hxxps://t[.]co/qfoQe2tjZ4

Analysis

max time kernel
118s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.co/qfoQe2tjZ4
Sample260803-thzdxseq71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302466565681088"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C66D4B2B-A687-4C7B-8110-5E98A9E595C0}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 904	4896	msedge.exe	86
PID 4896 wrote to memory of 1924	4896	msedge.exe	87
PID 4896 wrote to memory of 2200	4896	msedge.exe	88
PID 4896 wrote to memory of 2200	4896	msedge.exe	88
PID 4896 wrote to memory of 2200	4896	msedge.exe	88
PID 4896 wrote to memory of 4408	4896	msedge.exe	89
PID 4896 wrote to memory of 4408	4896	msedge.exe	89
PID 4896 wrote to memory of 524	4896	msedge.exe	92
PID 4896 wrote to memory of 524	4896	msedge.exe	92
PID 4896 wrote to memory of 524	4896	msedge.exe	92
PID 4896 wrote to memory of 3676	4896	msedge.exe	91
PID 4896 wrote to memory of 3676	4896	msedge.exe	91
PID 4896 wrote to memory of 3676	4896	msedge.exe	91
PID 4896 wrote to memory of 3780	4896	msedge.exe	93
PID 4896 wrote to memory of 4840	4896	msedge.exe	94
PID 4896 wrote to memory of 3780	4896	msedge.exe	93
PID 4896 wrote to memory of 3780	4896	msedge.exe	93
PID 4896 wrote to memory of 4840	4896	msedge.exe	94
PID 4896 wrote to memory of 4840	4896	msedge.exe	94
PID 4896 wrote to memory of 2020	4896	msedge.exe	97
PID 4896 wrote to memory of 2020	4896	msedge.exe	97
PID 4896 wrote to memory of 2020	4896	msedge.exe	97
PID 4896 wrote to memory of 4964	4896	msedge.exe	100
PID 4896 wrote to memory of 4964	4896	msedge.exe	100
PID 4896 wrote to memory of 4812	4896	msedge.exe	99
PID 4896 wrote to memory of 4812	4896	msedge.exe	99
PID 4896 wrote to memory of 3464	4896	msedge.exe	102
PID 4896 wrote to memory of 4604	4896	msedge.exe	109
PID 4896 wrote to memory of 2888	4896	msedge.exe	110
PID 4896 wrote to memory of 4036	4896	msedge.exe	111
PID 4896 wrote to memory of 3112	4896	msedge.exe	115
PID 4896 wrote to memory of 3112	4896	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.co/qfoQe2tjZ4
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9095ac188,0x7ff9095ac194,0x7ff9095ac1a0
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14950677944615415530,13080327209083345336,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6836151908523346596,13942724233348783919,262144 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,16599476896179008060,5418832764318110893,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,12881558647190053698,4004663057631147960,2097152 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8441975034982937841,4234459659079104099,2097152 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8085173079881853436,3087113375545038736,2097152 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10512628513791848168,13449504694650304408,2097152 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3952,i,11922354904779252003,6031936673149898533,2097152 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,17735213714260144322,2792040675299594172,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,3518339280798048854,11773739726661532427,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,3162139282183150593,2116542400352389681,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,3162139282183150593,2116542400352389681,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,4104726834632972084,10631023140366945634,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,11549985777725887936,1005675381881940729,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,8362348408108880626,9422760140484943231,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,8724154141882344899,2538005180375050429,524288 --field-trial-handle=2220,i,4149756420674975537,2665981127893739067,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd8f0a9e52501d92de35f11cc50a505ca8a9564354dcf875ac0a19d7b4c3aa09
MD5 a656e0714f7fd0f12d868c303fe7ef55
SHA1 f9ef9c04d94670f36e10bab221e67d4408d2b511
SHA512 ea13182f780d3ba22c2a594060c8538ac6d0d5327c9bf7d78d102719ef99dfde072719b6c62a4c41af17d722d2089a848ad7c646b2680c95435ed5cfd79b60c1
TLSH
T1DF714D361087CCADE71D00706CD181F374718DEAFD476E9B91BC2EB41A1AB63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a265.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a265.TMP
Size 3KB
SHA256 89d5254ef792fca33a249e0d4d7ddd6f3c868e799c9f9995999a5945ad4dc920
MD5 78672da5e08420b7d0e8c720b4516ed2
SHA1 995f9e7614877eae60545ab73c3819eb83b1b0f2
SHA512 2f938e9a1ba165e77a48e67e807a656eacd537eca92951acadb68a60c9c9073e7e68330a5ec1a2b0939853bb9c56980661765f1e3f413bd43f7cc2bcaf65b323
TLSH
T15E713B360087DCAEE71D00706CD181F334718DEAF9475E9B91BC2EB41A17B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7cd353fab7c342a1ce308a158434d7f7086b703ce9d817306a40772c0c950230
MD5 f12eae2021c2802f3b8f8d59a1531ab2
SHA1 7d3a46072e8ac0475054d3a46ce49a8d40b15946
SHA512 2178ce13d160013630a7c033e51ed1ab30be879f84bd6723fb3c0dad9ec79bdd6a769482c40fd7c24a4e5ffc82468c06054c833bbf3decc21f592d51d9a9f94b
TLSH
T1F7518EF6C3E59A6DC91152F4AA283E6BCE1E0654423C3D1A88E5EFC7D3E2071E10294F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3594596030b3633e6689cdda530dda4d37eb16daec1c513d668f3ec56a8144b3
MD5 2b5d90160ad306cbecf3d27ae795c89c
SHA1 fa0dece7e1f463797821768f33054ef0ea9704de
SHA512 48c22d300e24077b456045bc397b18c514d2b75c86ddd7a55efa4ad60c2b67556e1938bb4dd6508e59d023198cca498a6ccc6b9ab5fc438c214f9020aea5147d
SSDEEP 192:sxZoRDkQ/fms1If/vNIdp6JlnHW6+WNEs8C/Yz1K/V2Ig5HJ:sxZoeQ/fms1M/GIHbr/qdX
TLSH
T1A432D8626E34A87B8DC7D21DBA19BF53E2F5503290D51E58E6FC961C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b20679697296977cad4572819f920c14bec7dc7ae056aaea47e1866c91aa3092
MD5 eed99e04c87c29b34171b4f64a24b94f
SHA1 eb7f80362401b9ab3ee5f5df34919f2be4b954ff
SHA512 620b3cf664be6e7369e361f723a83079ef32aafb73d32b92c37fb25deb903135e564e622f089d109c0bca1b0e3ffc9786ea3a98207a073050ac6f8c3d37a8899
SSDEEP 192:sxZoRDkQ/fms3If/vNIdp6JlnHW6+WNEs8C/Yz1K/V2IgrJ:sxZoeQ/fms3M/GIHbr/qd9
TLSH
T10322D8626E34A87B8DC7D21DBA19BF13E2F5503290D51E58EAFC961C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 34b6c84e0dd7d2f9ec275dca47e2922643c22f225c11a4af1cec8f07a8491f57
MD5 ed9328b835e51c0c2273ac4bafca293c
SHA1 98956e8f90e1e49885dcaaa361351fd678ceee0a
SHA512 86075db2589d672bcf52f8b1a34637f3d6ffa021c95182d217ba591714f4ae938d200d8cba084140b5d140d1306b266ffdf53dd53db8d81b333d30e2bbba7686
SSDEEP 192:sxZoRDkQ/fms1Ih/vNIdp6JlnHW6+WNEs8C/YzHVV2Ig5VJ:sxZoeQ/fms16/GIHbr/NJ
TLSH
T11932D862AE34687B8DC7D21DBA19BF13E2F5503290D11E58E6FC9A1C04E7BCD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1592e11dea4acea155b595229144c3c1757215579abf1dfd1d3ecfe6d8b9ff4a
MD5 7eddf95b531c581094cb0c733e7e6cbe
SHA1 c16842df54ce23d0b91da9037a31ec5952c94247
SHA512 831a00c8fa584783daba5c7d4b8fc042038791196f1da9d0a3bd8f9a68586539a8a5f780cdfb04e674134c7975afab2e973cec540dc3e043cd2cb5fd1d5cc49e
SSDEEP 768:q0k7u70Wvqica8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBZroyZYU:q0k7u70Wvqicau1jai5LA3BStU
TLSH
T18CC2E93B740CCB7E4F801E9DAC566F977E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 444c22c9538a19743b11faf9bb7e462cad414796dab382fe974edf7e5e67d2b6
MD5 7494907a3056133d7ff193b41e1627a8
SHA1 f6af2f7cfb1bca612f6a4819e7e5b86efeed135a
SHA512 81a648da9c58a7751f3e242e4cda58b79de6958493ec97da3c94383a6511d3d4d00fe84818916523d122b8338c3f400aaf6363b29b8d48defe16bc18d10eb546
SSDEEP 96:KIbCKcvNSKWclQwK1uamVuZ1HnH6J/IJjl6KLPjx:sa1bmVuZ1HnH0/I1ltPjx
TLSH
T12691C145727F56803C3F288DA166D4270E4238633419A67F7BE840639EA6E124DFEACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593426.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593426.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 29584a2c5a2ea688575379b243bfae1434b5da6b7b219f88727321041b35663d
MD5 93bc15fb2dfad4bb479a579666601695
SHA1 45d915168534f244f72567007ae77d828e078316
SHA512 9157fcd46d1c64004b7a45829a8732dafef190c7f88d3c1fa815bde01e5374a1373e87e79b2a4e19930b5ec226d69c6b9cf61772987ed8749d6f459fb1a691a8
SSDEEP 192:uom+xasuheOwQxMGsNDMQSU6BbuGKQmiU1DUJy4aGBPKIOCHrWTPNgdN2bqE6wtc:4ZcIhsNDMzbaKJ97LCa2n6HlytEDq1g
TLSH
T168928E35A8B46D365BA7B100F48E36075EF88027F3D45F84A6FDAB2C04DA6E5130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c3e9bdb8ad20797e9f5cde1c851452db86d65cfb7ba138e9ae2ea72f027b7501
MD5 aaf9eff705971969f2039bc034f6b953
SHA1 00bdf7996629930295127e8cbdc2389d3375677e
SHA512 06c896c1e84bcaacf0f14a541ef626c573d07f6b7e2edc5578169722d35c209525fb8bea36d0a38db607f52cda796d433b0f0d7c8b435e24a7c71191ca3a4da5
SSDEEP 192:MONx64BAQmiUyg1vW5GBPKIOCHruaDhjU6:MONx6eA3hW8LLZU6
TLSH
T15302FB39AC796C7B9FA2AD05F48637175FE4112BA5945F44EAE45B1C00D768C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4b531f021f890c94a411c60cb7e03c9e6695adb003d40fb974f4cd622b41079e
MD5 3adb6322191473e27a2573aa9909904c
SHA1 032d4c58c1cca1b3b700e60ee9e03efd05a12a4e
SHA512 de6839d2471c5419c2507041b193066b621ce74f7bc664a9ab44e5b6a1a9d6f47557336b5e2903ac672dc4bb2bf8a0315302445087b10fbc9acddbf9fa5f4c5d
SSDEEP 192:uOm+xasuheOwQxMGsNDJQSU6BbuGKQmiU1DUJy4aGBPKIOCHrWTPNgdN2bqE6wtc:KZcIhsNDJzbaKJ97LCa2n6HlytEDq1g
TLSH
T19D928E31A8B46D365BA7B140F48E36075EF88027F3D45F84A6FDAB2D04DA6E5130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ee7acb8eb4977335d9445e5c8984fb12058c929b7ce002a7c205245d61aa963e
MD5 b59b1d5a3b903cdd1aa5487d9dc4e99e
SHA1 86f7cd99236c394efb950bb14d8598683ca0c567
SHA512 c58b333667e37013aeb6602a67bc09b7c9364e47a992ad32f50d8eb9363feda117abbd6d20c0ee259ae94482bdb8bbb2d8e3c5ada9f06ba32cd4f78ab81181ef
SSDEEP 384:xiFiZcISzsNd8TUNTUlIlJzbaBJ97LC52n6HlytEDq1g:YFQ6gwgD2JNAmoy6DqK
TLSH
T1A6D24CF148E3553ADAAEA703E77D2E024EFCC027B5949950B3D89A1CCC961BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 084ea7508dd5597beecfd73f0b387f7d453bab84d9d7163c5652d54c1d18e4ff
MD5 ad27c2736d16797023843d0e5b8deaa1
SHA1 68d832aa5d6aa8d42f5320abb8e0ce3f9d41a0d9
SHA512 906973febd0c0ef61014e052634e2c94d497e2ec1d713c80b3abe9c9deb6c8028fcf99f268ea6f12ddeb0b10fea7437e646755fcb48817d1cac3df966fd012f8
SSDEEP 192:uONm64B+QmiUyQvZ5GBPKIOCHrWTPNoWw2bqEU6:uONm6e61Z8LCO2nU6
TLSH
T1F9120A35ACB5AC2F5E92B550F4CA33035EE8412BF6856F40E6EC3A1C01EF69C6306917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a134825a-384b-42d9-976f-181ce12d9c69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a134825a-384b-42d9-976f-181ce12d9c69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 956f9516a2a7038b895640f22cb2a797c7e83b9f275e92fc05e100c4976420e5
MD5 362a53845c32023dbed4de2206783249
SHA1 3803336316e84b6a784c960f80d8d4b8fa03b88b
SHA512 1bd4a5b8ee7fd27802d0c9237cf3893e885be6aadf17f12df5fa1b6a29927824895b92af64c782aee21433ac1a5f30037b3e3c26461ab9f2156df95df86fdd4d
TLSH
T172410B58A6FD0108B3B77E1A9BF6B96D487FBA772E0A905D10010E4E0663B01C97173B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads