hxxp://otch[.]io | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://otch.io
Sample260811-splwqsfa44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309350984249513"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{64477D6B-9E18-4DA6-98AF-97A0978D367D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4360	2412	msedge.exe	83
PID 2412 wrote to memory of 2052	2412	msedge.exe	84
PID 2412 wrote to memory of 4988	2412	msedge.exe	85
PID 2412 wrote to memory of 4988	2412	msedge.exe	85
PID 2412 wrote to memory of 4988	2412	msedge.exe	85
PID 2412 wrote to memory of 1524	2412	msedge.exe	86
PID 2412 wrote to memory of 1524	2412	msedge.exe	86
PID 2412 wrote to memory of 2056	2412	msedge.exe	88
PID 2412 wrote to memory of 4516	2412	msedge.exe	89
PID 2412 wrote to memory of 2056	2412	msedge.exe	88
PID 2412 wrote to memory of 2056	2412	msedge.exe	88
PID 2412 wrote to memory of 4516	2412	msedge.exe	89
PID 2412 wrote to memory of 4516	2412	msedge.exe	89
PID 2412 wrote to memory of 4948	2412	msedge.exe	90
PID 2412 wrote to memory of 4948	2412	msedge.exe	90
PID 2412 wrote to memory of 4948	2412	msedge.exe	90
PID 2412 wrote to memory of 4228	2412	msedge.exe	91
PID 2412 wrote to memory of 4228	2412	msedge.exe	91
PID 2412 wrote to memory of 4228	2412	msedge.exe	91
PID 2412 wrote to memory of 3604	2412	msedge.exe	96
PID 2412 wrote to memory of 3604	2412	msedge.exe	96
PID 2412 wrote to memory of 4352	2412	msedge.exe	97
PID 2412 wrote to memory of 4352	2412	msedge.exe	97
PID 2412 wrote to memory of 2652	2412	msedge.exe	98
PID 2412 wrote to memory of 2652	2412	msedge.exe	98
PID 2412 wrote to memory of 2652	2412	msedge.exe	98
PID 2412 wrote to memory of 2508	2412	msedge.exe	102
PID 2412 wrote to memory of 3212	2412	msedge.exe	103
PID 2412 wrote to memory of 3212	2412	msedge.exe	103
PID 2412 wrote to memory of 3212	2412	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://otch.io
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x24c,0x7ffeb6dac188,0x7ffeb6dac194,0x7ffeb6dac1a0
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,7706116547408274819,18348506990323846446,524288 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4301035275915360081,12213573893100175623,262144 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,16603762653813716431,3421851313959944657,524288 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5747758100455380810,4976092483869005245,2097152 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9683497315202326200,5854570300944204026,2097152 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,13897812209644079672,4487065816102195738,2097152 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,8573953239728241096,8149985316033820763,2097152 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,14766178097665439108,6061883478603458989,524288 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,7764791807710091595,17690257480526099128,524288 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5508,i,10025469476669298650,11492265883108858235,2097152 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,10289946460881869882,12619011741187393600,524288 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,10289946460881869882,12619011741187393600,524288 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6188,i,11233314859466827049,7704177207917811709,2097152 --field-trial-handle=2380,i,12233564091997382899,16860152415696037442,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb198c81963e699455b64b9ce7875c63551bac1db146ac9e8b16246add4890ae
MD5 e5b55006b588cbfd0a0c4801b2c1055a
SHA1 ddde08e8f44660d59ca273351189083ac43d8809
SHA512 453a760669986555d9c71b4c1e974d6f1c226d7ff4ac867acc428d6346dc81990eb139eda65972c93abd04637b774055ff3725b789c9ae8f2d1492ee6187b2dd
TLSH
T1DCD023707D35EBD6D11E10F45420494112374273315757B5B155584EDEB4081F2DFDF6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aa5f667d5b738869920fa587d0c73e1a3c4e315fb6e05df47e5274b5284ccc56
MD5 59c75a11dcbbe3a70ad8c24a8236db07
SHA1 a69216cd7f37cd113e622a03209041bb7747f7b8
SHA512 1d011bc4f7530ef84f2aceab6929469ff37b01b2ed0cccb50f56ef7d78d4f0d9167cb8ec21e02c6033799b6ebc9202aa28b757629822e5beebda608d853588ae
TLSH
T18C61A4B80552096DE3671571D0D15500347086F9FBD3BE9782DCEABAEB37BA3805AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58afa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58afa4.TMP
Size 3KB
SHA256 27aea302f3da358f6fa8c9e9c1115db890aecfa468b3b0c2aff81abd78fe4959
MD5 181422af685d779035cc4f1b99ae3b06
SHA1 734a3988ee766e78eb23ca1bc4b1b03604bd6779
SHA512 45b9389d7ed1e71e6e78d64d39c4ee65720e10f78b31bdf7ab8267d6b8a6db0b4fd6120337937951595150789e3c35d498f31cc0f94d2cd98f14c5d501bd7e4f
TLSH
T10C61A6B40552052DD3671531D0D15500347486F9FBD3BE9782CCEABAEB37BA3805AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8566193b9144b4c54c91fdc60de61233f11371dbf4b08329af5d5d7a24f3ab55
MD5 a4fa0232105f6d6f7fee72cb6889b09f
SHA1 2bc1ef99e3191f15e2bef62aa207815e0bcc0f9e
SHA512 fc4fe432f0a8d1a2fcd5bbba4df0120a111352d8e8020aeeb258218d46c18ff53449bcd0cde58b85a28439eb76019a9a250700f23c83cca80c27b4685c29f233
TLSH
T1F5116AF383E585AECA1156F09A28AE2BDE2D0506432C7C1989D4EF2BD3F3475E01195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d19eb47b87df289e1278705e9a8b0bad688dd675510a92be5ef92a50f438282e
MD5 3cbdd17381e0313de4e192a4c0bc1f8c
SHA1 d4259cd217ee4824311ecb3bd912e80735fc0747
SHA512 38718ae29069a6b537d3b087541d6db60bcafeda16df781e9450262c397073cd6924fbd0d42690021edcfc2c33c476d9c4503ff1d8ba765175e46ef64449d7a0
SSDEEP 192:sxZiMR4yM/jK1Ml8MkGn/fmnshy8CRIdp+lsHyq6+WNGY9IK280IgrJ:sxZiMGMGn/fmnshyXa7HaGx9
TLSH
T10D42E9116A34A977CCCBD209FA557F53D6F5447392900E58A9FCCA1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 950ecc3b0c8e59768b5cd515dd9114d9003e33ef6530b36da814290c62650655
MD5 75395c56fe1e7c8bcd731175659febed
SHA1 78790e75432cbd6e6d88d2133e724883051444dd
SHA512 ce828311e554695e4524047997285d8f4ff6ad70d424073334be33a170774e2f5b474108d8b15208f7fb4b488aefb492c800d3cf938c466dae777d7383d21374
SSDEEP 192:sxZiMR4yM/jK1Ml8VkGn/fmnsJFWpVVy8CRIdp+lsHyq6+WNGY9AWBLCIgFJ:sxZiMGTGn/fmnszWvVyXa7HaGXv
TLSH
T14C52D711AA34A977CCCBD20DFA557F53D6F9047292900E589AFCCA1C04E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6ee412fca0b52ab3f64154fde4231ab3d5f9d916e8d5160b63412b63f4267169
MD5 c4b19785f3671441651ebf31bf6adf78
SHA1 a7a4088814d0ce19ddce9a0b9717e46f0b4be5fe
SHA512 a5bb8d877702e6cf259f063a2a0de796ebe24dd9696a96568564e49fdb74e69c3621bca2051ca8049ee8a22719a3cded911058363e21ebaf06a6549b04dda588
SSDEEP 768:Q1cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNrroBg61:Q1cv21wWvu+Z+u1jaeFLeRNYBl
TLSH
T14FD20A2B280CCB7E4F841E9CED2A6F866ED801CB56988D5447FA894C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7332384f2c2a366be97e2c54d20ea6b13e1c35187dc0fa2c9f9028050042164f
MD5 ceb711da81db9ca043df13bcbf01f1f5
SHA1 680dd585213f848ee042287cf731dc8a8c67c456
SHA512 0c7de08c1ca68a7b34b7a5550153d9d1ab0a9a8caae239142c698769381c54cccfc1d06a51dc4100774c4828f5768ad82ec7932685a7766a613a466111578a45
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDOFWKeMTSXmKgo+g:mTZwVg
TLSH
T123915005713B12523DBE380CA2A69A275E8132B37818F57F7BB814A20B67E510DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 890ac4b9ecf593e61c0b0f7cbaf1f4e27b090f9779d06abfc75e1ae635a6e098
MD5 ca98e8e6f3db1f189841e2f0b3dd1784
SHA1 e69284d0f2327b7269d07f768adb8154b5cf59f1
SHA512 cfa1bdd747764547e989b8c108f0e7b1f97a11d61b6f083ab173fa7ff47a4d597e1840deb65e3d4ca64289060a99256cbcd8449fea9fa2a5dc949ab8d2843442
SSDEEP 384:gZcIhsNMowzi2tee+CrdhMztOOPrXLpe8C/0o:ehfhZzEztOi9PC
TLSH
T1E6928E31AC382CA76EF6B945F48736139FF88077E6C52B94D5ECEB1C05DA5A81306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fd5b91c3b206b4e5993a2630ada99101010fea4cae741efb5b0168588edf4e2
MD5 d405ae6fc99ea084f08823c972e12c6f
SHA1 c8a424c9cf2f3bfc869078eeed55ffaa60c8f782
SHA512 ddd12395501233943bfde8042d2502e4302d208347b2cbe2bbfdbb07445ce768bcd81a227043d9e5ed54b555682db925afc5fcf4fc4245d643aef875983a1969
SSDEEP 192:JONVu6v+YLNQmiUyT+Zh+CG5+FdeuIcus5TK1U6:JONo6vz/7Zh+Crdh352U6
TLSH
T18A02D9356D386CAB9BF2AE05F58736135FE8217BE9952F50DAE82F1C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fac326511fdadf9aa30a61295ff68b3b0c06e91550cddc4f599f848005099ddf
MD5 a939f2b206c0eac359d1976a76ee90aa
SHA1 4da13f99671858d718d9a18a34f1797efbd5eff3
SHA512 8e0b72109e183dee58d1aebe0ac9f3f246c0611310fb8f75979590e7f992fabe89252f0575fb76e011ffdbd08083f52811dbbe56d9f1f8ddd0d97b440d4aada2
SSDEEP 384:dZcIPsNMowzi2cee+CrdhMzzRA8tJ41oIlKp/4GH/OOPrXLpe8C/0o:FPfYZzEz68fMKp/4GH/Oi9PC
TLSH
T1FCC26CB0D8A52CE754E5F8C9AA82E6136DF85037D5C95A4CD2F8FA3D309F9B81316821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df0750eb8064a7ae0c39f3c92c52c7cc95a284eb8c6f673ecb57166eecb9f912
MD5 be02d4bf56adf83a1769d614f4262c32
SHA1 6108df0bcae09502bfdf57d0e6878a9f04b65520
SHA512 313618d18c29bbd89a6a9740d435c1d8c6b33f0d67fcbb2120a104a6add55a917b25400e25b09c54e628c3c7229374bce52659d259217988f6d8224d850813b2
SSDEEP 192:2ONt6v+YLvQmiUyq+ah+CG5+FdeuInIEACHMrqfU6:2ONt6vz1cah+CrdhMhtU6
TLSH
T1F1122A316C786C6B9EE2A944F48335139FB89167EA893F80D6DC6F1C01DF6AC2306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f158f9b7eaf453928f36788382f785280497054c12caca00f3317b13c9d2be6d
MD5 c846df1dca73d14dd69a9540d6163f92
SHA1 061e537a510888b3b984afb0ce2f4e7514a7fe30
SHA512 65c48af519186ba71873304215980fe4ac2bf25907a8c87ca9d30e414a6293464a61b36d2a5f66e99928e2b6f0244078e1aeeb7f43b677e0f0699d4651cde5a4
TLSH
T1C2412C5CA6F91148B3B77E569BF6A89E447EB9372E06D05E10110E4F0A32B40C861777
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads