hxxps://cwhe[.]qualitypresence[.]de

Analysis

user interaction
yes
max time kernel
66s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cwhe.qualitypresence.de
Sample260710-qpy5yscv2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4336	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281636225398849"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{4EFB0274-2D9C-4A0F-BFF5-8DEA2CDA0021}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4136	2708	msedge.exe	86
PID 2708 wrote to memory of 4336	2708	msedge.exe	87
PID 2708 wrote to memory of 3500	2708	msedge.exe	88
PID 2708 wrote to memory of 3500	2708	msedge.exe	88
PID 2708 wrote to memory of 3500	2708	msedge.exe	88
PID 2708 wrote to memory of 5100	2708	msedge.exe	89
PID 2708 wrote to memory of 5100	2708	msedge.exe	89
PID 2708 wrote to memory of 4988	2708	msedge.exe	90
PID 2708 wrote to memory of 4988	2708	msedge.exe	90
PID 2708 wrote to memory of 2224	2708	msedge.exe	91
PID 2708 wrote to memory of 4988	2708	msedge.exe	90
PID 2708 wrote to memory of 2224	2708	msedge.exe	91
PID 2708 wrote to memory of 2224	2708	msedge.exe	91
PID 2708 wrote to memory of 3332	2708	msedge.exe	93
PID 2708 wrote to memory of 3568	2708	msedge.exe	94
PID 2708 wrote to memory of 3332	2708	msedge.exe	93
PID 2708 wrote to memory of 3332	2708	msedge.exe	93
PID 2708 wrote to memory of 3568	2708	msedge.exe	94
PID 2708 wrote to memory of 3568	2708	msedge.exe	94
PID 2708 wrote to memory of 2164	2708	msedge.exe	100
PID 2708 wrote to memory of 2068	2708	msedge.exe	101
PID 2708 wrote to memory of 2164	2708	msedge.exe	100
PID 2708 wrote to memory of 2068	2708	msedge.exe	101
PID 2708 wrote to memory of 1784	2708	msedge.exe	103
PID 2708 wrote to memory of 1224	2708	msedge.exe	109
PID 2708 wrote to memory of 1224	2708	msedge.exe	109
PID 2708 wrote to memory of 1224	2708	msedge.exe	109
PID 2708 wrote to memory of 4796	2708	msedge.exe	110
PID 2708 wrote to memory of 4796	2708	msedge.exe	110
PID 2708 wrote to memory of 4796	2708	msedge.exe	110
PID 2708 wrote to memory of 1804	2708	msedge.exe	112
PID 2708 wrote to memory of 892	2708	msedge.exe	113
PID 2708 wrote to memory of 3228	2708	msedge.exe	114
PID 2708 wrote to memory of 3688	2708	msedge.exe	117
PID 2708 wrote to memory of 3688	2708	msedge.exe	117
PID 2708 wrote to memory of 3688	2708	msedge.exe	117
PID 2708 wrote to memory of 2276	2708	msedge.exe	118
PID 2708 wrote to memory of 2276	2708	msedge.exe	118
PID 2708 wrote to memory of 2276	2708	msedge.exe	118
PID 2708 wrote to memory of 1376	2708	msedge.exe	119
PID 2708 wrote to memory of 1376	2708	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cwhe.qualitypresence.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffb20eec188,0x7ffb20eec194,0x7ffb20eec1a0
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,10107697404742335300,3230670517666288606,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,16756049497433977486,15696263984229066961,262144 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16786980347742483574,15146416444828929225,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15668811215039806075,7172489377801332407,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,14000193050776763789,2457699442057675188,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,17564416291948837817,5842196678318851303,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8394493769194096408,7247722520225923915,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,2005266807492669673,4360340340516920164,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,17713209028151651204,9210816342063326725,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14219319788897241769,1961100001611162695,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14219319788897241769,1961100001611162695,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4532,i,16921461775058042808,14425282298239836983,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6004,i,11131735268733679636,17375601234377636478,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,17128342665963431401,5917178266309251566,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4507621600129175139,4957358613672523946,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,17404597959117735043,12758200547718243253,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5108,i,3764534942602695291,9687566836185855782,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4176,i,12328566801878525541,13471708578948111416,2097152 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,9547577672722725095,1056796889937667074,524288 --field-trial-handle=2268,i,1350832984132779805,16543601681666699111,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

2fd6b41c-c4a9-4b10-adef-6f8069cf76ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2fd6b41c-c4a9-4b10-adef-6f8069cf76ee.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 802fb339e7517e4e18f80242a554a574e00819dd6f0a849bd7cb41285766258f
MD5 e3a8c15b35aec8545a6d7582391d5685
SHA1 0fd6fa0908d5f33073ef76034d6440a6e61e9de3
SHA512 06bb5cdfb2fa9e4918d36c2203fe7428b2b8f86bbe2aca1e57f152f0103b2dd85a2cfb51cccea7ad425ed3a86a81b64f51b8e12eaf19a607ad8e240032ec651f
TLSH
T1028151370282A6C0D3A4273990D68224367086EBFF6F5F7D3B9459F12B767250E59DC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 787c700d5fa820418a4474cd3093eb2fc350e1ee3e55242163de22fd633e2c2d
MD5 2b64864119bee60ac8a23f0bac5921b7
SHA1 2e3430b3ef28127ea335c8bc0e304d90ef20b541
SHA512 99145be410ffe30e49c6adbec42c01de9aefc95157b1d601ea577c14c86a2be79f139366834c0b23d7ac8bce7e58d8b079d3ad74a04de326058347f67497d45c
TLSH
T1268161370282A6C0D3A4273990E68224367082EBFF6F5F7D3B9459F12B767250E19DC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58600d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58600d.TMP
Size 3KB
SHA256 1106c3687304c38a0549fde026c9b7c086246556e47ecfe7c77badd1bdcf7c65
MD5 01cb60ec79a8cab8a4d0f28614ccf1fc
SHA1 f9639c14282e704c64abd9e218247c9b855dc16a
SHA512 ecf89d7e44298cf1eb0c94db0690b50096fbd25beca642b34da0888c3dfec608926438c03dde871501fbef290eba7c87217da6b6ddb0bc8c3f4bab63c385a140
TLSH
T1638161370282A6C0D3A4273990E68224367082EBFF6F5F7D3B9459F12B767250E19DC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fd22192d21719ed8e77e059432ba9e027a52f3ac9fe15216468ded9cb47912c1
MD5 1c168e24c7acbb3729f1db7392f85166
SHA1 71064e63567f4543399df141c1c39442b879eb53
SHA512 6bf621543266159a11d429a370f8df7452dcf90abdabb4a13ce0c7653a61afa3584310c1c5482ec5774876d22ad9322884e7e5e24a8d0dbe8a06a88031a3ea95
SSDEEP 192:sxZqgRryM/jK1Ml8Mkaj/f6Ds4Dn9IdpJHW6+WNGYCI9h+44IgrJ:sxZqgfMaj/f6Ds4Dn+JHbG4+Z9
TLSH
T1AC42E8126A346977CCDBD209FA557F53D6F91573A2940D44AEFCCA0C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5e56d8c4bc153ee45b094f193a974fe7436c93b7be8a55eb8c3621ee4c4463d8
MD5 601f42e9837d7aea483db25210b45621
SHA1 50674b3aab89de0689a6fd2c9749e4fc448edc80
SHA512 cda80a64ff26ae3a54475b6ca80726a4df59fe105764ffbdf805e60c091f079c8cfa9086dad672ab7443331ff45d2030e5c685397de722aa1d37cd3d6f684d44
SSDEEP 192:sxZqgRryM/jK1Ml8Mkaj/f6DstE39IdpyzHW6+WN8uz/YCb9h+44Ig5pJ:sxZqg5Maj/f6DstE3+UHbt/L+ZF
TLSH
T14552E7126A3469778CDBD209FA517F53D6F8157292940E44AEFCCA0C05E6BED720782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 be2bbca9b683a901d81fe25dda10edf13a6734987d5f31a863d8b2914d5b90b4
MD5 acaf17f46ed0f426477dd0fd58ca73f7
SHA1 c74af7a99b5eaea678ab079fe00945a4f0944cb5
SHA512 aa9dc9e2d9fbaec80ba9fd2337ae41956e8f2ebc04ed5a57141729ddaffa4491188dfc88e63e994904207f09919b56e50e768edde3f48c17d83e72e8c4338590
SSDEEP 768:Kf8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVlroY:Kf8bqn+WvSCt6u1jaCZLbWVeY
TLSH
T1E0D20B3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b761961c108b82c9de5af500b2192b5e918009414edbb72aa404c7eb9679d31b
MD5 97f5a189365fe336145775afce5f1eba
SHA1 7182c600553d1465651a9d057d24e1ef0b3a27d9
SHA512 0247061f1a95128596b3eca0b8ef85b8ed39ec94595b8b9c8505026b76bdac0d30783c930aae9da79893d546e2d404f9adda6a17d02239798821f4e9c8256f0f
SSDEEP 48:KoXIpK0g0bypQIHKpOXwI/K92c7yfa/Q0CkQzPg9CI4szKpqBOzVqj+lYCf:KoX6K0gCKQoKpOXwgK92SWXOKo43f
TLSH
T11EB1D406303F124638BD252493B6963BCE4172673919ACFF3BB920658E66E514CBDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fcd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fcd9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a68c405225a65fe29e44af07c6049454667447b05215288ba54f8261863c22d9
MD5 6493c53de50c49291d53835eea84ca14
SHA1 6839c07b07ccbecb1aafc969117d545f54b210d5
SHA512 f07141bc29f5eee056b465422ddf001c6f0db1974ea622c879e00278893d91f38f3cb8002e22060d4a75123b900fd9a4896762bac91ef2cf1a9f65729a4042dc
SSDEEP 384:hsNAMv9vHS4Ea+ld8mvOObjI9G6w7CUXw:hEVSba89v29Ms
TLSH
T136727D3268389D7B5EA2A519F48B3A179FF481678F8D3F84E6DD9F0C00DB99C5306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c34cd174a717bd4401aabf5f1271c7382810a7f62ab68a18c6580c7f915dccf3
MD5 16ad022b5c5cb466c64230423bddbbe1
SHA1 0ec18ca5749f57ae48425e266dc6f1823171ebc5
SHA512 1d379d70543dd689d0003764e548d6531c02154c55dcb5d98f4873c2e62b13b7a20c372870905bb8ad7db9230cbdbc7bdaac6a51f6333a3445837acc652655b7
SSDEEP 384:9iFlxzsNA8TUNTUlIl9v9vOS4Ea+ld8levOObjI9G6w7CUXw:0FLJwg3USba8Oev29Ms
TLSH
T164825C335868CD7BAEA29A59F48A36179FF041A7CA89BA84F7CD9F0C00DB59C5306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d82797d43d65a480e20ddd423ec6ba8c8f333dfc1e83d9a85b4ccb1fb1a5ec44
MD5 90b4c981ec383a77a0dff3c07d915c15
SHA1 29bf7dce6bfddee456ab6ae68cec5b49624b2e0c
SHA512 8b45861f1df900144e63318aa7a6168be371fb5cc7c6354d58a3f626b63d496a884eefaef2fc63751685c9f301f1842cb2c4637ec98af5a51781939076258b52
SSDEEP 192:vON3p6Db6QmiUyCiHBa+j2+FdCrtm5RgrJWU6:vON56uuHBa+ld859WU6
TLSH
T14102DA3568786CBB9EB26E49F4873B175FD4207B9A962F84DAD85F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9d22b2fc95594f2070469e2779791a9c349a694aefb9ac342ed0b5ac5439122a
MD5 fca47bce30c83e4cb7412cbcaf29dd4c
SHA1 5ce34655afae7f6d20399cec58ad9e8637472781
SHA512 22c5084ed9b66ea05f0482a2c24b48f0877eab873ab813b63506d7c0375a2647d8c82316ad4c136081d10eaf9471ede0e27de42c81336e27295763743c04b3a2
SSDEEP 384:ysNA9v9vHS4Ea+ld8mvOObjI9G6w7CUXw:yBVSba89v29Ms
TLSH
T1E3727C3268389D7B5EA2A519F48B3A179FF481678B8D2F84E7DD9F0C00DB99C5306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 058b0d73896bdf09114b9dd52953297a5e6fe165c53900b222d70a56a215fa82
MD5 74c5f32da87558b68e03d173a5af0160
SHA1 a2253dd1708a3bd97de3b4ac1922b4316be712ec
SHA512 d28fb5c94a49bc518b327060c3289971cfc4360fcf5887c1a033c74efba2299eebef623922b9185cb02c9b86f6c722c56ebd0fa671599d3625d4703f76db6fe4
SSDEEP 192:mONB6DbhQmiUy8ihBa+j2+FdCrtmEpe4GYNz7qYU6:mONB63ChBa+ld8BvU6
TLSH
T16812FA3268786C6B5EA2A549F48736179EE45167DE8E7F80E6DC5F0C00DBA5C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4b4157a10b57b1061bcb6dbaf693393a0febf96f218a7cd83010280168f21f66
MD5 9db61845b20d951d75f367757472acf6
SHA1 6047fae16e520566cd100e7f5ed8176a1a2e52b9
SHA512 97554fe07a833adb3a143f28108201bcabb34685f1aedb3ba7e545432a26059dc0f98040f9eb8e904932c2b917fd98fc1e54c96c697d769929db651e40d449c9
TLSH
T17FE00243D3144093D002437540C35F903A6286200202020D4AA402683D303066D11000
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f037.TMP
Size 392B
SHA256 d0e4cbc4262140c84ca32b986b6b09a650df13700899d09e15a109dc154ec854
MD5 2b7d32bdfc64bf1e826a47be02863bb9
SHA1 d5b7cbe5357df29705212ce2fcb958faecaa6a02
SHA512 2a45e9ee9c2468738509a388a8869f4df8eec3a7fcc878a14f10a6c572a580c35271ac5145b12e8617814b1b72d5e7bde8f0b69e19325c5cb8be276a135e8e58
MD5 SHA1 SHA512

Submit Download

396829e7-d553-4fa8-b0f1-e7f6a19f5806.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\396829e7-d553-4fa8-b0f1-e7f6a19f5806.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 de30e696a68cdae828580c29a8b95c4444d12510adbd68090ade2e7ab7c93134
MD5 debf102a9fa3d1df6bcd0a61b34e1160
SHA1 5b325317d2c7277ae2e23b2501ec46978508d967
SHA512 3606de7386ef2c51673db380038868938f394907c08c9063690806edd493e2d5d22977265a89710c876648e3464916b1842acd0f1fb50de55bad9d555463134a
TLSH
T104412758BAF91114B3776F5AABF6A4AE487FBD372E06C45D10110E4E0A63E41C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads