hxxps://tr[.]ee/sketchfab-antibot

Analysis

user interaction
yes
max time kernel
56s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tr.ee/sketchfab-antibot
Sample260809-am2v3axbnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2808	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307084553041832"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{CB179D34-BA96-4921-AF60-3DB27134758E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{B1C4A298-C254-4617-9C0D-1D026AB9DBD9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2500	2624	msedge.exe	89
PID 2624 wrote to memory of 2808	2624	msedge.exe	90
PID 2624 wrote to memory of 2644	2624	msedge.exe	91
PID 2624 wrote to memory of 2644	2624	msedge.exe	91
PID 2624 wrote to memory of 2644	2624	msedge.exe	91
PID 2624 wrote to memory of 4216	2624	msedge.exe	92
PID 2624 wrote to memory of 4216	2624	msedge.exe	92
PID 2624 wrote to memory of 3476	2624	msedge.exe	94
PID 2624 wrote to memory of 3476	2624	msedge.exe	94
PID 2624 wrote to memory of 3476	2624	msedge.exe	94
PID 2624 wrote to memory of 2916	2624	msedge.exe	95
PID 2624 wrote to memory of 2916	2624	msedge.exe	95
PID 2624 wrote to memory of 2916	2624	msedge.exe	95
PID 2624 wrote to memory of 1588	2624	msedge.exe	96
PID 2624 wrote to memory of 1588	2624	msedge.exe	96
PID 2624 wrote to memory of 1588	2624	msedge.exe	96
PID 2624 wrote to memory of 2148	2624	msedge.exe	97
PID 2624 wrote to memory of 2148	2624	msedge.exe	97
PID 2624 wrote to memory of 2148	2624	msedge.exe	97
PID 2624 wrote to memory of 5792	2624	msedge.exe	99
PID 2624 wrote to memory of 5792	2624	msedge.exe	99
PID 2624 wrote to memory of 5792	2624	msedge.exe	99
PID 2624 wrote to memory of 2828	2624	msedge.exe	100
PID 2624 wrote to memory of 6024	2624	msedge.exe	101
PID 2624 wrote to memory of 2828	2624	msedge.exe	100
PID 2624 wrote to memory of 6024	2624	msedge.exe	101
PID 2624 wrote to memory of 3456	2624	msedge.exe	103
PID 2624 wrote to memory of 3896	2624	msedge.exe	107
PID 2624 wrote to memory of 5452	2624	msedge.exe	108
PID 2624 wrote to memory of 2984	2624	msedge.exe	109
PID 2624 wrote to memory of 4076	2624	msedge.exe	110
PID 2624 wrote to memory of 4076	2624	msedge.exe	110
PID 2624 wrote to memory of 4076	2624	msedge.exe	110
PID 2624 wrote to memory of 2664	2624	msedge.exe	111
PID 2624 wrote to memory of 2664	2624	msedge.exe	111
PID 2624 wrote to memory of 2664	2624	msedge.exe	111
PID 2624 wrote to memory of 1256	2624	msedge.exe	112
PID 2624 wrote to memory of 5204	2624	msedge.exe	113
PID 2624 wrote to memory of 1256	2624	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tr.ee/sketchfab-antibot
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x238,0x268,0x260,0x288,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11636409246457311159,4595876777769399272,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,12262638726942460236,9513208997040204781,262144 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,8676435998614288697,13668358783412974147,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,2430775480491487074,3980728839904239153,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,17917633872160255123,13358789971631215238,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,3772230360070666343,10060884626993269997,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13131236600338422677,6859327281861426683,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5356,i,14774705154348297151,10924605397562628545,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,10454956681245594538,2273040597483836577,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,9726201034796273597,16295098506023862239,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,13585503070600366323,14849398222380139158,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,13585503070600366323,14849398222380139158,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,13665866150748429667,5159346830385455443,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,2956854626531656019,5197786787136863023,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,13093492877151262492,3579429436633232515,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6052,i,776873440243963998,6863043059833580405,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6960,i,15835435861047121310,16088863310818818544,2097152 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,10661959313269252383,2927203227093362498,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:12
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,8639252580195776971,9809307305662395210,524288 --field-trial-handle=2892,i,1683043394762556399,13341122037673016988,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 96KB
SHA256 d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
MD5 dc131113894217b5031000575d9de002
SHA1 f96348260751ea78b1d23e9557db297290bdaf28
SHA512 0aa4420c7b7dcc70238371f9d21d521d0673caf4c1883eeb2d3254c5a1dad941f4569f418350ffc61e93303466c504179b90ba0acf008250dc9c2c6ddf6f850b
SSDEEP 1536:kWKd1QBjcSqfPdRBUJEW8yB7F2W4Ob2RdFoEw1r4FM9OcU/0UDTTj:m10zEWfB7GObYof1r5icUH
TLSH
T170A312AC58FFDF34AA65A9FCD27856761094223D83EDC0AC90A200C6C7B65794FDCD98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d8bbc53089f19f7bcb7942dcc1c92bf38863d3bf457d329c04b66fdc43a156ca
MD5 053f4660292e5ab9daa72e35f032a429
SHA1 7389a87d3c48f37bd8ca5816cdaa40c7eb48f592
SHA512 15c9d367b8bdf32c63e1101533da848f33c6488a51fce5f8898117973e8b911b2c7f2c3026b9baf6eb72eb93ce7cef7176fb4352722456b33cbfe2729a53549b
SSDEEP 192:sxRhRObN/fusKowGuzoA8pi2Y/g6+WNe2Gr/YolMbeY/GrIgIJ:sxRhON/fusKopTS/5M/F9s
TLSH
T10F42B8166928A93B8CC7E61DBA55BF93D2F91033A1D42E58B7FC960C04E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e559645fc6ed5c5c2d708ab8310d5efa3d3cf9f35a976c5d668945179831281f
MD5 8a8d88d8aaec66cb19f4a86820686ed7
SHA1 f37497d99482e047c46be5f34600afd0b94ee0a5
SHA512 4cd0e57db59c615e0ba9b18a285fad758526592ff5eccfcaa17e2644766598cde079413b067ad61650609eb14c1bbf2a1b25e295ee7f9a27f137fd3972c15a93
SSDEEP 192:sxRqRObN/fustowGqzoA8piM/g6+WNe2Gr/YolMbeY/GrIgDjJ:sxRqON/fustopn7/5M/F9B
TLSH
T1D242B6166928AA3B8CC7D61DBA55BF93E2F91033A1D42E58A7FC960C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 786b914a1b3e83108a69ad55252ff8bda9287d7569ee9d6b33f5fd8537c9a178
MD5 e388ca2f82fd7378d06ff063f8ad5248
SHA1 c9c7f33afd4ab7e47675a5fa8937887e7cf444e0
SHA512 0ba639d43878901d9501bc03a342926e0d264141842837019d0ca18feabc5a12b1efa819679b1d66e87ed1303010fa8fa02494eb61abf75661e5d9c11eebd3f0
SSDEEP 192:sxRqRObN/fustRewGJzoA8pN2M/g6+WNOTBnXYobjeY/GrIgDlJ:sxRqON/fustRepUt/5CXO9r
TLSH
T10242C7566928AD3B9CC7E61DBA55BF53E2F91032A1D02E58B7FC960C00E77DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 51084449e73b88e13c2a212179685dbdba073cebda336a57b6a31c508d471598
MD5 1fd81dd249e5cfce2540cec8c9257329
SHA1 49241f19f47fbafc0c23dec439aa99d8c751c593
SHA512 a2e712d4f698e544f0cc60ea3fb4357f78bfcd860283d030fb4ebb873c4945db21ab70d81bdf5f8e1d9146971a15661be3cadb9843e7c08cda6004175529ac4d
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXGro981:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vj
TLSH
T1EEB2DB2B640DCBBE5F800A9DDC19AFDB6D9802C79B588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 02d7c940232a1229e2ecb3de052121bea2e0fafd55d2f176b18711ae53c7bd50
MD5 f8a78ce551c0bc8eaa961decb45e794b
SHA1 ab1b8e03636d4f0e286694bd3fafb4779efa77e2
SHA512 af806d862a7589a7ac38446351ba4f8eb7c4af1980d41a7cc400b3cbd724d045268f4364d6635e534d3a4fd5cd04147a0322547af4e46a9701305a50affd1f3a
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgziXv6K4c+:C3gFB31lERe1JDggH2vHG5FaHoZs4q2y
TLSH
T101913440757A12443C3EB61D90A9981ED9C1B8737009682F7BE951668FABE424CFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\a5c218ce-ba5d-4f56-b393-f19fde1fa4c5\index-dir\temp-index
Size 72B
SHA256 fd17c6f915ec6f4fb52c7067f37ed0f63dfb9eb9ff2c22cebd1e9bac1741ff79
MD5 a6dcfc92ede337a42d4188c85d52d70e
SHA1 fb96f89c71c09f7f28f353654fdf3f77d56dbf69
SHA512 27de5b7b2ef2b104a844410fb1137ab829696efe9c10241ed186fef0ff3c606c80e871879c47339e79666f40623bcd7caf1133826166b6a22e812f171ddd685b
TLSH
T1BCA002154BCE1045D0145D7560051FE12710CD500C400703C498419C8C606CA591501D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 93B
SHA256 36cdbfd8ebc59c711a12e23528fc41c0e64ba1c760b99390d6066562e2512682
MD5 1817ca859c573b8fdf5ff97b3233a1f6
SHA1 5e0c4a96a709b9fff040a3bc33efb51a73890ba9
SHA512 901a2d42aeaeaa463e6df78ac8ddac1e3c2b4e15d91e35018c23bf99123ddccd59d9c3a4e06ff6b271fd5bf9c71597a9c03223dec18fc82cb513df40a23d0ad4
TLSH
T191B002BB004565D55E7134FB040632DDC86732CC5CD0DFCC85B5105933105BF1042D68
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2b47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a2b47.TMP
Size 180B
SHA256 8dea1a0019da2409e311df38ce739ca27f2b8d7e5af775842aabfc0179c2327f
MD5 4e6fe0b94f5c730117f7631bef8574f5
SHA1 09284ece59d3ad1229760851469f7d0357120e4c
SHA512 e7a212a195b9a59f2a80379d46991e7bb66b6775bcb89e5ec2ba9df94658f3e84bfb1922b245bc7f3f57aedc430aff89b36f00cd3ec321bc211973ec87cda521
TLSH
T1F3C012B7018691916E7914EA415232C4C8363FC89CC1DA8D48A5314922788661441D64
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 22088d33244f3e8c0a25af858542627071190b22deba57ae5bb8960fc887a7a5
MD5 e8c563d13a0fb41a191421525d8d9d77
SHA1 82c0a99ad089720e8cd479d255688a99cda42f28
SHA512 9836427c68598848399494797b3ef734b51cafe3db8e5a88ef1b3b1c9c93426f738eb352c8c63498060f0753db2c35affbc83b23cbeaa78069736478ce8ff3c7
SSDEEP 768:Si3EO/TBOW8Fsmi1ONXyer1IRCzni9B2ewBKZO3q:Si31adi1SIqn22evZ+q
TLSH
T158F2BE30E465DE234CD2A7CAB5077343AEF85067E5C81A74AAEE6F1E029765E130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1777ed25dae49469e0a66b873733d9953a74b47588fdfaf273603a515cf26608
MD5 e6415110945452b6190a8ee2a1ae6d46
SHA1 fc4f876f18071cca05f6a78967977e67a4f4a227
SHA512 c70468a77eb695e719b9920f56a527285f4729ff0735dadae70fddff832091f3e6bd0a8816b39164c1c801536f3eae948bbf5b9aa679a48267a74d265f1aaaaf
SSDEEP 768:8rv+4UNbdz3iY/TBOW8FsmbONXyer1IRCzniwBeVH1SK7:8bsbV31adbSIqnFEH1l
TLSH
T1CF03AF31A1A8DE334DE2A7D5B04772037FB8605BD6840BA0DDDA2F4E069B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf0152ecb0b759410a8e844626498bbaef5f96a9873d7b0216be0629e3c8cb1e
MD5 32f9b1006bb13e958a4413b61d6d179b
SHA1 c7c181cfe7a90928275117f067b05c8a2cf3d0a3
SHA512 ed86c9ff940c6317d1cb6ff84e082caf2183c2ecbd92aa6ac7fd3bb0ce2812863fe2eb498a9029f40cae50b47b7b04ea10711341e824adb5b202ac97387e63a9
SSDEEP 768:Krv+4UNbdB3AO/TBOW8Fsmi1ONXyer1IRCzni9BEWq:Kbsbf3hadi1SIqn2Ez
TLSH
T1D703AE31E498DE274CE2A3C6B14772537FB8105B85C407A4EAEA2F8D068B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 63663066d5da7f190f387d157b3b5484d956e1d7bec1d8ec91533d7c693b4597
MD5 a120f2083f5b4bde2511855312c24b02
SHA1 416014d33eee42519a6c5bf03f44942ac23abc00
SHA512 5617a338928ebb595c735b8e27d06e7431c9b7e02c20af18149a2a70850439983324880ac8e1d08a16bd81002746c4d3655d122f61c21f950844216469d3ca1c
SSDEEP 768:hrv+4UNbdz3F9/TBOW8FxONXyer1IRCzniBUeVH1SK7:hbsbV3baxSIqnLEH1l
TLSH
T1D803BE36E4A8DE334CE2A3C5B14772437FB86057D68407A0E9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 30dff5ff6621f0894027f5fb9ba741c33a04448c481930b7acdbe0562555ae7e
MD5 b200cf512de5b16beb54620f162cef3d
SHA1 e66c95665474f67aeaba4a37c6ffd6e59fc64b7b
SHA512 bdbcd65cac44f35292d860723b9d61f51350811989f5ff304f55a846afb596ef8bd6a5632f58074746f2d9bc1ac4c4ec0112eed3b49e74a62dbd0344478c7b76
SSDEEP 768:Oi3fO/TBOW8Fsmi1ONXyer1IRCzni9B2ewBKZO3q:Oi32adi1SIqn22evZ+q
TLSH
T101F2BE30E465DE234CD2A7CAB5077343AEF85067E5C81A74AEEE6F1E029765E130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c6333dd1cd4c70f9948c2ba2cee5a45564091746049180256a1ebe88b16e4555
MD5 6552e8da5d6c98dfd29448d5c150ba72
SHA1 b01e3060c8ece97d93df2b83e4ee9d9f6b24b412
SHA512 c952fc4c306c31a1f14b90d3026f83d8908973d172ab65a896bbf46557a02a0ab4be90a05eb66eb8900079b40bf94e5cc41f5d6d8ed88b25649e5300729d7c7b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cf99875a36782a92d18fbc9ee13852e72de0e405151c453cdca1012fe84c8008
MD5 9d7a48cfbe4ec38138e842c71293b035
SHA1 1876f4dfdc094f514f49982d40d48307fb88b274
SHA512 deb911e547cf332341fc8959396d0d932c8e7edf20546f4c569441975537a5ed1f385d5b5e89d747e1d5eb8a8604d694d53ca576f32bbe175a015619002d75d1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e9e67df46a4669e374c33e9fdc01a6e33eebb16c42dfac99f19898f85f504a44
MD5 484c0129579edcce3737061d9c92a0f2
SHA1 3ed50c6461c903e7d0a2269002b8353b532cba27
SHA512 3f18c3bdb024d6a25247df7b501d6dda1088578ad15378bc70f7df53a7884b7051f015dcd6fc8bb002c5bf2cbced60022a6cab166bb678e963f07eff344d8b9a
MD5 SHA1 SHA512

Submit Download

33ff5acb-2a5e-41f8-923c-f42ec8911b87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\33ff5acb-2a5e-41f8-923c-f42ec8911b87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads