hxxps://titaniumnet[.]ru[.]com/soa-doc/sharep-redirect[.]html

Analysis

user interaction
yes
max time kernel
72s
max time network
72s
platform
windows11-21h2_x64
resource
win11-20260513-de
resource tags

arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://titaniumnet.ru.com/soa-doc/sharep-redirect.html
Sample260727-qvp48stdjf

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3252	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296329220187843"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{B33CB157-8DD4-426E-86EF-06FCA9E6AA4A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2184	1432	msedge.exe	80
PID 1432 wrote to memory of 3252	1432	msedge.exe	81
PID 1432 wrote to memory of 4304	1432	msedge.exe	82
PID 1432 wrote to memory of 4304	1432	msedge.exe	82
PID 1432 wrote to memory of 4304	1432	msedge.exe	82
PID 1432 wrote to memory of 3536	1432	msedge.exe	83
PID 1432 wrote to memory of 3536	1432	msedge.exe	83
PID 1432 wrote to memory of 3516	1432	msedge.exe	84
PID 1432 wrote to memory of 3516	1432	msedge.exe	84
PID 1432 wrote to memory of 3516	1432	msedge.exe	84
PID 1432 wrote to memory of 3480	1432	msedge.exe	85
PID 1432 wrote to memory of 3480	1432	msedge.exe	85
PID 1432 wrote to memory of 3480	1432	msedge.exe	85
PID 1432 wrote to memory of 3952	1432	msedge.exe	86
PID 1432 wrote to memory of 4140	1432	msedge.exe	87
PID 1432 wrote to memory of 3952	1432	msedge.exe	86
PID 1432 wrote to memory of 3952	1432	msedge.exe	86
PID 1432 wrote to memory of 4140	1432	msedge.exe	87
PID 1432 wrote to memory of 4140	1432	msedge.exe	87
PID 1432 wrote to memory of 2880	1432	msedge.exe	88
PID 1432 wrote to memory of 3192	1432	msedge.exe	89
PID 1432 wrote to memory of 2880	1432	msedge.exe	88
PID 1432 wrote to memory of 2880	1432	msedge.exe	88
PID 1432 wrote to memory of 3192	1432	msedge.exe	89
PID 1432 wrote to memory of 3192	1432	msedge.exe	89
PID 1432 wrote to memory of 2468	1432	msedge.exe	93
PID 1432 wrote to memory of 4596	1432	msedge.exe	94
PID 1432 wrote to memory of 2468	1432	msedge.exe	93
PID 1432 wrote to memory of 4596	1432	msedge.exe	94
PID 1432 wrote to memory of 3376	1432	msedge.exe	96
PID 1432 wrote to memory of 3964	1432	msedge.exe	97
PID 3964 wrote to memory of 1416	3964	msedge.exe	98
PID 1432 wrote to memory of 4840	1432	msedge.exe	99
PID 1432 wrote to memory of 4552	1432	msedge.exe	100
PID 1432 wrote to memory of 4996	1432	msedge.exe	101
PID 1432 wrote to memory of 4500	1432	msedge.exe	102
PID 1432 wrote to memory of 4500	1432	msedge.exe	102
PID 1432 wrote to memory of 4500	1432	msedge.exe	102
PID 1432 wrote to memory of 2536	1432	msedge.exe	103
PID 1432 wrote to memory of 2536	1432	msedge.exe	103
PID 1432 wrote to memory of 2536	1432	msedge.exe	103
PID 1432 wrote to memory of 2548	1432	msedge.exe	104
PID 1432 wrote to memory of 2548	1432	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://titaniumnet.ru.com/soa-doc/sharep-redirect.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffc937bc188,0x7ffc937bc194,0x7ffc937bc1a0
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,14759304855717962635,6557591036891752893,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,15435379717425325816,13182347773368163249,262144 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,16347378854522759952,4820520783335820673,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,4789970315486247313,3717553135153355325,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11001610848226225524,12589030320476541112,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6880358888929378177,4481848745211464650,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7262600167909197724,10773853484288574824,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4304,i,10616952925549649275,1825880112810866694,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,17163857175872850027,4056538319658750485,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:9
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,1451064203392343332,60505938826112667,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,9634336643870709971,15109547301568100120,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,13101557135218634618,13698235874273694810,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,13101557135218634618,13698235874273694810,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13476920065064159484,8110483208443984361,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,5028940926019844021,15829488831854021693,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,3634687064657857229,4668979575540103544,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,1823961893235123171,8479507748820099169,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3464,i,17596376502965757979,739181933765428241,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3544,i,7273166493562601866,11347305020004729384,2097152 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,10779488696042446172,11949695234187906942,524288 --field-trial-handle=2212,i,9351814595973537486,10045250740718438040,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
  2⤵
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ffe3af3a4f95113830499dd6c7b42b4cc1b9c2aae4e2c90411bf401ed48be38e
MD5 82867984be72ab0680f5888f7095906c
SHA1 5392e19fe03212b43882d468b245733ab37c264e
SHA512 863a3e066558215a5a7268bdda34d3fee8bddd4e968fe7dc4df46a1bb45a4e64a4b47badcddd56e650caf9198b37ea7e3409ef9936ec3b6c7f61ef0aa77a2ddc
TLSH
T186715C77325B5465E3F00731F0E202A67075A5D90197EF02136DD8FFA319F65C522C68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b438.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b438.TMP
Size 3KB
SHA256 a0979baa48144cbcc872377533d0759c559af41751cc27a7e57d7eeb1ea58977
MD5 7acff57f4f62fb31c397d01c55744ac0
SHA1 f94e3c386e5f821c2777b4209592eb6e62629484
SHA512 756c1bd54f2c3e5f006cdbd32d4f008a545e21beb5a4e19b1e9d1d9a11f43a796097f960e7963187df0773951673311fa8246a95f9c91883daf045a5202c1462
TLSH
T155715B77325B94A5E3F00731F0E202A67075A9D90197EF0213ADE8FFA319F65C622C68
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 59824c2b618ce8e2f2527f6b23f4a792497accecb2a468f80dbbbd3c663cced6
MD5 ec7419d15e0448e9615a21be3117443b
SHA1 3e18b81e28d0fb0d6bfe9d42b40e90fd6d8649da
SHA512 f06d09164e8b74a2421688b18dcf37ebdff1110d489e503f01276dfbb4c79fafba3ba9328c6deb96fcbccab58d4e77b4df5fac2811896dfd758a411dd3ed3498
SSDEEP 192:sxZS/yirKOMl8MF3W/f4sZZasIupM/W6+WNGY0axkl8IgrJ:sxZSAd3W/f4sZZaMM/bG5q9
TLSH
T16342F916AB349977CCCBD209FA45BB53D6F51472E2900E48A9FCDA0C04E66ED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c1b6a6a604cce40feb396718365d8821b81c436e156c36e9a11b50bdb6eae1ec
MD5 ada35fad8aaa78b25eb2c32cc24ecec7
SHA1 80dfbef94be18ce6af820cdf0758fc044b100345
SHA512 84bb35b40e21d4efabd3a6bdb23397922ddef2530d13e7fc32d4fc6fc9535c93c4ae40128d437601f45363ce1c7dfb7b7b9bec7fbf92aea9ee3b2d60280d9d58
SSDEEP 192:sxZvI/yirKOMl8MF3W/f4sGhaBIupAL0/W6+WNiLh3B/Y0aPGcl8Ig5OJ:sxZvIwd3W/f4sGhaNM0/beJB/5gck
TLSH
T1DE52E816AA3499778CCBD209BA45BB53E6F55463D2800E48AAFCDA0C05E67DD231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 d90fa3f4276d2df874629beb1a62f88653ac90b34828e685cd50889d51c1e25f
MD5 51b94c3f8e9570b4960400aa1960ba0e
SHA1 610f0ce0ea687885bc877f2b3dc913f982cda978
SHA512 10800d2306a5e5cb3ca71cdab94b195b4c25c0abee3023a3fbae7d9c9282608802043034b237a41b555000f49b2a8441a3ee79587f12898aefa8615aa01146eb
SSDEEP 768:gt/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VHfroR7:gt/zh8dF2PkWRmEcQXwu1jaKWjLp2tV8
TLSH
T1B4E2092F280CC7BE4F844E9DEC266F976EE801CB66684D5447EA894C03C77DB521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e1beca4cdd25f48a8f3c9a17df1576fd871bef88cfba492ca44fa1d00e6e5c8f
MD5 5f8d31ef1a5a968555f8c498fd6b7d95
SHA1 633297c3ba663e56063d10d4929130c33927418b
SHA512 a7a7eef4a0dba95e1f6fe44fed909edb43d76eaed923c4d25c4b11f516f0619778e7a6182d18cbb04d0a51e755126738cfc9a71fa59f1bb6ca2fbd967a2620bd
SSDEEP 96:KEWgKvjakK/6+aC8Kb6ADSKc0+2biKk8E:2cTnmJR1
TLSH
T1B7D1491271FA02427D7D3B1C92A5972B8E42F1A37559A92B7BA800714D2BE244DFC8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f066f6a-8b98-49b6-987f-cb2bd64f28df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1f066f6a-8b98-49b6-987f-cb2bd64f28df.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 77e882c38ea67f34843ed15519c43b0e1656f744b87719cf1fa57bdf1fd25c88
MD5 363ad7a18cd6f91f44cb2b85cfc22736
SHA1 382478201a76cc2014add2818e522bcc6b951b83
SHA512 fa298f942b646b698eec02baca881b7d0b7dfdbf0c89319910d5b8d94ad4e96fd932cb779e0e2b32fcbe0790af4defef28b49be8a8e45f7eb1088f346e28f733
SSDEEP 192:uIL8NVXbQ4g02U71eQmiU1gjmdWB4nv00OvoK77BzYPqjCY0W6B:B8NVXbpEu8qiWuns0OvoK/WsjcB
TLSH
T1D8423A766C789C734EA29145F88A36139EF8606BDB842F80E5DD2F0C01DF69D231F91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c06abb62eb67d12954555343ad82c42e0726d95da70b76bb20e7ec2d2b23b481
MD5 4b0c3890040009224f1d6e6434412b5a
SHA1 c581c4572000f5abd1dc66fb5f9c7ca1a0a6ee05
SHA512 e17b81da3802670f05e1327db0869282d5e12842030119fe304d0dce9895be65cb5c9222917007acdddfcbcb837703f0842205e69ab81852df7a28d0bd4f45b8
SSDEEP 192:uSL8NV/Q4g02U71eQmiU1gjmdWB4nv00OvoK77BzYPqjCY0W6B:v8NV/pEu8qiWuns0OvoK/WsjcB
TLSH
T1A4523B766C789C734EA29145F88A36139EF8606BDB842F80E5DD6F0C01DF69D231F91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 21eeb7e4dbb7da894f01615c4a883f5652f28d0a37ced05b46846dc2900d26d8
MD5 4853797000ee756e7edc372b3802b4fb
SHA1 122e253b6b6297740add029da772b6a0175b0bef
SHA512 32439f34911b5262c5e5f2090183670e5f70210062fc4fa603690466b9cd686c5efefbebd638694503dfc00bc2b27a914f99ed5f39f188eb9f64296538ca9966
SSDEEP 384:PNFiZcIm8Nv8TUNTUlIlWpEu8qiWuns0OvoK/ksjce:1FQmmwgtP7s0Ovosksjce
TLSH
T147926C735C64CD7BAEB69A45F98936138EF850B7C6D4AA90E2CC5E0C01AF19C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 341b6c47079630d59e29357873520566cabb004920a5c28d85b2e5fe1d7f50b6
MD5 dd4bdf40217075b522b7719150903e56
SHA1 a90499a0ab28c1a8aaf4d97990a34a32ef05dc39
SHA512 d5a83f1007c094a21b9b04d3dca835cd42779127e846122f0341bd0f5b7e9e6e2d937ac3fd7be353ed69a707d1ad92a28b254e33004eacea9d5b4b3bcc39fa16
SSDEEP 192:uSm+xasuheOwQxMG8NVWQ4g02U71eQmiU1gjmdWB4nv00OvoK77BzYPqjCY0W6x0:QZcIh8NVWpEu8qiWuns0OvoK/Wsjce
TLSH
T104727C726C749C735EA2A145F88636138EF8A07BD7D42F80E5DD6F0C01AF69D131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a873f5a1b4492462693259b56a8b600776c968bb84a280d587f8f518b8d4432d
MD5 053cf91a1610bf25f0dd68f61c4fb1b9
SHA1 751f72099fb8d9d8ee5bd2078451f4d192f079cc
SHA512 f090ce1715bcff5cb047621a3229cdf11e073c059d445ae16c56d3fd3bee756cec47361c895684705e4dea6e30884dcf29eecc6268da364daf0ac5fb840d0ab9
SSDEEP 96:8bqGNkIQsjpfN2dYXOR95ih/cIPURHl8h4otop5M1ISDUBYP6vVjhLcgz0czOVih:BGNM6P2UOcQmiUyUIUYqGv00OiwSySU6
TLSH
T1D102D8396D782CB78EB2AE45B98737174FD8207BE9952F80D9D41E1C00DB64C3346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6ab791189a8615b8e85d280bb35cc1177ecfeaeb3f810251b856fbee2da41c95
MD5 d6bbfe91b9f13912d9916041e7e3c271
SHA1 d6cf450c52981e54e4d45b4f7847ad55adc4b96d
SHA512 93f3eeab6123450d0b9c4355117183d58aa8b08b50166f59409e136af663ad193d8080bbe40a818e43e43e15c442821c2c34e54a732da1cde0fe8f5d4a5ac144
SSDEEP 192:AGN46P2UQQmiUy7EYJGv00OvoK77t0BPqjU6:AGN46e/ufJGs0OvoK/SsU6
TLSH
T1541219366C689C774EE2A545F88736178EE8506BDA893F80D5DC2E0C01EF69C234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads