hxxp://pgd3lrzwit65obpm2jucgrab5zft7c7n4kzn5lbtxhns746pkwha[.]v6ogyjbvkexbdlbwjnaxky4mypt6laktroe4bqjcqtlvudas3w4q[.]westeurope[.]waconazure[.]com

Analysis

user interaction
yes
max time kernel
12s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pgd3lrzwit65obpm2jucgrab5zft7c7n4kzn5lbtxhns746pkwha.v6ogyjbvkexbdlbwjnaxky4mypt6laktroe4bqjcqtlvudas3w4q.westeurope.waconazure.com
Sample260623-vft7vset5n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267073901252891"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{8C303C43-DFA1-4EB9-9D3E-456FB1F08732}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2040	4716	msedge.exe	88
PID 4716 wrote to memory of 3452	4716	msedge.exe	89
PID 4716 wrote to memory of 692	4716	msedge.exe	91
PID 4716 wrote to memory of 3452	4716	msedge.exe	89
PID 4716 wrote to memory of 3452	4716	msedge.exe	89
PID 4716 wrote to memory of 4052	4716	msedge.exe	92
PID 4716 wrote to memory of 4052	4716	msedge.exe	92
PID 4716 wrote to memory of 1732	4716	msedge.exe	93
PID 4716 wrote to memory of 1108	4716	msedge.exe	94
PID 4716 wrote to memory of 1732	4716	msedge.exe	93
PID 4716 wrote to memory of 1732	4716	msedge.exe	93
PID 4716 wrote to memory of 1108	4716	msedge.exe	94
PID 4716 wrote to memory of 1108	4716	msedge.exe	94
PID 4716 wrote to memory of 4364	4716	msedge.exe	95
PID 4716 wrote to memory of 4364	4716	msedge.exe	95
PID 4716 wrote to memory of 4364	4716	msedge.exe	95
PID 4716 wrote to memory of 4504	4716	msedge.exe	96
PID 4716 wrote to memory of 4504	4716	msedge.exe	96
PID 4716 wrote to memory of 4504	4716	msedge.exe	96
PID 4716 wrote to memory of 4992	4716	msedge.exe	101
PID 4716 wrote to memory of 1140	4716	msedge.exe	102
PID 4716 wrote to memory of 4992	4716	msedge.exe	101
PID 4716 wrote to memory of 1140	4716	msedge.exe	102
PID 4716 wrote to memory of 688	4716	msedge.exe	104
PID 4716 wrote to memory of 4792	4716	msedge.exe	106
PID 4716 wrote to memory of 4792	4716	msedge.exe	106
PID 4716 wrote to memory of 4792	4716	msedge.exe	106
PID 4716 wrote to memory of 3300	4716	msedge.exe	107
PID 4716 wrote to memory of 3300	4716	msedge.exe	107
PID 4716 wrote to memory of 3300	4716	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pgd3lrzwit65obpm2jucgrab5zft7c7n4kzn5lbtxhns746pkwha.v6ogyjbvkexbdlbwjnaxky4mypt6laktroe4bqjcqtlvudas3w4q.westeurope.waconazure.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffe0d44c188,0x7ffe0d44c194,0x7ffe0d44c1a0
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,17492238754202507755,5330653522544827675,262144 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4441750334288479663,7890129726535152920,524288 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,7120000462459399237,4993905774640673781,524288 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2175258937783241742,4780795735242732037,2097152 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3791251570113602688,2966697068862687888,2097152 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,10610616824701584999,12758564932261458767,2097152 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,4948610050316659701,18432515796670820373,2097152 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8180744496474687430,12882885528254516898,524288 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11886696166953807487,1478631010632925183,524288 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,4852087855191145908,5824721586163778722,524288 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,4852087855191145908,5824721586163778722,524288 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,9509672829114158546,13543119031103579378,2097152 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3564,i,17110030469380976836,5273166350150540567,2097152 --field-trial-handle=2308,i,1242124131906560746,10893610090344963379,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a6e033473df97953d2c20420b4e717d12b406d6c2082d394b84d9a489fc20f46
MD5 b97600aae150b5939a4c87bcdbf97027
SHA1 920269cb73d9eb3bba6658dfba3f9812ba8029e2
SHA512 8a863d27d0693613d24e59e1351101235cbcd2ab511e950841bf0364cafb778ada08aadb7db9b9aad4b9c8a43ace2b38861a0db96bedfe96195bc4af33f5597b
SSDEEP 192:sxZdRbyM/jK1Ml8Mkm/faskbndTIdpeTHieBC6+WNGYzQm+AIgrJ:sxZdnMm/fas8n+4HFGs9
TLSH
T1EB42EA52AA389977CCCBD219F6457B53D6F51473A2940D44AAFCCA0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 85131cfe86af18b1ee6322f5476ee1314f514346e2eaa952ec31add4a86b59a4
MD5 11465d0e1ad9badc93c3cf9882546166
SHA1 9821cfa528a97246dd2855b5b84d1e495a894742
SHA512 4445aff269f614ae374ab7a5eafed22dc5cb4ef88f83744b324c04051474400be9f4c3bc905e58942010706f781a4c1b2251735ca310e535df3322cdc212e5fc
SSDEEP 768:iBW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjhroIHioY3:iBW7kf0Wvqidau1jaa5LA3ja53
TLSH
T186D20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ca878733800e72473dde99f6aed94728fd570098ed232205d18abbba60c66d9d
MD5 7a3f01b6bd8dabae721dbd9be504deb9
SHA1 7959ab672677e4b7bdb18d3ad330bc1a962b0cab
SHA512 f47444f9a4b76334174ab62a220018ac83c9119b0a8fa6a5a1dbf64c9d6697458f636f508d316a311d8f245947a2fe13e5c7bd9bcbe5d52ef761c994e55b21af
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTrGIvKLS0nyVfIBKkIcbyhgIvKpz:KIbCKcrGgKLSuWfKKkIiCgQKpz
TLSH
T19491C71130776743397E2D48B2A6856B6F423092305DF66F3BA810A22E27E524EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 f95d1c026c3d7f6f217293a3c544697722580d4ec989b45d8ec2a3ceb8537594
MD5 c43e49b432e4ad54157f9eeb95fba15e
SHA1 2f1844e6f7dd49304a6574f4cbf0ad664c86e1c3
SHA512 e2b5926be11abe472e79147ab0331f5161f897863d7cc6a0d2d188f6c52b7964d900195247acad5d09994c02eeb213e0cf6dafd6deaf00b522c67a12a1c2c3b2
TLSH
T12E2132C092FA71565E8DA581E30A544B70A13916124E29B6335F58F47FC4C170FEFE35
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 28fc094d4198eeda3cd67e2f4cdced8d928788c548ac1134633138ac9fc9e605
MD5 8e06e9ab0dc8d87c1878f11713ff2764
SHA1 a75dd0edf9384879d79853271cd572420f1e60c7
SHA512 adf6378026bda3feb9f8e00d9489a1ee52ceb00104b51117d4156976cb2c364d20bfd03fd97582abfa1a4cba664bcdc28399cca3229fef3c43319df1a9e2cf48
SSDEEP 384:vvZtNn/s3n9SfsNwIktbiXIoDFD1DITGT0ICacx9e:vxj+9UTAN/Di+0Zacve
TLSH
T11A928D736C7A9D6B5EE2A191F14B370B2FB445B7E2842F44A5EC6F0C00DA3AC2317916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8b901046961c69202145711d4cb046bc239bbb0d47b3c03495807a6ed2cac53
MD5 3647d93913af1887e8174566dbb6c895
SHA1 34345eed2b2237766e024b418317e089f0f80c4e
SHA512 364b3bc400c0c17ee7f35e2b2a391a8203f223b871ccf96be8c1a80068dbe2c14d3c45f4992475fd766a374fb69ee9adff4b1a076940265f6828282ca81c8676
SSDEEP 192:MONH64BAQmiUy1K1HW5GBPKulCx9FUaD60U6:MONH6eAL5W7DFFTU6
TLSH
T123020A756C796C7B9EB2AE44F58637175FE8107BE6945F40EAE42B1C00D764C2303427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8b2c4c13a9c60c57513b7b11bbfa61541c54c0e5f5ce319ddf38b569e290287
MD5 a594dc09e34af53814b7dbe05f8d0647
SHA1 d72f8f7fc3ae5702335ad500232d246b5d6f557f
SHA512 ed1bd94af4bb80a06140e8337cde2e4043fe92da8fc94859e451d501d234c7c5e4c1ff70e5b6fc67cdbf8e330f7a039cc5346a5d3f06af54ff42b496baa51e51
SSDEEP 192:oONx64BjQmiUy12H45GBPKulCx9FLvGvWwyqzU6:oONx6eVZ47DFDKDU6
TLSH
T18E120A76BCB99C2B9EA2A151F48732076FA5416BF7846F40F6DC3A1C01EB69C2307526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a42b048888895bdba67414578e968730279d97f6cd6f0a120ed722f309f1e815
MD5 2db40fb491c128308fea9af8ad6ec301
SHA1 3def01b02c20e0e7448748f61d2cbb3715502377
SHA512 9894b049ed9b34310daa52237fee8ef34f39a421502af5c4c4623a07b00a550449173ba5688c803053b9d83743916bfbfccb8f769090b2f8c12959ba2ccf9025
TLSH
T1FA411A58A7E91148B3B76F555BF6A8AD847B7D332E06D4AE00110D4F0A62B40C8B173B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads