hxxps://3giwveaeyqbvygsgslhmttrcye0hhydj[.]lambda-url[.]ap-southeast-2[.]on[.]aws/

Analysis

user interaction
yes
max time kernel
72s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://3giwveaeyqbvygsgslhmttrcye0hhydj.lambda-url.ap-southeast-2.on.aws/
Sample260722-gpc32sbb93

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
101	ipinfo.io
102	ipinfo.io
104	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291735185730421"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{55DA7D5F-C577-4E12-A692-F8840EC372AA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3436	2120	msedge.exe	84
PID 2120 wrote to memory of 1840	2120	msedge.exe	86
PID 2120 wrote to memory of 2032	2120	msedge.exe	87
PID 2120 wrote to memory of 2032	2120	msedge.exe	87
PID 2120 wrote to memory of 2032	2120	msedge.exe	87
PID 2120 wrote to memory of 4540	2120	msedge.exe	88
PID 2120 wrote to memory of 4540	2120	msedge.exe	88
PID 2120 wrote to memory of 4104	2120	msedge.exe	89
PID 2120 wrote to memory of 4188	2120	msedge.exe	90
PID 2120 wrote to memory of 4104	2120	msedge.exe	89
PID 2120 wrote to memory of 4104	2120	msedge.exe	89
PID 2120 wrote to memory of 4188	2120	msedge.exe	90
PID 2120 wrote to memory of 4188	2120	msedge.exe	90
PID 2120 wrote to memory of 4720	2120	msedge.exe	91
PID 2120 wrote to memory of 4212	2120	msedge.exe	92
PID 2120 wrote to memory of 4720	2120	msedge.exe	91
PID 2120 wrote to memory of 4720	2120	msedge.exe	91
PID 2120 wrote to memory of 4212	2120	msedge.exe	92
PID 2120 wrote to memory of 4212	2120	msedge.exe	92
PID 2120 wrote to memory of 1960	2120	msedge.exe	96
PID 2120 wrote to memory of 1960	2120	msedge.exe	96
PID 2120 wrote to memory of 1960	2120	msedge.exe	96
PID 2120 wrote to memory of 996	2120	msedge.exe	97
PID 2120 wrote to memory of 1520	2120	msedge.exe	98
PID 2120 wrote to memory of 996	2120	msedge.exe	97
PID 2120 wrote to memory of 1520	2120	msedge.exe	98
PID 2120 wrote to memory of 3968	2120	msedge.exe	100
PID 2120 wrote to memory of 4132	2120	msedge.exe	101
PID 2120 wrote to memory of 4132	2120	msedge.exe	101
PID 2120 wrote to memory of 4132	2120	msedge.exe	101
PID 2120 wrote to memory of 4292	2120	msedge.exe	105
PID 2120 wrote to memory of 4108	2120	msedge.exe	106
PID 2120 wrote to memory of 2440	2120	msedge.exe	107
PID 2120 wrote to memory of 1196	2120	msedge.exe	114
PID 2120 wrote to memory of 1196	2120	msedge.exe	114
PID 2120 wrote to memory of 2840	2120	msedge.exe	116
PID 2120 wrote to memory of 2840	2120	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://3giwveaeyqbvygsgslhmttrcye0hhydj.lambda-url.ap-southeast-2.on.aws/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8bba5c188,0x7ff8bba5c194,0x7ff8bba5c1a0
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,14469170741765851385,10716389935833957226,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,12719105451772184818,15578269984747009500,262144 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,1080395960119345050,17837993965728681781,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,10934202256579684738,9377053742303286535,2097152 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,10954819003337550204,11551264862313615796,2097152 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,14493623460325192259,10544711153899634435,2097152 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,6857271839064530159,16738084437433670123,2097152 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5140,i,3904769223002761110,17545337909803698491,2097152 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2544434047169558487,11952387947658235873,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,5636639137261881966,4541761754351457448,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,13644329114249149799,8137942262849770912,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,13644329114249149799,8137942262849770912,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6204,i,7398852373445269790,16794482886160068825,2097152 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,7161136415468205562,13313827113517780017,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,1229343480501702606,9332789110729925199,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14656575002142854819,1999919636055770279,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,13855455944430071146,16564235631104501419,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9979815522287281448,14844873964967149328,524288 --field-trial-handle=2936,i,1838060246244466136,14022147391093682720,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3af2b8ab6c61b0dd85d208ae8de6768927916911c95d6595598f44683591732b
MD5 8e0ecfb2da54303b7509b919819361bf
SHA1 e55871649bc2242fee21134078fc96fb140d5297
SHA512 70db551f6308ca8aeea19785f7b9c61a0cb1b61abe4baf3419b9b9f862e6fffdc7cc910180e1160bede0769bb480b623cb882ffd71bfffbbbe8a4529b2626c7b
TLSH
T11E61A368CE934B95EBA00373ECE21A9534B584D40E1F8E5211BDAFFC6910B68FD77409
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 db54ee693e13ab97a813767f25df46dfcfb52cc36a2ee6d05855d26391bfcfb2
MD5 2813e38a67d600e1de671f8b6ec377ad
SHA1 90b922e3b8c13047bfc60e021eeeee2ee0c5a65b
SHA512 8ecd2fdd59672ecf947b7ef591c05a13cf6aeed7794fa62fd38582c4011822132a6503b94f3c3947645e1cda576b7f775f34c11f2b2c4132428eb433755ab45d
TLSH
T176619458CE934B96E7A003B2DCD21A9435B188D40E1F8F5111BD9FFC6A15B64FD37449
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 52ca8ae8438f138ad4869bc88142cb2581df7e01ef08e46d4513a260e7748c5d
MD5 fb4adc981a3828166987d371124fa222
SHA1 d4562b0030118622d8f8346f730cf210778acb38
SHA512 e0f2b92425ee42d576cdd6b84187131c1e742caec3da7849971767d6616e643a1d0b444c053a11a8797afa5d5f59b3e1110f3d532659c3e2959ba6c54cad40d0
SSDEEP 96:DmOUtlUtiUt9Ut/UtXfz3UtPBUUtZUt4wqUt4UtsQVUt9Ut/zUttUtgGUtld:DFOlOiO9O/OXfDOZUOZO4rO4OjVO9O7M
TLSH
T1099192B3C3D4892DA9117EF4EB287F1BCE3E066982187C5649D5DF17A3B1871E20194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 78dfe6584d0af3c6f75895a969f5de4dadb5e4943c8a6718a2d1943698447c30
MD5 dbcf3058f3f27769e6a322ce654bf919
SHA1 0973d3527242c626c6856f5576ea39f397eb49bb
SHA512 502a0a6c60d9221c47b61fe02547f210c2e239743f17a5d97e6233aae712ccd909ffc41a7cd263f067ded0b9da1479bff65e63f19c2b5e3f2ca23c6403609b5c
SSDEEP 192:sxZpRr5yM/jK1Ml8Mkh/fQsyn/IdpU+HW6+WNDfc/YH+/qaIgrJ:sxZp3Mh/fQsynwjHbI/l9
TLSH
T12D52C6166A349A77CCDBD20DB955BF53D6F51472E2900E48A9FC8A0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 80d238858888cb2530fe7ed0eed00cf3f6e3ada86f775d92f5e81b3bea0d9c1e
MD5 fba85e634cd176e14b2fa7036cbafe84
SHA1 fa5b8cdc8a63b5bb2513ec5ebc93d4475d069c57
SHA512 b14e07295651c45484c8a7381114786b94cdc2615e4ee4e41d29312fca11eb925774f3c6118e2a13e19162d7c904aead440b16df692b5555089b278812c32460
SSDEEP 768:cTUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RbroVe0p:cTUZYTMWvg0Pou1ja7eLZmRojp
TLSH
T1CBD20B2F280CCB7E4F844E9DEC266F963ED801CB9A584D5447EA894C02CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ceb2be3d62e3ce2442e9b96bcca69f2703c4ba293e9476f09c99788c1c110665
MD5 0f24b9d7b049505dab92803f723c4015
SHA1 8336dde152b5816d8b4f14d640cc9269c8ea1375
SHA512 b06aae9a7c4e12637a51cfc3991ddd61092ecff1c1fdef7ca61cfcbcf189a82997f842acd23488265bc2482dfced9ee91fe7a92fb2e3ba6686658d0959fce777
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKli9:EWE1r9n6
TLSH
T14AD1D51671BA03113C7D2A0C86B597668E42B563702D652B7FED00B54E2AE209FFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25940c89-4c1f-4055-9737-e1da08a37a02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\25940c89-4c1f-4055-9737-e1da08a37a02.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b47281b9d49d290358fcec856466f0e4d5f1dfcb975dccc975dbd5d5b309275c
MD5 ee47f92f333cadcd5cccdecb2ac5e0eb
SHA1 fc0654727930872551088721f7b3cc3eba36fefa
SHA512 59d56e6c7c5cc457b97648593419b003d82bfd1c1ac3deec002a9f7b7187150bb87da824bcc7196b2526c6c419cd8edd8bdc77d9cdbb81464776f2338f78aa2a
SSDEEP 384:1tNn/s3n9SfsNb7e8c94nQHuzX5od+2d6/Id+2CL4k7QeVScjmw6z8:1j+9UvCOv3lCLBQ21jGo
TLSH
T108926D336C256D6699E2A145F44B3A138FB850B3DAC42F84D5ECAF0D01DA6AC1357E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0f256c47542eb09425ed4eef0e2969225cd34871a991e1167fa0cbb2d7364f5c
MD5 76ffc4a0f2bfa2ad2704d2b1e92c2b04
SHA1 daeb8d66e5b1183ec85bae0907bb2da059fa68cb
SHA512 87f52672aba65838cb860a703faf71fae1c935c9daa7dd76748721c464dc96dbb4207a428fb9ada2b3bcb973437d7e2086e7d8763ac961c30914f50da77aff4d
SSDEEP 384:UiF1tNn/s3n9S9zsNl8TUNTUlIlAe8c94n1HuzX5od+2d6/Id+2CL4gnQeVScjm+:vF1j+9mkwgCCOv3lCLrQ21jGo
TLSH
T1E7C23AF358D79936D9AE5747F77E2E028EBCC063B9806A44B3985A0CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 158c0e2318bb52f2f4f4ab4c50a4ebe7a1ae2bba12bc87b3dde91276b47214ae
MD5 d725bccf2403cf00b88f11a70011fd9c
SHA1 1831110d8ce04680b804a0580c10fe1ad7567547
SHA512 9966fd298b3b20592bdecb27b4464c27dfe579aff7006ab2bdb383a856f2629e261aae10ca0efb6f5f11a38defeee7707a27aceb7ecadc1c50dd30f8214e8fdd
SSDEEP 192:mONu61DWQmiUyz/kqGX5Obd+j1+FdgX/oxFd+2CL4DjJQ7QqsVU6:mONu64+8qGX5od+2d6/Id+2CL4RQeVU6
TLSH
T1E7122B326828AC278DE2B555F48736134FE45167EF897F84D5EC2B0C01EBAAC231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f12aacc3b20f866f02945c63317ca760dfd5a183af6ce59c9084e2097056de79
MD5 8caf0bb9b8ed8b6b98675bef8b74e375
SHA1 16646a9e116b86180e9a6a6210679129a10a746e
SHA512 21f04bb96e7c6f0907a5fe54f39c7f8f2ea2f71a0cbedd2b61398f34b31b5b43e80f8795626a41fa234495484460f9c8c444f9f70fb0738ed7581e39db610827
SSDEEP 384:DtNn/s3n9SfsNbAe8c94nQHuzX5od+2d6/Id+2CL4k7QeVScjmw6z8:Dj+9UICOv3lCLBQ21jGo
TLSH
T1DE927D336C25AD6799E2A145F44B3A138FB450B3DAC42F84D5ECAF0D00DB6AC1357E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af9365af42df7657194dae8aa0c9d4ee39fa4ff8736cc2f6adcfa28e85f9a7e6
MD5 43c44ed5e2776d7006ca7c41a8beb74a
SHA1 b3aa885490782c84ae2dc9ea51c5f4e663a2b134
SHA512 e001aa991be63b19e6a2b94838ea0ae20cd8b12c063b933ffed5a5e0234cf8173ebea1c9e78a5409663942c4ad62e28ce828de990775559ab36cdcfcc98a1b30
SSDEEP 192:yONI61VWQmiUyJkgGX5Obd+j1+FdgX/t/aQw3PXU6:yONI6WHgGX5od+2d6/wQUXU6
TLSH
T16D02C73568687C6B8EF2BE49F48777135FA4116BEA952B84DAEC1B1C009765C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c435c22e4424e428c68443616b3e218a12ccdfe98896a2f0b8f2d18ffb6a2c31
MD5 51b467bc104e6655f010c342d65e2350
SHA1 ac691ec342b61896f65468683c6501ea454b89fb
SHA512 03c0aa998646cf17dc06db96de7e3066a9d274b2e4eda93750971508c2f448a585d01d9e20044fc2cd5d90ab609315af55d2430190cdfa87291ac3e23c819698
TLSH
T16041E958A6FA0148B3B76F5AABF6A86D447F7D372F1A955D10010E8F0627A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads