hxxps://m61dncw0[.]r[.]us-west-2[.]awstrack[.]me/L0/https[:]/google[.]com/share[.]google%3Fq=ziTOLBskZAdSnM4Fx/1/0101019fdb068626-5692fe09-e406-4761-b30c-5e939d7ee1db-000000/_eN1w9Ik7VlXEMAf_ycLwa42ZDE=474

Analysis

max time kernel
118s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://m61dncw0.r.us-west-2.awstrack.me/L0/https:/google.com/share.google%3Fq=ziTOLBskZAdSnM4Fx/1/0101019fdb068626-5692fe09-e406-4761-b30c-5e939d7ee1db-000000/_eN1w9Ik7VlXEMAf_ycLwa42ZDE=474
Sample260810-thhfeasdrd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308514072977761"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{E49837B3-BAAF-41BA-9F08-F67B29BB5B23}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4536	1148	msedge.exe	84
PID 1148 wrote to memory of 4556	1148	msedge.exe	85
PID 1148 wrote to memory of 3168	1148	msedge.exe	86
PID 1148 wrote to memory of 3168	1148	msedge.exe	86
PID 1148 wrote to memory of 3168	1148	msedge.exe	86
PID 1148 wrote to memory of 4624	1148	msedge.exe	87
PID 1148 wrote to memory of 4624	1148	msedge.exe	87
PID 1148 wrote to memory of 4340	1148	msedge.exe	89
PID 1148 wrote to memory of 4340	1148	msedge.exe	89
PID 1148 wrote to memory of 4340	1148	msedge.exe	89
PID 1148 wrote to memory of 896	1148	msedge.exe	90
PID 1148 wrote to memory of 896	1148	msedge.exe	90
PID 1148 wrote to memory of 896	1148	msedge.exe	90
PID 1148 wrote to memory of 1636	1148	msedge.exe	91
PID 1148 wrote to memory of 4620	1148	msedge.exe	92
PID 1148 wrote to memory of 1636	1148	msedge.exe	91
PID 1148 wrote to memory of 1636	1148	msedge.exe	91
PID 1148 wrote to memory of 4620	1148	msedge.exe	92
PID 1148 wrote to memory of 4620	1148	msedge.exe	92
PID 1148 wrote to memory of 1164	1148	msedge.exe	96
PID 1148 wrote to memory of 1164	1148	msedge.exe	96
PID 1148 wrote to memory of 1164	1148	msedge.exe	96
PID 1148 wrote to memory of 636	1148	msedge.exe	97
PID 1148 wrote to memory of 2496	1148	msedge.exe	98
PID 1148 wrote to memory of 636	1148	msedge.exe	97
PID 1148 wrote to memory of 2496	1148	msedge.exe	98
PID 1148 wrote to memory of 1736	1148	msedge.exe	100
PID 1148 wrote to memory of 812	1148	msedge.exe	107
PID 1148 wrote to memory of 4308	1148	msedge.exe	108
PID 1148 wrote to memory of 3416	1148	msedge.exe	109
PID 1148 wrote to memory of 2056	1148	msedge.exe	117
PID 1148 wrote to memory of 2056	1148	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://m61dncw0.r.us-west-2.awstrack.me/L0/https:/google.com/share.google%3Fq=ziTOLBskZAdSnM4Fx/1/0101019fdb068626-5692fe09-e406-4761-b30c-5e939d7ee1db-000000/_eN1w9Ik7VlXEMAf_ycLwa42ZDE=474
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc4c01c188,0x7ffc4c01c194,0x7ffc4c01c1a0
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11963403243310426219,10626834202624924741,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14387454175316750650,14995470150379785049,262144 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,7135226716457884246,17107508348773842420,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16564739625337132738,7628990856975651143,2097152 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2388880287614604934,14809693929379828636,2097152 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8073265880778926313,6415289020631228832,2097152 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,7304301328558910954,8415470617587428100,2097152 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3664,i,5044606495019728418,15928682885092282467,2097152 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,1509069471175588300,16434453708569730328,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,7584501067026633237,14306748921039278573,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3487118983551213173,3588481746874551416,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3487118983551213173,3588481746874551416,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,9373895650105998339,8262064853890135521,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,13609429541117058729,702094964690183191,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,12778472248611697664,12303751796392290344,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,8002455134166880807,14627903987636548635,524288 --field-trial-handle=2300,i,5522117835006692622,13025479891301967759,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a2b5cc2e203368f446c575f19f2fe5f61d33e3a9d2a7813ae6c061f28bde2415
MD5 fb12914c93c690ccd6905a726f1260bc
SHA1 e4366ea19d9acd21006a84c56f57afdedc180278
SHA512 fa9481ad31c244c8365710251529a81c45eadcf695229fd09b4c231712557400edb2b9724960631eaa05ead35f74c308116b6561f5856c42ae964b56f8503d9d
SSDEEP 96:d61JIm7G8KhD4GJFMc5mp99W2xAQbXhOfSa+tGqLlQKsosy3gsdlPD1V8FqJZuDF:d61qm7G8KhD4GJFMc5mp99W2xAQbXhgn
TLSH
T12F91813805AE1471D3891CB2A6D1A207317ABDE7F61B1E35C2E0AEB3110FF62753E44A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c0f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c0f9.TMP
Size 3KB
SHA256 7cc2f835b57e2a01f9cf4a684b7cdbbf9447151897ccd0e973e64868b9393370
MD5 5bf32cd11349b4fec08c9c4055d4e146
SHA1 97a68a09177170ca4153fed0b569a8974b0318e2
SHA512 d8d8ca52c5f8938fe1d84f420fd59c680d294350fc0560bbb5c6655e82f8fb99b3e445fe237fe5bd9c638f48cca0ad66386978808b82ea81add6e3361c153a8a
TLSH
T1C761E738092E0871E39A28F156D5320734B6BDEBF9561E75C2E49E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 616821bd46477ad44d893af4ce8bb725c7e43a0dce83ab3b65d930a2c79a39d7
MD5 e9ba242fee145cf0819fa912db6cac72
SHA1 5842eaa972816e8dea36e436f48b95388985331c
SHA512 894487e55e79017d6255a9dd856f98fe27fab863c7acc8cd4ab369e2bc4890949b34e1eda75d726f633242ed5a3a32a257985deaad59f275a492095314645fb8
SSDEEP 192:DcnCjfJPXg4F1cmHNjX8i3+OAc8ezSHzg8VtED48Ly+ZR9GNRkB+z:DcnCDJPXg4F1FHN78i3fAc8OiU8VKD4N
TLSH
T18AE18CB383E5952E88125AF5DB14EE2ACF1D0728432C3C6AC9D9BE57D3E2462E10161F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7752cf79e5650a6f78295a751b7d37ab4ee5f948a1b461bb948f0dc16dfdcf41
MD5 b9ca69b3b42d52ea74d8c73a2c01436e
SHA1 c6b3733cfcb71ef66b740c6e280e5610c17386a5
SHA512 129cfb2309a808d660c01a74a3ead8c3efc38c8f77f745fc2d30ae869dc2026d9a16513301aea2032d5fe508d203881c161e9204ba1554e512cccff0cf20f803
SSDEEP 192:sxZtREyM/jK1Ml8Mkf/f+sU0Y/lIdpekGHW6+WNbTl7/Y9INDKFGp+IgrJ:sxZtiMf/f+sU0Y+erHbb1/V+N9
TLSH
T1AE52E8126A34A97BCCDBD20DB955BF53D6F9047392940E489AFC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0b368395da2d88582fb7723367a1352cc6e99a7b6ceefcb642627666d44ac7b5
MD5 1811e36fd2a685e2b1ec3f855710733a
SHA1 7a56f41106704016c8c23c3cf592f433b2ed5b2e
SHA512 f1c33e3ddae73697424bb59232b34070b32c2caae39b2f49eb1179dc61a96bf491e541b73ba674b6898681c9cfcdc55342a4bbe25eb08d5f0f254394129e9a62
SSDEEP 768:GTcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNdroqg6v:GTcv21wWvu+Z+u1jaeFLeRNWqf
TLSH
T1AFD20B2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 780dd5a1d6dcf21a992e30dbac3be7c0df2b73d2be13ce24d213a424ffe78492
MD5 7101630d96a7a2a9409bec4a0e70bb63
SHA1 eeee9b2b464aac3d114b8032046a9536a44a3884
SHA512 3048cf499512f0808cf4b35439f8b7343266e45adb127986f80f0ed815c95c5ac365891dac51cfbed9b6650fcbadff25464a72bc8be6007ac970ea15900dd408
TLSH
T1FFA002A006A52016E04042706E81115023545994071313C255D895C489AC5475366774
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ed405755b7929fbc4346b4ffb85c549b915eb1844cb22571bc9984ffe2dbe778
MD5 d964e1affbe4d97c320c40d1cf611d20
SHA1 85dea68af6c521dd7a3cddff846b9c6c29566d2a
SHA512 f730e2bf75e212c974edcc9511326fa8abccd69a0e13259b7617d2b4d267292819ffc0503596da8e6490028553342431c8318a3f9a2615873e698fa201163d5f
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyCqz:mTLqHPy
TLSH
T1D8916516313B029278BF684CA3A68A368E4536A33818F56F7BB800754F27E551DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594694.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594694.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 02179c95891e0c7e6951af45e9218dbd343a2c7a1c7050c7332d29b3e8812df9
MD5 8bb4d4e695c0aec5f792aa0c017d42a1
SHA1 cb5c3c4fed51ce1ab5bf2fb53fb84ef9a77f0f9e
SHA512 009a71712c68947e5386d2c639b7f8dc263379ceabf52742b815b89837e2ba9153fac6d9cb5793a7ea9c2a739fa085def314d859abc0418c2a318fcdf3633289
SSDEEP 384:vZcIhsN67BHGg3zirUAe+CMOf5J6HlytEDq1A:nhpjDhjkOf5Joy6Dqi
TLSH
T15B928E3169781D775EEBA145F84B35135FFC8027E6C56FD491EDBF2C01CA6A8230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f9bb02dc9c1d1c09e3fd64c40fed8813ad5e8c7be3659a2a2fde8e1acfd2b407
MD5 9107080ed349327ea2f642390016047d
SHA1 e46c9d40a68a20c7f6d16ce52a8288a5bfef61f7
SHA512 dcfb6fbe974bab5800b2d77a2797b524f021c82fc83a6848436f9833ddf75135159867a0d4eb891fff39571de3438c124a5195f5bdca8367461b7e277a84c98b
SSDEEP 384:LiFiZcI7zsNC8TUNTUlIl2BHGg3ziraAe+CMOfEJ6HlytEDq1A:mFQvjwg0jDvjkOfEJoy6Dqi
TLSH
T110D23AF254E74936DAAE9747E77E2D034EBCC027B5845A90B3D86A1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 73c4856958e76de631cdc0a9c14ecfa18bce94ec823a31aa40a746b86266f176
MD5 75f2a0e9a1b434250a1b49206375b9ff
SHA1 b47f2787854256cde58f710a2781d7b2266c456a
SHA512 db90d8ba9a563697744a52807595fc8a73d1bb806d104e0ba2ea4d23ba246b094dd35458e7dcbda6323c45b98bf68b5af66231f99e6ac411cd1325d4825d0f34
SSDEEP 192:JONVh6v+YLNQmiUyf6Zh+CGlOdmuus3EU6:JON/6vz/jZh+CMONUU6
TLSH
T19C02FA357D682CAB9FF2AE45F48737175FA8213BE6912F80D9D82E1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 149105c9d9f94b0af0ea784be7933d7c169974b790c75266690ac171831e0ea0
MD5 dddae5aa7965a9e114a10f979ad671f6
SHA1 ed74524e6b0b45c2c2b8662b07b3d5a8270de518
SHA512 5b63a35b8a39c7693cb18c3ece555e6b2376ff7c0a1c10c2489d3c7a5b8d85177c9c622d68aa89766fdb52288ffa50ece2d2576340b8e683f7e786abe4d8e02d
SSDEEP 192:NONL6v+YL4QmiUyy6gh+CGlOdmchetCHlqoU6:NONL6vz80gh+CMOftJU6
TLSH
T156121A31B9786C6B5EE2A545F48735139FA8513BEA867FC0D5DC3E1C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 951c25115fa49a4d0e5f7a155884d5f96ea6c5124b0dd67ad06495a49711c563
MD5 0366af72983971a56e5493d45d8709cd
SHA1 65e32d2a5dbac909f344e62ee84d256345c0a9f1
SHA512 0b3440c8e202e16bec0fb4ad378abd9aa6faa19cb6256fc67df70bcfc1992f3b7682a6189c386d74668d5b0591f3b458a48e32bd3f4799f3c36c006f2fea0f39
SSDEEP 384:OZcIhsN62BHGg3zirUAe+CMOf5J6HlytEDq1A:shIjDhjkOf5Joy6Dqi
TLSH
T1CC928E3169781D775EEBA145F44B35139FF88027E6C46FD491EDBF2C01CA698230A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 46f7674139a8cd22d59df1b2b260e5f8a79e57c1c3138b7d619fac5e7ccd41e6
MD5 92f02d64fcd8298061f179b57d33efee
SHA1 fca1fe74e078d0f1cc83bd714a4fcb7544231467
SHA512 013371c59fd7b321f7712ee29cfb7c6b28737eb0cc2aa9a4c4afe0dbf57ff7a40f5c0ebc7d828fc7b5f49fbb7c5a61cc0e24f5526451b8c4e388001ed2a0507b
TLSH
T124411858A6FD1048B3B76F4A9BF6A86D487FBD672F06D45D10120E4E0A23B00C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads