hxxp://dub[.]sh/oSBwaY

Resubmissions

02/08/2026, 02:43

260802-c7jw4a1zgx

02/08/2026, 02:41

260802-c6ewraseqa3

Analysis

user interaction
yes
max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dub.sh/oSBwaY
Sample260802-c6ewraseqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301120744073119"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{A622A5F1-E339-48EC-8C5A-46F6D945EB79}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3512	2064	msedge.exe	87
PID 2064 wrote to memory of 1808	2064	msedge.exe	88
PID 2064 wrote to memory of 4008	2064	msedge.exe	89
PID 2064 wrote to memory of 4008	2064	msedge.exe	89
PID 2064 wrote to memory of 4008	2064	msedge.exe	89
PID 2064 wrote to memory of 2224	2064	msedge.exe	91
PID 2064 wrote to memory of 2224	2064	msedge.exe	91
PID 2064 wrote to memory of 4124	2064	msedge.exe	92
PID 2064 wrote to memory of 4124	2064	msedge.exe	92
PID 2064 wrote to memory of 4124	2064	msedge.exe	92
PID 2064 wrote to memory of 3640	2064	msedge.exe	93
PID 2064 wrote to memory of 3640	2064	msedge.exe	93
PID 2064 wrote to memory of 3640	2064	msedge.exe	93
PID 2064 wrote to memory of 228	2064	msedge.exe	94
PID 2064 wrote to memory of 228	2064	msedge.exe	94
PID 2064 wrote to memory of 228	2064	msedge.exe	94
PID 2064 wrote to memory of 116	2064	msedge.exe	95
PID 2064 wrote to memory of 116	2064	msedge.exe	95
PID 2064 wrote to memory of 116	2064	msedge.exe	95
PID 2064 wrote to memory of 364	2064	msedge.exe	97
PID 2064 wrote to memory of 364	2064	msedge.exe	97
PID 2064 wrote to memory of 364	2064	msedge.exe	97
PID 2064 wrote to memory of 4484	2064	msedge.exe	99
PID 2064 wrote to memory of 4484	2064	msedge.exe	99
PID 2064 wrote to memory of 1200	2064	msedge.exe	100
PID 2064 wrote to memory of 1200	2064	msedge.exe	100
PID 2064 wrote to memory of 2500	2064	msedge.exe	102
PID 2064 wrote to memory of 1328	2064	msedge.exe	103
PID 2064 wrote to memory of 1328	2064	msedge.exe	103
PID 2064 wrote to memory of 1328	2064	msedge.exe	103
PID 2064 wrote to memory of 1644	2064	msedge.exe	104
PID 2064 wrote to memory of 1644	2064	msedge.exe	104
PID 2064 wrote to memory of 1644	2064	msedge.exe	104
PID 2064 wrote to memory of 4428	2064	msedge.exe	107
PID 2064 wrote to memory of 2872	2064	msedge.exe	108
PID 2064 wrote to memory of 4800	2064	msedge.exe	109
PID 2064 wrote to memory of 3700	2064	msedge.exe	116
PID 2064 wrote to memory of 3700	2064	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dub.sh/oSBwaY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11920385637682749153,14116803569730269789,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,5495488733947084765,15084246796243644012,262144 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,3891090191043829051,9626790739097497241,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12384938867739574373,17515305017683635033,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,17913224884942353212,13198449569593964962,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12636476572878225222,1409594276820252278,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,2273710576696500001,17475754805548209923,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4992,i,1889357544208528333,7161816094518383348,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4607331475174687907,17768161521661773821,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17580908962713469437,11333575100403784544,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18069507178628931014,6091776718501768230,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18069507178628931014,6091776718501768230,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3476,i,6811865773726017467,13397186161208847493,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5644,i,6259715709672854969,11750489996304977669,2097152 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,7097483446365174956,16256240276508027411,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,5953049040748271014,10863201377693094253,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17804859368125761043,8058333873852145448,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,17359889580933889574,12214692194908334974,524288 --field-trial-handle=2320,i,5767209920976884382,7202472058806108797,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9b8185b1a392b6c6f84f1ff15eb5d3cd9de1f021ecc76339dc26eba8d8b43c02
MD5 b87e0e88caca0f718fa75dfac145cbf6
SHA1 164d0047183936ef904bae1c56cd0559ab1ba060
SHA512 676db1abe9f09dd42e1c0d49d9c09d1602b6edaa0f2941d24975de94445cd54adf9f64301e2bfd5ede4f33e6af8df4455e54e31995ffbd9b0b9c784acb3a6a06
SSDEEP 48:ALg+3FoEuLnWAYq1SjCoSyOuRlxyTMBSbdHlGxlybc0DJh1Qk5a4pyYn:mVvotVkpnr4TkxlyQ0Skn
TLSH
T1D6A1631612F9C84DDB32B2B0F2DA2D9978F3B0A60D135A4A2168F8BDA53E7B4A075504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e579.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e579.TMP
Size 3KB
SHA256 7c396c99171128f5686da13de557aec6f0b19de59e1d044a1498190c3098970c
MD5 46a1f65ceea892f0c73d0983b883f50d
SHA1 bba9694cd5211ff9096cbc5c29132f4882ff3670
SHA512 510924111f52726756148f17105e12d62b58ebb245f6dcbbe763b0a9a2532bdbcdced172e114cc7aa7d6ad554bb63b9aa8afe21645188d4292701362645f05d7
TLSH
T168712B1A02FA489DD721A330F1DA1D1E7CF3E19A0E139E89319CD8BDA53A734E4A6458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ccf6708144bce23e3376193f596bef0b05fbd658f80283409d31e7576080fbea
MD5 5363373127ad636d5133baffe5418347
SHA1 8446e8eea722eb839f7712dcf016907fc034a37d
SHA512 ab01cecf418ffb1dfe6f0cf68e1541fc81b600e194765e5af530a4c84ed166cf14fc5e99a6209ecfb8c9bcc0a47ae7fb753b8464aa51adffd131415f31fb8fb2
TLSH
T1B25190F287F645AEDE1192F0DA146E2BCE1D0506435C3D5AC6D4AF5BA3F2C70E18194B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 267d1b448ec3e95a1921a4cc58d2bdb2de0166cde2e838692b99843455a04797
MD5 5917b48edd2fb32e936a4efc5f6606d5
SHA1 0587d815617d6464ca035e7dc6ee4ef1f7b47726
SHA512 4f1d6051445957c8ba8937365bea9aee454f962819975f15de04c491081e027f86c62259081f034718461980f4fe785c249fca477e3501ea34ce75d5b65db050
SSDEEP 192:sxZKRtyM/jK1Ml8MkK/fssyddTIdpm/ZAletHW6+WNtUYaB2/Y4ZZEj5IgrJ:sxZKvMK/fssyddMmBHHbtbF/Ox9
TLSH
T17452D7126A349A7BCCDFD209B941BF53E6F5057292900E54AEFCD91C05E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 590c49acbca7c44d1ad2534d51077df271008e853758291613613cb648912f7f
MD5 6e64563c9b4767b27b66ba39a37bf317
SHA1 318b21672096ade8ea369516e8bb44357078df93
SHA512 4f81707bb54c45f90ebeed311b723087b741a65d3c6f673cc7786d2a102d80eb5982b1ae58bc607d2f43c912d3005c02f58c5a00431873b4a5ea9dc0edc954cd
SSDEEP 768:Vd8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdBro1kdUnh:Vd8iJPNWvx76ru1jahALocd6cUh
TLSH
T1B9D2FA3B680CCB7E4F844E9CEC2A6F966DD801CB5B948D5447FA884C03C77EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 57bbbf44629ef2cce0111a4f87019f7e2f05acaa5581585df017fda603818e40
MD5 bdd1b30974f9fcca1e8595a3745004b8
SHA1 5b9c38c3824392d1bbc5bcae727587489b59f89d
SHA512 06dbf8b7eea9c28bc9d9184f7ea26d821be04fd3920b70f086f2f88a0f01db392a34c5f9ac5ef975181b4fb56479ddc4c68b6e90a3603b3bbc1a49323b2c66e6
SSDEEP 48:KsgIvKBWMPyNPK7/1pNkdpgPIgXkKDBbtkHf0aA1XOIXKT68fylRI5KSUEs:Ksg4KBW2qEgKNCCOYKT6O2RSKSUj
TLSH
T1BBB1322271BA17113C3F380D9299A51A8E4276A33114E56B7BF884B21E7EE601CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88a5c86a-8a2f-41f7-b981-2150ebda17c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\88a5c86a-8a2f-41f7-b981-2150ebda17c3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 54432622d599c549571e5473626908c9ff769a9af1729f70158dee462ec4f3a8
MD5 4b088e3ee71bc71465734087c285010a
SHA1 f16c29065be8a6fce78de7efde4e5afe988b2ec4
SHA512 b7694750ab22e79432f970073b94162ad48262b9b9f478926e8e3e47a70d18404bc4a047d15442129116ce20e6063e42fab5a8f0b7255ef0372651b77c42cf54
SSDEEP 384:FyZcIhsNkfMuuYJukkTiSjnTKwBODNZOCwKD9:eh8MMjnewBKZOLe
TLSH
T135929E715C386C778DE7E515F84736075EF880B3E6D82FA4DAEDA72C05DA298130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 631b898b3b0bab5cc1fecd9a34bdf93c9471b639affab67368012fac714dbbbe
MD5 a3c64f026de7ab001b3dfb5853e1fef7
SHA1 15240c5cd2a99d658ac93508083f4d6c76467edc
SHA512 e80b0faddccbc6fe445f9d8a565da835c910c53d1532b32f58e7bfe8531ae78da5b8e2344a14df5646f715273c7cafbf5eef4a77fb7ed3032c96753d0ef8138a
SSDEEP 384:/6iFiZcIYzsNs8TUNTUlIlOMuutJukkTi5jnTKwBODNZOCwKD9:ZFQkxwgZx3jnewBKZOLe
TLSH
T16ED218F248EB583ADDAE9B07A73E2D075EBCC063B5841A60B7D9561CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df08873a20efb6a0e8b0bf4a7d72fc49e57ac3417a9bcd984eb17f147783fdd2
MD5 90dc08d414c9329f46b8cea6042f58c8
SHA1 3fa1d5603f2dd56e7d31594075c619cdc322bd92
SHA512 bd61918ba241d8dbad777b7bfbd7b2b066d6fe58c9eba0d0bbe660dd136dfdd7b3294c6114f0fde86a2dcd824d9bdf587035df328104e6b0d316426a670e0eca
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5T5DfBhPwivh50xy0SFYKCAxTeYNe:gONl6kDfQmiUyFpZ903plQiWctU6
TLSH
T1E602F93568786CBB8EA3AE46F48737175FE4112BEAC52F84DAE81B1C04D725C1706837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0507974f25a306c9dcd557c51833fd10c3230fdb665904dca9441190721280e8
MD5 572723cb6edf0ace4429a421a4831825
SHA1 44ed7ddc35405acd563c04e6eba36a4bc89f00eb
SHA512 69d11fa213517c149d0beb2713dfd2e96f29f95c2405964b80d8863c338492b7dfa8c61536a6f70e7cde1229284c4cf3515592ee524ad1b1dce609dfd4bb32e4
SSDEEP 384:3yZcIhsNkOMuuYJukkTiSjnTKwBODNZOCwKD9:whnMMjnewBKZOLe
TLSH
T100929E716C386C778DE7E515F84735076EB48073E6D82FA4DAEDA72C01DA298130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37cef78691542d4bdee83cf0a752f5d1fe1fa1f56c0e9e3d2155f1317caefc2b
MD5 8990b08a99f1c58ffa0896f16ff668b2
SHA1 80228de9d86f5414dce29bf12dc4a935cef4bfa8
SHA512 70602e6f7fca9e7b3641aeaaf4ac1647a91e986b0825c490dd243fbf0b8916c3cb5547b66b994f08527973222c1dd769fcb268a8f0516a04358709cf8361f925
SSDEEP 96:PNqONkRQsjpfmUTuOK5ih/cIPURHl8h4otop5TNDfBPaPwivh50xy0SFYKCAxTeP:8ON96kMQmiUyxpU903pTeF3vcRdqCU6
TLSH
T103122B3268787C7B8DE3A851F48336175EA1516BDF892FA1DADC2B1C05DF25C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96c66b57-9eea-47d0-92f0-559e90ffea23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\96c66b57-9eea-47d0-92f0-559e90ffea23.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8ce11a5361d9ea834581f91fcf62c7fc6b6e503f541819e55a4bf29b3defd739
MD5 bb412cd64624704e818f7f91c4efde52
SHA1 ea9bf307e8ebd9fccde9c60f5d4b20228208949d
SHA512 8fdbc346be322d277eae6c92668bbe8dc9391cf87e521cfb9bde16c85e7ac56cebdee28d6b910e7a96a92806dcaef6dd4f1dd0985e2cf7bc1cc1bfbcf6593d2c
TLSH
T1C441E658B6E91148B3B77F5AABF2A86E447E79772E06D85E00010D4F0A62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads