hxxps://www[.]katrinasdream[.]org/dreamscape/the-fourth-pilgrimage-hall-to-hall-libertys-flame-for-equality/

Analysis

user interaction
yes
max time kernel
83s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.katrinasdream.org/dreamscape/the-fourth-pilgrimage-hall-to-hall-libertys-flame-for-equality/
Sample260925-q3rm2aee45

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
848	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348176780021469"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{7EA34978-226F-4A26-A42E-47EEF0977345}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2072	3416	msedge.exe	86
PID 3416 wrote to memory of 848	3416	msedge.exe	88
PID 3416 wrote to memory of 2784	3416	msedge.exe	89
PID 3416 wrote to memory of 3704	3416	msedge.exe	90
PID 3416 wrote to memory of 2784	3416	msedge.exe	89
PID 3416 wrote to memory of 2784	3416	msedge.exe	89
PID 3416 wrote to memory of 3704	3416	msedge.exe	90
PID 3416 wrote to memory of 3920	3416	msedge.exe	91
PID 3416 wrote to memory of 3920	3416	msedge.exe	91
PID 3416 wrote to memory of 3920	3416	msedge.exe	91
PID 3416 wrote to memory of 4156	3416	msedge.exe	92
PID 3416 wrote to memory of 4156	3416	msedge.exe	92
PID 3416 wrote to memory of 4156	3416	msedge.exe	92
PID 3416 wrote to memory of 4184	3416	msedge.exe	93
PID 3416 wrote to memory of 2568	3416	msedge.exe	94
PID 3416 wrote to memory of 4184	3416	msedge.exe	93
PID 3416 wrote to memory of 4184	3416	msedge.exe	93
PID 3416 wrote to memory of 2568	3416	msedge.exe	94
PID 3416 wrote to memory of 2568	3416	msedge.exe	94
PID 3416 wrote to memory of 3748	3416	msedge.exe	98
PID 3416 wrote to memory of 3364	3416	msedge.exe	99
PID 3416 wrote to memory of 3748	3416	msedge.exe	98
PID 3416 wrote to memory of 3364	3416	msedge.exe	99
PID 3416 wrote to memory of 3792	3416	msedge.exe	100
PID 3416 wrote to memory of 3792	3416	msedge.exe	100
PID 3416 wrote to memory of 3792	3416	msedge.exe	100
PID 3416 wrote to memory of 2112	3416	msedge.exe	101
PID 3416 wrote to memory of 2112	3416	msedge.exe	101
PID 3416 wrote to memory of 2112	3416	msedge.exe	101
PID 3416 wrote to memory of 2408	3416	msedge.exe	102
PID 3416 wrote to memory of 2408	3416	msedge.exe	102
PID 3416 wrote to memory of 2408	3416	msedge.exe	102
PID 3416 wrote to memory of 2364	3416	msedge.exe	108
PID 3416 wrote to memory of 5156	3416	msedge.exe	113
PID 3416 wrote to memory of 5156	3416	msedge.exe	113
PID 3416 wrote to memory of 5156	3416	msedge.exe	113
PID 3416 wrote to memory of 5676	3416	msedge.exe	118
PID 3416 wrote to memory of 5684	3416	msedge.exe	119
PID 3416 wrote to memory of 5692	3416	msedge.exe	120
PID 3416 wrote to memory of 4328	3416	msedge.exe	128
PID 3416 wrote to memory of 4328	3416	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.katrinasdream.org/dreamscape/the-fourth-pilgrimage-hall-to-hall-libertys-flame-for-equality/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff805ffc188,0x7ff805ffc194,0x7ff805ffc1a0
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,8239551504727387147,8593519657476268006,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5661008137555014956,9872265456461599864,262144 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,10197451366019188758,8541902249155489964,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15754845178300982872,1621807444992170458,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13452071844483945049,4244876659889695819,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16648369192006655165,13771653588876574615,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,7031669447049807704,5265556326629426179,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,14580080443423722754,1581222595831642682,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,13697279267013017888,835850744524963944,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5676,i,14414579450031941383,16203433323926095466,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5844,i,17924359212533907976,7340403524253605636,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6024,i,3696504995724635973,585420226779182979,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15684305389179732849,16765919442705077975,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15684305389179732849,16765919442705077975,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6664,i,12544122978156753871,15469331781760102074,2097152 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1164098662681253563,7730728304618344152,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11755518440439026699,7476102983443545111,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,14045324922206633610,14695282937215818367,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,12580850852619211776,7011290934068609428,524288 --field-trial-handle=2452,i,12620511647653861769,4671131351692527152,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6ed479393db33fb57954b9ea1a7393f3e38613b2a18d3ca59670984f6696a76b
MD5 2ae8692c00454a1200c2c6b1644982d3
SHA1 625fb506bb8b268512fd3ce02a922792a69d1a76
SHA512 6a29405f4c85684c91865e48775646cc29082b501df1b961c1def6a132a7b3133f976db11b7623ee118c1fa5d3fb8dae6d36543b7907327d5921ae810cde2790
TLSH
T114818585E5D08463FF58F5B061DD2E87FAB843BC5C835FBB28A4C4B95B477825930805
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593e76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593e76.TMP
Size 2KB
SHA256 d5e5e21359c7abae18b66241d51cef197554396305691bbef75d6bf36ff5e8de
MD5 dd2ebe61a38241ca0cbbb2950153c46b
SHA1 396b7d7ca42a63017e2690ff850a04f7ff1e09ec
SHA512 0fcb0c21639b129a219a46717fb5c81db2bf7b3f58d9fbb46ef50ae4d88de82a820e6457f56f78a1a1f1816d0be9d4e149fa278c8101978f87cb3d7a5e6462df
TLSH
T158517285EAD184B0FF59D970B5DD2F873AB887B958C71FB32CA4D5BDAB0A7066830044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 bf8c542e2b19a79908ea9a03a0c46504feeebcb53525fc714e2770277ec6fe37
MD5 f86daa851ae257e576a2279db37f5c47
SHA1 0c5eb27a7bb60832e2419396098197fdcb6c7639
SHA512 4b9e5ace36b3c14cc0c5a7343034730e8d901774c39c2e085f66ca0b56b709581a61b0e228359db63c9756065119435489bc21bed601bb6b843b43cee63143fa
SSDEEP 192:D5ElvYDnMkEEosp9KancfBDaru4oivCNoYVT:D5ElvYDnMkEEosp9KancfBDaru4oivC/
TLSH
T112E165F78AD4822DC9515AF29E287E2ACF5E0528036D3D16C4DCDF9F97F1461D28260E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 48657039b963d7babde8cbe871e42d81e022e96b21e626bd26f98e297d6aa090
MD5 a026cc71ee4906c20181032d2e1dd84a
SHA1 0f17bca1d519a7339e8418a7c0969357e3a9e546
SHA512 bd48cfcf6a7601b2726dc040335ec7506a2a7766566e081548332813b317ac5f09038e958a8fc831ccf7709cc01a519e31a34597c14a5345bbaeba1c4b68de8f
SSDEEP 192:sxZrR/VWu/fzs/gkIdpfJyHW6+WNtgIZ/YYBTajIgrJ:sxZriu/fzs/g9ByHb6y/fm9
TLSH
T13222A8556E38A57B8CCBE20DBA15BF53E6F9403291D01E58FAFD8A1C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dcb4206eb446d23262414b88ee92900ca88bf1a7063420734cac91bccb8b3e37
MD5 93219d72edcb17e1bf164aa1f848b2f5
SHA1 7959812b738bac21f977448a289a3b6b300f64bc
SHA512 9b8585b726fec3ad16ec39590d0b7096512f750481fab34f9366ae5a769eb27b378af95e9b3ed31c51a41846e52a0e09e6d8fc108d38957bac917a92f9e7e002
SSDEEP 192:sxZrR/VWu/fzsqokIdp5JyHW6+WNtbsXYYBeajIg5yJ:sxZriu/fzsqo9ryHbqXfnY
TLSH
T1F022B8566E28697B8CCBE20DBA55BF53E6F9403291D01E48FAFDCA1C05E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8681a90412e21dca53c2b187c10c3b29f90ad0107ef47ab6a32d7919f631353f
MD5 b8bebc87959172cb4bff5a7dd6f268b8
SHA1 c559f6969f5e5aad61ff3006a131edd49022788a
SHA512 c39e30a80a072561ef70a7bada8e096a5cc573e742b4778624296bf37ae65853eafd83cefbaa55a9cfe869018c943aec7dd0e5d398d5f410d3607a1f59302191
SSDEEP 192:sxZrR/VWu/fzsqgkIdpfJyHW6+WNtbsXYYBlajIg5AJ:sxZriu/fzsqg9ByHbqXfQK
TLSH
T1E022C7556E38A57B8CCBE20DBA55BF53E6F9403291D01E48FAFC8A1C05E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 51613a92f5beedfdaa9b2128c012e74dfea75a5760c541e21b2e9c16715dacce
MD5 15baee6cdf44791e761f6b1b472be8fa
SHA1 4644f9f34201cc0c9e703dd89363e49d6c1b453d
SHA512 f66cbe10937740727405059658495d0ab8df549e32879f7b6642b638e9449b6109d40f941f06b0bf209f0542e906b983105fb4f53cf2d161564d95e9d0ddd7c3
SSDEEP 192:sxZrR/VWu/fzsqokIdpfJyHW6+WNtbsXYYBSajIg5yJ:sxZriu/fzsqo9ByHbqXfjY
TLSH
T15722C8556E28697B8CCBE20DBA55BF53E6F9403291D01E48FAFDCA1C05E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 458bb1f99c6ac7a3815f32193614feec2838a08fe454b2a155416d9c5e3a3d1f
MD5 4e8f797c2af25b8bb5366c543949f28f
SHA1 da7c62543744ef9d1edd8cbbc4bcaf0f5f654438
SHA512 1900067fc407dee82d10ba3364c10936ca6c9b6ee09e0200f8206a3131797932e1831ffd2239697e0bf96702fbcb17686a28aa2b0be0b625b2570b05e366e2da
SSDEEP 768:JiyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX2ropzTi:JiyYR7jWv3NpBu1ja/CL8OXNk
TLSH
T1DCC2E92F640DCB7E4FC01E9DDC5A6F9B2E9802C796548D4047FA994C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 fad542432e680dd0dc4ba8b82f356d70128f854f5d8a7a182bc5e12e5d106321
MD5 1f7e426c630594e0ad1a9d19dd2fd4b9
SHA1 90b1f1af534a2fc8b87721ce8b59b38cb43754a3
SHA512 3856d95ef763935e8f5e1ee9a1e91a6ea6a754709f1470ae74e5bce27b604bba5af8e8644a4f4e0161a24027602f50a13acd7d39f39601428cc2f80447d4b6e0
SSDEEP 96:KQsAKVC+ikAKR+uRmKKoS+ROK6E98gKFP:WTTkJ55P
TLSH
T1BAD1DF1531BB020038BD795880B69B5F6281B2B3311AE63BBFBC50A54E6EE544DFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b210.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b210.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b802a6962466973c714c41ee727b4755f4be115d330f073cd258751bea5754d6
MD5 45568d6b538009866d083470dc3847ca
SHA1 1e50dfdc86d722e72c2023498e28a5bef4420fab
SHA512 a5eef43b35677b2e4d02a88b1229c13aa46aeacca8d30a2bbc519226fb0dfb6ed812a476ca34b9b440078514ab2b13965bc457ee79b67f0e82049d5d05d177a3
SSDEEP 384:PZcIhsN2dD1DaiV9zxQX5+DtJOnIqNJr3GitgOIwZOyWQoQ:HhQgNmkDzOIqNh3GiXsob
TLSH
T1AD827C3659B49C775DEBA184F58632139FB85067D6C4ABC0E5FC6F2C01E96A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f81dd121f7c8eaf4cb3d0b1cc60910f8106d7e3d0365bd6ea8f4b1b909931c49
MD5 424f8066a96a7cb34f2b65a985c80e91
SHA1 5bc756dda848c087e02b54ed4318b099e93416ce
SHA512 cc9e8a9b15193e994d9aee151f02df475224af5d2a858b8673d5b1fe7f2c5c61fbd497435a5980cb2746b6560a48a59574a7231fdc26f4dbf0f53c4ac528f35b
SSDEEP 384:+iFiZcIwzsN28TUNTUlIlGD1DaiV99xQX5+DtJOnIqNJrRGitgOIwZOyWQoQ:VFQsLwgVgTmkDzOIqNhRGiXsob
TLSH
T136C219F649D7887AD9AE5743A77D2D038EBCD063B584AA80F3985A1CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6712502d858c2a22909b17af3f34577d2df4a88680eb9b5198e42d3df0852ec3
MD5 0260ffce9f0c1430dd0eed9b01e38cbb
SHA1 2ebdde70cad63caf807379fab71aa8d2182f61a2
SHA512 ed4021e2c1546c1c02dc290960eb388bc30282adbf3be129a02f441ca27c24c678e7927fd0c091660a9a9753dc56449975cf044881c45fc17b422bff73d13fc3
SSDEEP 384:3ZcIhsN2GD1DaiV9zxQX5+DtJOnIqNJr3GitgOIwZOyWQoQ:/hZgNmkDzOIqNh3GiXsob
TLSH
T11C828D3659B49C775DEBA184F58632139FB85067D6C4ABC0E5FC6F2C01E96A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ab7ca8bb5c5942d3583d7f3a3274fa6711d97de3df7549e6d81be65775c93b0
MD5 f8cdbda2d9977e6cb14aaf47e218dbe9
SHA1 2cfc285aae14d878d625acbc0e7e5c538db9a39f
SHA512 ac1551841a1ba89dd8bbc2abd697dee954db1bb9eb12412fa21abbdc77b9bf503320d88c229dc2231a1fc657245034ee7710aa2f9a210bc263928f2271de21dc
SSDEEP 192:EONP6nnHpQmiUyw7DYcX5hQDP1JOnHoqSSJrKg30/5iU6:EONP6nnZDNX5+DtJOnIqNJrVGiU6
TLSH
T164120A35B9A4AC774EE36595F48731139EA45127D6857FC0E6EC2F2C01DEBAC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ca3144ad7342f8fdc64141c12f37300681017d0cc7f67753bcf23bec4bb5fdd
MD5 e60c039e7da6369c0d84dd13a4efb463
SHA1 7546cd1efc6edc764975e73195c7bd895e0a52ac
SHA512 01686e5235582b889a23cdbbc00dd4bddc7efd554c3930b371c382fe1741e5612ed4ab5545e288a29b374c06cd4dac728371740e9640eb637f8bf92795dc43f5
SSDEEP 192:EONq6nnHGQmiUy97QYcX5hQDP1JOnHodMcP2U6:EONq6nC6QNX5+DtJOnINeU6
TLSH
T1D802D934BDB86CBB8EF36D45B48622139FA5216BE5956FC0D6F81E1C01D775C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53f1c2c3-2769-4824-adbb-28958c2f015c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\53f1c2c3-2769-4824-adbb-28958c2f015c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c82bd04f4e318930855b9a6d2ea7e73009ba5f98dc5d48bbf4c2b991273aadad
MD5 2ee5dee77a15d85d6d3b28788e3fe350
SHA1 7fc32e5962a8e4f485e8eee4ceabccb1d7c780f8
SHA512 8430bce2fbaea3e7fa0d0c737bd2927e00b8e5a7c788ff04befe52b6b098c969eae752f19caf453255845f38e5fd3a561ee25107582acb5774e611251b5bc4c5
TLSH
T100410B58A6F91108B3B76E5A9BF6696E447BBC772E0AD45E00010E4F0667B44D862733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads