hxxp://excellentfurnace[.]ca

Analysis

user interaction
yes
max time kernel
47s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://excellentfurnace.ca
Sample260930-fbffkseh23

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{43DD5EDC-50F6-4727-B179-3F94E5F3B929}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4640	4840	msedge.exe	86
PID 4840 wrote to memory of 4168	4840	msedge.exe	87
PID 4840 wrote to memory of 1832	4840	msedge.exe	88
PID 4840 wrote to memory of 4168	4840	msedge.exe	87
PID 4840 wrote to memory of 4168	4840	msedge.exe	87
PID 4840 wrote to memory of 3940	4840	msedge.exe	89
PID 4840 wrote to memory of 3940	4840	msedge.exe	89
PID 4840 wrote to memory of 1648	4840	msedge.exe	92
PID 4840 wrote to memory of 1648	4840	msedge.exe	92
PID 4840 wrote to memory of 1648	4840	msedge.exe	92
PID 4840 wrote to memory of 2352	4840	msedge.exe	91
PID 4840 wrote to memory of 2352	4840	msedge.exe	91
PID 4840 wrote to memory of 2352	4840	msedge.exe	91
PID 4840 wrote to memory of 4832	4840	msedge.exe	93
PID 4840 wrote to memory of 1416	4840	msedge.exe	94
PID 4840 wrote to memory of 4832	4840	msedge.exe	93
PID 4840 wrote to memory of 4832	4840	msedge.exe	93
PID 4840 wrote to memory of 1416	4840	msedge.exe	94
PID 4840 wrote to memory of 1416	4840	msedge.exe	94
PID 4840 wrote to memory of 1604	4840	msedge.exe	97
PID 4840 wrote to memory of 1604	4840	msedge.exe	97
PID 4840 wrote to memory of 1604	4840	msedge.exe	97
PID 4840 wrote to memory of 2844	4840	msedge.exe	99
PID 4840 wrote to memory of 2844	4840	msedge.exe	99
PID 4840 wrote to memory of 3296	4840	msedge.exe	100
PID 4840 wrote to memory of 3296	4840	msedge.exe	100
PID 4840 wrote to memory of 2144	4840	msedge.exe	104
PID 4840 wrote to memory of 4240	4840	msedge.exe	110
PID 4840 wrote to memory of 4240	4840	msedge.exe	110
PID 4840 wrote to memory of 4240	4840	msedge.exe	110
PID 4840 wrote to memory of 5416	4840	msedge.exe	117
PID 4840 wrote to memory of 5424	4840	msedge.exe	118
PID 4840 wrote to memory of 5432	4840	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://excellentfurnace.ca
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb0e76c188,0x7ffb0e76c194,0x7ffb0e76c1a0
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5435800148631895865,10561424763573569842,262144 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14545618645899887847,9802109571120735065,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,14474234524094461568,12887203512111071141,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15430243679180993147,16421798365410629723,2097152 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17657037666625601327,1798170527736811133,2097152 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,7678802315364564332,14576414026214189412,2097152 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,14639587774392283065,3145994531246098968,2097152 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3864,i,5444224443147061075,8705200376147629560,2097152 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4517005738838919968,14398574451110146908,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,15126194941758914652,3459785937003805496,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7792394656399439397,1906490705390838185,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7792394656399439397,1906490705390838185,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6280,i,16238723929608621469,8505026745057212675,2097152 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,14509654725718357593,7945382550929301540,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,1030254480505323330,1417230144881707610,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,6385035070857812081,8241744473818307409,524288 --field-trial-handle=2672,i,8496266776069724183,12717121999733267911,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fbeb03c55fa74339a6fb7553c3e84c94d9ea21cfc58ca8a34dcf02b17ecde1c0
MD5 be8449863515258c158e4ed98890d930
SHA1 1aad454635f693e3cd331bff0953ff3c06da00bf
SHA512 311f0c30213e003eaeb13ebe29b86bbb9565376677b7e012a72e432e44427f48bd20731d691edd87e3798ea0da04b08743bff122567fe76a449f1e81249a2f10
TLSH
T15D616956E1A14070CB95AC717CC21EC37F34EA7856B30EF219A6D974BF43F9160013A4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b29d052c-2df2-42ac-b50e-5a9702a2269e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b29d052c-2df2-42ac-b50e-5a9702a2269e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0dc2dc6e31d380409cf1db16ccacca697a7d9ced89caf9935f5094dc80c5b8c6
MD5 dda92fe29d8e5fa8fd80a9b1cb8e2e33
SHA1 7ca910b3c8a6f6565eb8e38b964d7b361bdff049
SHA512 89fbd38208359f25f7dbf0763bb00a9e6b82adbd5b9961a40b32e37d3fef3022501ff3f15c7dc7049267bb82a1db6c734f716c7977d3c1b0d34e69627e217a18
SSDEEP 192:sxZsRyWN/fysuTJIdp/eHW6+WN0rQ/YappRxIgrJ:sxZsDN/fysuuWHbP/j9
TLSH
T1B522A7526E38A97B8CC7E20DBA55BF63D6F95032A1D11E48A6FC951C04E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1af13b2edd84b142dc5861b156c9911acd09c6cf70adec6242e62316086c702e
MD5 a238719fbb27cd601ddc0bbb5e8e8e94
SHA1 a1f15c02da70d5432b71f3471d065fed88d0e9a8
SHA512 f8df7d2c6f0267b32f0c90a1863c1968454a79f4efe4b674920f4ec48b6df27c81ddbcdac945ad9a59071e68a6cb1571940817e29838573755a86c56677d3eb0
SSDEEP 192:sxZsRyWN/fysFTJIdp/eHW6+WN0rQ/YapQRxIg5JJ:sxZsDN/fysFuWHbP/ch
TLSH
T1F922C9526E38A97B8CC7E20DBA55BF63E6F9503251D11E48B6FC961C05E77CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b1760c043eaa91c004f1cd2c43101e3b85bb75f565491815255cc00df93c4394
MD5 57e0758111df9dbb825c32080e9a4806
SHA1 a2909f2e358d6dc71a4ec0af30293ceeaa2a2422
SHA512 e3239667efbfe1763a910cbd906c4896c2ac22db9745f68019e9a1c0866d800660ec7ed26a14131f11977c7ff250b6de2575e70f50e1dbc1110c297970447f59
SSDEEP 192:sxZsRyWN/fysETJIdp/eHW6+WN0rQ/YappRxIg5rJ:sxZsDN/fysEuWHbP/jf
TLSH
T17822B7526E38A97B8CC7E20DBA55BF63D6F95032A1D11E48B6FC951C04E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 63072c75ff93d9eab3e8d550c284b03868b211abaa2d6bd2612d48b25fa9deb4
MD5 e58923dbc7aab7bcffde6f2335e52cb9
SHA1 fb9f976881368f3d11ebd53f092e965985efc5fc
SHA512 ed07bee706e45e2c0112b0b10bab05c59f198a461988a3c56210aaa9d54e3daa74ca3408810ab6ca2a99d8e3e5fce7c51d56f5a1fb1bb5c76671561b7f6a5971
SSDEEP 768:8oWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7/ro4Wfe2tmR6:8oWPcLKWvKeEeu1jaClLiF7s4WW2tmR6
TLSH
T154C2EA3B640CCB7E5FC01A9DDC5A6FA77E9802C796548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fd598c7f87c29118c7249365e85091c9ae8352293fe69e0dbd6719b06949dae7
MD5 0e6c6b714c7298bb3b7bdb4874691120
SHA1 dbf02b9736b6e8ff4c1909e95c13cb5e82baf08e
SHA512 d0c2b115ce0ae182d2d034671a5bd446a6cf679d24b480526f1b300fa813c404a79473fea3daeede757bff334dffe229cb765119bd1b70fc7b912fe53f31e7db
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyLitwciAgxb8LsIS0xK941Cxx6hYj04C:KkSIKHq2W1GKewFgwK1Wqv
TLSH
T10C918110717B520138BD385891788B1F568635B7300DEA2BBBBD14AA4EAFE04DCFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 07d26a0d240583befd66c7c254c21b2bf89c868fd0037f56b4021c3e09eaf5ce
MD5 005aae6f637f2d25c928f7219c390344
SHA1 2f1c7d6358c482003fec74c241cb8b6672c4ecbb
SHA512 b9a24f6df7269ac6c47714e1ac446358718b9580d5a6434e84ecce52cf8c21a3845c056268026ce9212f1b562c9b11ee4ecd0bde68ea5ec5bf09d764be084801
SSDEEP 384:7ZcIhsN7oQB1RrRzIGmjs9X+bVeihtgOIwZOyiLSoc:jhCBzdks9X44ihXsx2r
TLSH
T13F828E329DBC6CB76DF7A544F4863A135EB48127E2C9AB94D4DDAB1C00DE298130BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 eeaa4208be252ef7519f0b6fafcf95f2206a9165f4bdfc406406b3b30d64220d
MD5 03eb2575bbe0bb54bbe8c989fc012c58
SHA1 566d15fa70ebdbe40f34d3b702792e46d8a1c904
SHA512 f68111420f58c0a14c938abb58e821450f4e81839451bdde1817708712546472ca044d48c43cd1175cd05132a087400d2c6e70d5a7a1eade3e383249f0ea2b05
SSDEEP 384:0ZcIhsN7fQB1RrRzIGmjs9X+bVeihtgOIwZOyiLSoc:yhnBzdks9X44ihXsx2r
TLSH
T176828E729DB86CB75DF7A944F0863A135EB48127E2C9AB54D4EDAB1C00DA298130BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ab8eb6e31f0116627db9b67b4b1af19d16e424cd626a6199d24f050e2596d50
MD5 e9f5c6f5d7bbe7c8a85f719517b03579
SHA1 4abb85d8f1cd7c8ebe28cb09b21104337e202178
SHA512 53d67cce32c802d7dd3dfb6435b0194ead6f3bac385e3e40f574f7c6420cd301be3291054006a29daabcb15ecf2a8d9a3b8874bd444a8cfb0b18288c13a9101f
SSDEEP 192:aON26IERQmiUyZOaTjuIGmjs9X+8iVJ27HhqQU6:aON26DvAjuIGmjs9X+bVWHhU6
TLSH
T138121A31EDB8BC675EE3A844F48739239EA58227E6897F94D5DC1A1C01EF25C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ee1a2c5b005f05b59c6c4039e3480c1e30db2c32b463581cb3b39585358ba418
MD5 de97e8f2b3dad542e9f1b9d76a701f54
SHA1 90f21bcfa3b96c840fd3acce36b22e702b445619
SHA512 985310ddb5dc4e1c2e6b51c2832a160ce9ccbb15a9414afc3a04868d045f66c679aab47376addab08ed4570765b90ae8880827fe17756de2fb551f4efda25881
SSDEEP 192:aONx6IE7QmiUyZVaTPuIGmjs9X+8DC7s2JU6:aONx6DtxPuIGmjs9X+FsSU6
TLSH
T1CB02E835AD787CB79EF3AD09F4872A236FA5112BE5952F84DAE81A1C00DB24C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f353b112-a702-49f3-87a0-a1eed9ce57da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f353b112-a702-49f3-87a0-a1eed9ce57da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cbd8a180889be5280a04cbf45fc82dec279f1fa476389c2bc067fbf7ea8c8a41
MD5 f553bf461e329db350cd7d6293f10ba5
SHA1 c5506df3c5c06260ab41b5b6774d98580b91cc5c
SHA512 e8d8a46c9827def47106bf489ab928986a6613621c08ac5ed8f7bfd50efce1ecd429e62b19c8dd7d0b54789b1f0cb52607be5144ebc98f54f783ee63af9bfcdd
TLSH
T199412A4DB6EA1148F3B36F55ABF6A86E847FB9772E0BD49E00110E4E0663A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads