hxxps://u113650933[.]ct[.]sendgrid[.]net/ls/click?upn=u001[.]u6cIXfhh-2B4LKOaDCMhuisVk0SIUQjVrCL-2B-2BsRuJfcBGcn0IOUvkutfM-2B7xcR0XOyZPH0_UWU-2By-2FZm6RuXltwZUEcwiRUscYCyhVhe5OQnAUwBZk8BpEYK50rB4eN9Kga8w8-2Blaj89kPH1kBuRsMH71YOyg5aoLc-2F4hMFejdHvkF6pmsZCXWpSa0rUw62FCjOHq52kUbM3dBcNCR3BeoMysHuLQvc7bJY5SUpxcv-2FodtPlDt4W8nxlEomb7QEQIcyXJMMXghyQ0i2BO83ix3MSiumDTQ-3D-3D%7C60000%7C%7C%7C&sdata=QGzT8JDOvutxIC3EUZpobFom89dfjvrkMg7U38%2FLv40%3D&reserved=0

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u113650933.ct.sendgrid.net/ls/click?upn=u001.u6cIXfhh-2B4LKOaDCMhuisVk0SIUQjVrCL-2B-2BsRuJfcBGcn0IOUvkutfM-2B7xcR0XOyZPH0_UWU-2By-2FZm6RuXltwZUEcwiRUscYCyhVhe5OQnAUwBZk8BpEYK50rB4eN9Kga8w8-2Blaj89kPH1kBuRsMH71YOyg5aoLc-2F4hMFejdHvkF6pmsZCXWpSa0rUw62FCjOHq52kUbM3dBcNCR3BeoMysHuLQvc7bJY5SUpxcv-2FodtPlDt4W8nxlEomb7QEQIcyXJMMXghyQ0i2BO83ix3MSiumDTQ-3D-3D%7C60000%7C%7C%7C&sdata=QGzT8JDOvutxIC3EUZpobFom89dfjvrkMg7U38%2FLv40%3D&reserved=0
Sample260916-wpzz5stdqf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340556077973119"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{9813F814-89DE-4E0F-B218-F483F2B01071}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4200	4384	msedge.exe	86
PID 4384 wrote to memory of 856	4384	msedge.exe	87
PID 4384 wrote to memory of 2624	4384	msedge.exe	88
PID 4384 wrote to memory of 2624	4384	msedge.exe	88
PID 4384 wrote to memory of 2624	4384	msedge.exe	88
PID 4384 wrote to memory of 3392	4384	msedge.exe	89
PID 4384 wrote to memory of 3392	4384	msedge.exe	89
PID 4384 wrote to memory of 4708	4384	msedge.exe	92
PID 4384 wrote to memory of 4708	4384	msedge.exe	92
PID 4384 wrote to memory of 4708	4384	msedge.exe	92
PID 4384 wrote to memory of 1872	4384	msedge.exe	93
PID 4384 wrote to memory of 1872	4384	msedge.exe	93
PID 4384 wrote to memory of 1872	4384	msedge.exe	93
PID 4384 wrote to memory of 4552	4384	msedge.exe	94
PID 4384 wrote to memory of 4552	4384	msedge.exe	94
PID 4384 wrote to memory of 4552	4384	msedge.exe	94
PID 4384 wrote to memory of 3948	4384	msedge.exe	95
PID 4384 wrote to memory of 3948	4384	msedge.exe	95
PID 4384 wrote to memory of 3948	4384	msedge.exe	95
PID 4384 wrote to memory of 4512	4384	msedge.exe	100
PID 4384 wrote to memory of 5044	4384	msedge.exe	101
PID 4384 wrote to memory of 4512	4384	msedge.exe	100
PID 4384 wrote to memory of 5044	4384	msedge.exe	101
PID 4384 wrote to memory of 3484	4384	msedge.exe	103
PID 4384 wrote to memory of 4464	4384	msedge.exe	108
PID 4384 wrote to memory of 3964	4384	msedge.exe	109
PID 4384 wrote to memory of 4120	4384	msedge.exe	110
PID 4384 wrote to memory of 4056	4384	msedge.exe	112
PID 4384 wrote to memory of 4056	4384	msedge.exe	112
PID 4384 wrote to memory of 3200	4384	msedge.exe	113
PID 4384 wrote to memory of 3200	4384	msedge.exe	113
PID 4384 wrote to memory of 4040	4384	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u113650933.ct.sendgrid.net/ls/click?upn=u001.u6cIXfhh-2B4LKOaDCMhuisVk0SIUQjVrCL-2B-2BsRuJfcBGcn0IOUvkutfM-2B7xcR0XOyZPH0_UWU-2By-2FZm6RuXltwZUEcwiRUscYCyhVhe5OQnAUwBZk8BpEYK50rB4eN9Kga8w8-2Blaj89kPH1kBuRsMH71YOyg5aoLc-2F4hMFejdHvkF6pmsZCXWpSa0rUw62FCjOHq52kUbM3dBcNCR3BeoMysHuLQvc7bJY5SUpxcv-2FodtPlDt4W8nxlEomb7QEQIcyXJMMXghyQ0i2BO83ix3MSiumDTQ-3D-3D%7C60000%7C%7C%7C&sdata=QGzT8JDOvutxIC3EUZpobFom89dfjvrkMg7U38%2FLv40%3D&reserved=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ff9c3d9c188,0x7ff9c3d9c194,0x7ff9c3d9c1a0
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,5183299073726960055,1892008190547677029,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,10694599277116492632,13092035715811430426,262144 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,1947813821884633045,4550577532353410436,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,17300963867868516948,2672434910203888086,2097152 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,5597068680641334977,1802793821012527267,2097152 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,11310704952180682726,14001377201072629606,2097152 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,8574003246082007341,15312335450314175314,2097152 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,17439195074254174820,16732414696793013958,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,10946578736556959236,4867394561748321958,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10215954844731645350,11119457724184191331,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10215954844731645350,11119457724184191331,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,11732186386889401442,4795552389818402837,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,18054095515655210902,17299119658084086759,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,6188655489942410482,2850117456455401782,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,9800715276824722688,16986858699421920589,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10914895468402816489,8600155270638213162,524288 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,9685146472468366055,1586295814762504143,262144 --field-trial-handle=2264,i,2195362637058925403,16453549280359040109,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 57b33c0b459e404bf3e00f662ccc18b64905786e02d1280ed4a52810acc24c81
MD5 a5911c13ef345788ddd1115ceef20bbf
SHA1 0e78a664eb8b92e2b9f9d3c9642e985e621c952a
SHA512 3b33ea327d6b487f422ee4d0c5be65e5b56369428fe5254fd65774ac803c17c3f4290b0f7cf675f6df8a219b5d99d126057d529e37f80a3ee7e5d8459fb5bead
TLSH
T177415442CA5128A6FF9485BDC9D41D8B3B709C91ADC3CE1703A7C4BDEE76F724604258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5909da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5909da.TMP
Size 2KB
SHA256 82c6a5340d316b465b2574e54aef32afcf165b911b2d3e153b447d3f081ccfac
MD5 041222ce15ad56dbc240c34d8498d12c
SHA1 402b3929ccf62939ac7f36b5e88d9f3e404122b2
SHA512 65a172c5e8ffa441dfb872c3af22b9280bb2ef028cbdbdea33b273667517fcdeb4657aa8abd90f9e11987cc1f6d2bb34b6c8f7a5565d1fedc024cf1cd1c848b9
TLSH
T1AC416342CA5028A6FF9485BDC9D41E8B3B309C91ADC3CE1703A7C4BDEE76F724604258
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 631e0979dc5d4702a8db65d60df5d8921ca825be0c88c9ff6c2c7281f2cb2f40
MD5 7438408ec30e166d469016706c9d77ad
SHA1 bbcd3e5f5277f3933ad50f1d878546fe63a5a43b
SHA512 62b9707f91707cfb8da466a63d501dd62014482675f63278567aa699b3ef23606184b377a45233a79d6a6e51a89fa1bad10c19ce55dba977253446319d53775f
TLSH
T1370168F7C3E4996E8E0056F06A18AE1BCF6D0902821C7C5A85D4AE2B93F2465E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a1c1c434efde8b1f8df9b50c02384169db607db9e345c93f9108379dfd65dc5c
MD5 306d82e1fac0516071ca3634104aa642
SHA1 2fbbb14bf0981487c417dd5ea7bcf0c9b09ef169
SHA512 3c234d223098f931653faeff16440e9e89e6e3e9f11ad5b3f8524e38fb1d5c7c356353c4c10b782f0d9916ae653eee2d4bbbded8407f1062e4117c1d2a6e1711
SSDEEP 192:sxZQyR2W+/f+psk/5IdpUGHW6+WNMj3/YYBZf+/IgrJ:sxZQyP+/f+psOSPHbI/fBG9
TLSH
T19822B8156E38A57B8CC7E21DBB19BF53D6F9503295901E48EAFC861C08E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6355fbd1f47e78bb358cbd565579c2109a23f952aa26d6501337e79fc884685e
MD5 3e5543de204add1ac088609e5103c63d
SHA1 9772b92de45998ed697c800fb6338791ec08e5a8
SHA512 bbf8ae7fa58564abb3e5d63f9dec4306dcd6beb58406d188c0398c0575bcc90a549d6bf9dfd6ea70595bebff67afec4896481b31ff3ab572c4385015f595820b
SSDEEP 192:sxZQyR2W+/f+psfY5IdpmGHW6+WNMj3/YYBXf+/Ig53J:sxZQyP+/f+psgSFHbI/fPG3
TLSH
T1CB22C9156E38A9778CC7E21DBB55BF53E6F9503295901E48AAFC871C09E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7d1b7db02d096de5f2aa7ba0bd56e3e36a72cb89e3ee2634a0b04df6fe016478
MD5 202bba37e5a596932e775ae7dc0564f8
SHA1 c510e8cf5cd4797b0c54b542b3e00c798a62d9e0
SHA512 42be77777eab28339e3410e4af72726fd3cfad93948920038d37ebf358c6fd6b24719cac605b889293d3f3085c523f4d9620eec259802d97cf4f716dbade74eb
SSDEEP 192:sxZQyR2W+/f+psf/5IdpUGHW6+WNMj3/YYBZf+/Ig5dJ:sxZQyP+/f+psHSPHbI/fBGR
TLSH
T1A822B8156E38A57B8CC7D21DBB55BF53D6F9503295901E88AAFC861C08E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c3e5639f92dd5db622628df3b41bdc1e1b151afaf01e7bda416aa18cf63bb811
MD5 12aaf4ea9f411bb5505b8340a5946202
SHA1 8b316059156ae12ea644b1bd713aad049e04b148
SHA512 07d85c03dcb40c99a068b7e476b79dd2553782a3b1f134890f79c6a792c1ccb039547f371ff80037f003aab2c3a82fa9520ea5b4eb5aeb10ace6078295dd735a
SSDEEP 192:sxZQyR2W+/f+psfY5IdpUGHW6+WNMj3/YYB3f+/Ig53J:sxZQyP+/f+psgSPHbI/fvG3
TLSH
T1F322B9156E28A97B8CC7E21DBB55BF53E6F9503295901E48AAFCC71C09E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0245218af7a7dedbaa1db8c94820e5d0efff8ea91cac9a4f0b18ca7eeb898eeb
MD5 73d40daca92e322eb4d0d563db6e3b92
SHA1 81694320cbd7cd63935fa9797a0cf72d7d854367
SHA512 0efe42bee09da16a5842e64c4c7c13e9a9b2eced8a7871ee12e15543c1b58ff3f29c0b236ee91698f4eea56b08effec43ffe7292e420eb91db85296767e6d0da
SSDEEP 768:ktyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXnropbND:ktyYR7jWv3NpBu1ja/CL8OX0P
TLSH
T151C2F92B644DCB7E4FC01A9DDC5A6FDB3E9802C7A6548D4047FA944C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2eacf2f682120d94557b924ec3d1e3fc0ae89cf5382a2ea39d4807ee62a6327
MD5 45d8dc916d39a6c638840780255e97de
SHA1 391fa209728092879a2b2fd9e99d20876c08cf43
SHA512 3880e11aa41fd88e5d46aa832bca0ea8bf828e648dafa5db7657762898e80a4a66ac9dfeed55d7828aad6070c9c89709de91a1e94246b08975ebbad30e023470
SSDEEP 48:KgjGnDtFVWbFIdISDWK9z1hWxrGYQxjHyLxgNBLPTsbfq3ISZsK95XBI5KK8UDyA:KoUYKxayaSwKrXBaKK8KK4QKz
TLSH
T19391C51033BB030039BE299C95649F6F964131773119F62F7FA90456EE2AE095DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a5bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a5bc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 041837a4b5fa6440cee7f98f2a58025357e7859f5d3546268657f4b7ffd8cbcc
MD5 7bb9571327a36038293d7ae9c0357cd8
SHA1 120829e31739a2eb0cfb879478789452083095bc
SHA512 b726169c9f7ec0c668b538ab406644bd64e1074de0f90910812252cd7d018afcd8e3dd6f43c487cea118bce785d6c4089f868a729fb5e37d931bf31f349e67fb
SSDEEP 384:sZcItsNJUpg9i4T/uQX5+Dtv8XLFXPJrREosa+VYMlkoO:6tb67dkDuRPhREohgyF
TLSH
T1A1827D3169A4AC7749F3A2D2B48736139FB89163D3C96F84D6ECAF1D00D96A81306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1aafbad98f60f96ba48480476468db3622d035222d61580ccef4bce7b774b2ae
MD5 363ecf4f8f95eb48c9ab5e2a0f203d05
SHA1 45b96f39000b1459b4f5abf00b1f43afcd63f874
SHA512 8197f0e61ffed2fb0ce3a8b2a4baefcd8917ab5a4de6f50103f6e5550d75b384cb593b844f4b3763e9dd6a860ec37aa867775b000548ccf006588056de6d09c2
SSDEEP 384:38iFiZcIBLsNq8TUNTUlIlmg9i6s/uQX5+Dtv8XLFXPJr7Eosa+VYMlkoO:3nFQdLwgI6WdkDuRPh7EohgyF
TLSH
T1E4C23AF258D79836D9EE9793A77E2D128EBCC063B1846A40B7D85A1CCC951BFC306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2ef63431955025f677f60f1b9ddc6bece27d6ba10b9f48682245b2cf99f8081
MD5 474afb16f31d631be10840c24069f808
SHA1 c4a7d463ade6d4d1c5649313867ce38ec89442e9
SHA512 91bed29efa5da576e52c8aef0295181a8db36379dd9d50cc0848bed929cf3b8dd4e565673e7e16b24153a424d122320bfbd56dddf0d47e0c886c212c27306384
SSDEEP 192:EONw6nnHGQmiUyBqQYcX5hQDP1HjzorMoLCMc+zU6:EONw6nC3QNX5+Dtv8XL6wU6
TLSH
T1B302EA34BCB87CBB8EF36D56B48626139FA5212BE5952B80DAF81E1C10D765C2306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83b7dde2bcc8aa19523499f26110a42249d3f1b8db28c86f6618d6c411b98f45
MD5 3368fe42b28f3c2e4c420879408f9515
SHA1 e27b9e7e5bb0718b709c3f9e6de2683d2ae97ad7
SHA512 79954f4bc481931ece0068cb60f6b8c7d1f68d729a852d34ef6f85e6a78d3c9ab14ad260d233853c2de68c55e1da745a7a88ad9a97ed55da18da1b98bbc74570
SSDEEP 384:0ZcItsNJUmg9i6T/uQX5+Dtv8XLFXPJrREosa+VYMlkoO:yts6tdkDuRPhREohgyF
TLSH
T135826D3169A4AC7749F3A2D2B48736139EB89167D3C96F84D6ECAF1D00D96A81306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 570313b6be387b2522197cc5f1b4957db268c3fd1a2c070074d9e573f2475594
MD5 c0fb34ccb2085535f2249e86eb4305b9
SHA1 8d52a67173ab4e02a7a667f0b7f393ac35da8858
SHA512 d7dbe34369d96c8e70a66d66ccd6fbaca474ac5564d2014ec5e6119baa042793717487914be9ab0942a568b98c91143383cb1693036edf10d906affb612957fa
SSDEEP 192:EONz6nnHPQmiUyFqCYcX5hQDP1HjzorMoLFX4SJrbg36r/5oU6:EONz6nx5CNX5+Dtv8XLFXPJrgEoU6
TLSH
T146121B35B9A4EC6B5EE36595B08731239EA45127D6857FC0D6FC1F2C01EEA6C5309C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e258f7a-797b-4960-8cdb-cb476c940c38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e258f7a-797b-4960-8cdb-cb476c940c38.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 44ac234feb8c6d21961c9799111404ec88bd9ad0589849a485cd16cf25b9a4ad
MD5 fb52468c05e05b1c1d80b2cfa1d60ac7
SHA1 4191631e4b62fa78e19ba43ccea5f9c3eacc040d
SHA512 6700608891ef48315fa6ecefedb7ef89f27e37e26f5d980c1e58f3c86a0ee5d7ebf5b7f384b9717dee63d351c5ada8b5c76ebc93612e894d6aa8ced2edb5dece
TLSH
T18941245CBAEA1148B3B76F1AABF7A96D487FB9372F16D45E00110D4E0A62B00C961733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads