324 wrote to memory of 5516	3324	msedge.exe	95
PID 3324 wrote to memory of 5516	3324	msedge.exe	95
PID 3324 wrote to memory of 5516	3324	msedge.exe	95
PID 3324 wrote to memory of 5556	3324	msedge.exe	96
PID 3324 wrote to memory of 5556	3324	msedge.exe	96
PID 3324 wrote to memory of 5556	3324	msedge.exe	96
PID 3324 wrote to memory of 4200	3324	msedge.exe	97
PID 3324 wrote to memory of 4200	3324	msedge.exe	97
PID 3324 wrote to memory of 4200	3324	msedge.exe	97
PID 3324 wrote to memory of 3968	3324	msedge.exe	99
PID 3324 wrote to memory of 3968	3324	msedge.exe	99
PID 3324 wrote to memory of 3968	3324	msedge.exe	99
PID 3324 wrote to memory of 3524	3324	msedge.exe	100
PID 3324 wrote to memory of 472	3324	msedge.exe	101
PID 3324 wrote to memory of 3524	3324	msedge.exe	100
PID 3324 wrote to memory of 472	3324	msedge.exe	101
PID 3324 wrote to memory of 4456	3324	msedge.exe	103
PID 3324 wrote to memory of 6036	3324	msedge.exe	107
PID 3324 wrote to memory of 3344	3324	msedge.exe	108
PID 3324 wrote to memory of 2748	3324	msedge.exe	109
PID 3324 wrote to memory of 6040	3324	msedge.exe	110
PID 3324 wrote to memory of 6040	3324	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://trendoras.online
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdd66bc188,0x7ffdd66bc194,0x7ffdd66bc1a0
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,11570951619361245854,13366599341908007076,262144 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,10821956634818368876,15028290523810617495,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,1027929749521989331,15280900602102649607,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,6428070251894863518,17695937424038685057,2097152 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,15871889933329559113,3100126797076485014,2097152 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17142602374219336301,17580146929552821330,2097152 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=2840,i,2462083093057907493,16143400693774944262,2097152 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:9
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5392,i,15337804068959709621,1007133582946973135,2097152 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,15198017372015849155,11092144036733762683,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,461316929478418118,1853031137315004935,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9888080481421179347,274000498212262328,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9888080481421179347,274000498212262328,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,1770795565379649269,16488756987420338562,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,6761749693240960699,9865786543272672899,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,235085068246535470,10404513899770659071,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,11677436413815989776,937321857050274174,524288 --field-trial-handle=2732,i,2177457721647692762,15157846419463220021,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4521edb6-f920-4db1-94c1-277651bb6e00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4521edb6-f920-4db1-94c1-277651bb6e00.tmp
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 daa3b8332ad067828eff08bea3b793c0c9cad457e730ce6dc07f5150269b02d7
MD5 b0f56a3ab40852d4ae4cd59057457f9a
SHA1 4c4c20d6469b31646829df4bef609a40c97e948f
SHA512 53f2dda2bcce6c6c38cc50c34278d683b86f029c0eab9715e8ec2cc1d91b846322b5dcc996ef79b39f4d1dca57fb86e0ecb36e5e9e0d0426469661e356e74ba3
TLSH
T15E5152CC86E04243FB5D053065CEFB533F7961B1A5630E820999CCBC6F4AB92CD902EA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e1fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e1fa.TMP
Size 2KB
SHA256 a13f2984eff44f84610042d3f1aab5ff6096e520781054a3e722fcc7944faca5
MD5 9363ca284f5f2f4d3f16025ce33a7597
SHA1 06a64ae4b5f68778c42f7df51e3729b9f44294fa
SHA512 797882ab2f885c1e6160cb162cec139581c50045aba21ec6c511676041f6fd451b296d765fe34e6b0b8eb80719d1d51f27b2e788412c2092e8b0e47efc189ff8
TLSH
T1734140CC8AE04793FB5D0131A5DE77A73F74A6B2A5831E4205A9C4BD8B46BA7CD140CC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c41b4f17b0076a36c8e68395365a01b829fd78227d4d5462a982f5991df57da
MD5 47ee4bc7c7d3b3b2dcad5c3abfb230ea
SHA1 95a674912e96256afc8d7234ca0929f1ef2d6cd4
SHA512 ffb40b80fc46e58dc426636da369c701fc84291443d1476e9071dc5ba16885fba830976bd5721156f3b330b144b4da0e1cd7ca0ba75c56bc7225430e93d79557
TLSH
T1B3519DF783F4996EC90191F0B6186E1BCE5D0928436C3C5AC9E46E1B53E74B1E240A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0d9daffcf110cf917966183076e60268bd5999b4f81279a7e4975afeb7b2cd3b
MD5 e213539fd5be78dbc4647293769dd332
SHA1 513586bcd40f5c23b9db3a45fb429f62de7b31ef
SHA512 4d26d042700fde321dc7b9914ea1a54e5915769c52622603e17e3ce6165d694b9419b3ba9947bd502e5c0a477fe5acbbe3bd089ab76d8a4542d97b7d122cdca5
TLSH
T15021DCF7C2E8567D890192F86B282E1BCE2D0915932C3D5BC8D49B5F93E18B1E29095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1a3724056a5dfbb199bc571f9fd771f9fe6bffc05b32c3331aa418aaf9be8aaf
MD5 dcd04aa42ae9b0c5942f25b0adbae78d
SHA1 106c44ec075d028361d2c022194fe5b1e19523e0
SHA512 550989a89e26c0931cb47f26b7e83595df0d523f1a8cadc8569ee75dc9677c55df0b7e587b02a703bb6ba807179a8d7c1c359ffe2d77378a4c8800168591e897
TLSH
T15B21DCF7C3E8567D890192F86B282E1BCE2D0915932C3D5BC8D49B5F93E18B1E29095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 403b1e43cf2e3ce185981b924cbd32d99b6ce67ebd631b1e81cce488772c09b9
MD5 4e189f2d2ef4a4b51315e52e561b0e9b
SHA1 c7153e45d6402dbf3600c2b3a483c01bcf61b3ad
SHA512 73506f9402d32482ddd1bee5f90e01745cae7ca62314d2d10124587d5bd5e26ffb3880020c1666a127e46575b52fa7f7d1fc4238541a5dec2cc0c5871c8455e9
SSDEEP 192:sxRgpml0/fFsiuQ7R73JzoA8pbw/g6+WN5bhXYlacIHGUIgDbJ:sxRgpO0/fFsxy73U8/5fXtx
TLSH
T1AC42B715AD28A97B4CCBD219BB65BF53E3F95033A0901E58B6FC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2db8bcbe31efc78f3ffcc2a11b5c01f7da01ef337ca477660254fb5b968d717d
MD5 057ab8e9abe2bcc2c1c9ea30379367d6
SHA1 bfdb72c56a2327d4e2faeb1a13f4d5ef2496d154
SHA512 a61bc3cce7d19d63301280bbc980582a79bc82cc3589afd6eac04f43245d7cbcb5a2b2ea0bb605887bfffb073c8431ac9a80bdb67405ff8c8a0917b0406188f6
SSDEEP 192:sxRgpmb0/fFs/uQ7R73JzoA8pbw/g6+WN55O/Ylac9HGUIgDVJ:sxRgp40/fFsGy73U8/5K/Sz
TLSH
T15A42A815AD28A97B4CCBD219BB657F63E7F95033A0901F58B6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 93a2be3399a5553f1da0bf46c95f4ba421c68ac9c6b5cdc9e7d7e9ee0d85f1b7
MD5 fcb5385f9f2b29ebbd059f8fc70567b3
SHA1 3bc0795ad6639dbf87fa94d7a7bb1b18aab66580
SHA512 36bcfddccbdc6cdbf2d4b972b3cb89b7a9f2805eeb2071df848d14be737f00e10f43e13cd2d2db70c02ee22b41792358225525b092e34d33468cc3d23d3b4432
SSDEEP 192:sxRgimb0/fFsKuQ7R73JzoA8pbw/g6+WN55O/Ylac9HGUIgIJ:sxRgi40/fFs5y73U8/5K/Ss
TLSH
T17432A7156D28A97B4CCBD219BB657F63E7F95033A0901E58B6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 08403ee342240080bde918313aaec23ab7677be444f5170de59c2211e4e76164
MD5 10ed545d9187719f25681a3ac7e8f641
SHA1 5aa3ac9dfa64db770a75443ab877daea924dab98
SHA512 20119ce0f8cb1f4e18c544cfa7e79f8e7ee42cc6ea52802a8e9a8558371e0364bea36f2d14a3885988a5f8456c8e897b8fade07fe0c9c2fe48bc0d8c2d46ff33
SSDEEP 96:KJABUQieyg+WrzIIgKQ1IKgEYIbqgtisgKpWqMoK56TSoQKheh:KABUQieyvWrUIM1IK3YIbqgtjimz2
TLSH
T16BC1ED1072FE020538BE695A8171971B068172F3305AEA3A7FBC35A65A67E046CBDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ee2bf0f2-5366-4ec8-8f54-44597394dae1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee2bf0f2-5366-4ec8-8f54-44597394dae1.tmp
Size 23KB
SHA256 8e7be75d99ab72bef77efd7ee818db51705cab0c7959aeb8895b7c72bf6d42c8
MD5 a6f085a641b3e4913f3bb64f7d511dd2
SHA1 a0d91885c4fa02d388b40ca57bfc1eab0baecb03
SHA512 5e5f7c06b9715a38a329995c64439931559b71a505f979bc90c19db6aa5a27ffbe65db4045b9126b0bfa9e6da31a8f9e5a11ba085d647102789ad431dcf82278
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfsroe28:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0V5
TLSH
T184B2E93B640CCB7E8F814AEDDC196F976E9C02C796588D8047FE994C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d8d9e2d-47f3-4fc0-896a-b25413c7f66f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2d8d9e2d-47f3-4fc0-896a-b25413c7f66f.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2913fe56c86fa6b0843aaaa99e945423ca78bc23c6b1a1b429fa686a2c32889e
MD5 7728d0aec55290581069c00ca2835664
SHA1 0b006caa95e9d0a7b45a4a4d9affb039d0d721f5
SHA512 2acb846667c593c527de2b4bd53e52e7ac97b98879711e062857d9bd69bd3ec59571881e7c6b070fed7039617c5a16b9cfcd43152e7f9fcfdc6628777ee48065
SSDEEP 768:Hh35itSFajBdpYnqMwQi5BgK5/CwYcZ64YGHUX:Hh35sz6VmBg8/dQ4YUUX
TLSH
T1EAF2BE32DCB58DF75CFA9280E6927747AFF85243D599096880DE6A0E029BDED1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aa54f2c21b8f52d5c66b6b0fb4e235da3793b5c04df790d8b02e5f16c78607b2
MD5 78b9411db741346a42f47d012593c6ee
SHA1 aad0e92263ad987c2b1b4c47836ed7a80ec54b7f
SHA512 fe7fba36107c63a3fb8cab8a3df043479a732b42511da696e101d3b67c1f95b2ea53a4a9ab0584c21c8cdd29bb9bf971abe96c0e296a526aa9d785211ba1db87
SSDEEP 768:L/UxvxjgC+I35HtSFajBdpYnqMwQi5BgK5/CwYcZ6EgMp:+Zj3+I35fz6VmBg8/dQENp
TLSH
T13A03BE36ECB59DB75CF69240B28A7797EFF45253D48509A844EE5E0E068BAED030BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5f14511f770b26f4f9a72e9f2a4ff173580375b5cb6d8241fad298fa91d35b0b
MD5 4852713003905cfd5bc46826f117818c
SHA1 955f2cfc9fb9a120bff176b257a656669101db7c
SHA512 a6223c7e81101617680fdc105916931538a55a61c838c73a7e1c856f75db37526d6b0847da830ced9c59670b6c79e5493b3bb6c0bc3b31d3656c9316fbd079de
SSDEEP 768:rFQZ3swgHJtSFajBdpijnqMwQi5BgK5/CwYcZ64YGHUX:+Z3ehzsjVmBg8/dQ4YUUX
TLSH
T126135AF288E389B7D8AD8743A77D2E42AEBCC153B4950464B3C9590DCD979BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7e4c51aa68c72714aaeb75b24ce09b303e5dcdfdbc1c972842f7c4f8707ac13f
MD5 681ee6b9155730e6d082f027050cad7e
SHA1 2c6f09953aee325ce5c95be3f67c2b0a555b8159
SHA512 0e97627ab4b1957b8eaa886ccbb8fa5716e0ed52971f420ae61c0d7cdfdfcd5b802bf7b50efaaa1d436e0bf6931393965fd18e09d57d84f3ce404be393ce3df6
SSDEEP 768:3h3kitSFajBdpYnqMwQi5BgK5/CwYcZ64YGHUX:3h3ksz6VmBg8/dQ4YUUX
TLSH
T104F2BE32DCB58DF74CFA9281E6927647AFF85243D599096880DE6B0E029BDED1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 be5e1a98b7b15a7ba9156dc4f83be5cb4b6858e8065155b147d45c16f8cb02a1
MD5 fea54035762ecda9c11ab3ed4e8b8a18
SHA1 25ef3ddaea11398d7fd7d6f3e4d10aa0b3d91844
SHA512 613c332ad4b3e2e1679bf5fd4efff24787765502286b2f3f6ca01628b088e67e5ff808e63aba564f860063821a370aefceb532d4313bd6671fc8666934344dac
SSDEEP 768:O/UxvxjgC+Ft3VbZRSFajBdUnqMwQi5BgK5/CwYcl0A8Dea:DZj3+Ft3VbNzUVmBg8/dqA8Sa
TLSH
T1E403D036ECB49DB78CFA9240774A639BEFF45253D58009A889ED1E0E07C7AAC1307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa245197-c247-4c6c-9641-5bbef7ca3290.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa245197-c247-4c6c-9641-5bbef7ca3290.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads