hxxps://www[.]tiktok[.]com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=lx-sagittarius-star-mail[.]qiye[.]163[.]com%2Fapi%2Fj%2Fre%3Fc%3D%2F%2Fwww[.]i9tech[.]com[.]br/wp-content/AB/#YXJpYW5hLmhlcm5hbmRlekBmcmVzbm8uZ292

Analysis

user interaction
yes
max time kernel
36s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.tiktok.com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=lx-sagittarius-star-mail.qiye.163.com%2Fapi%2Fj%2Fre%3Fc%3D%2F%2Fwww.i9tech.com.br/wp-content/AB/#YXJpYW5hLmhlcm5hbmRlekBmcmVzbm8uZ292
Sample260925-wpfaqsshlf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{290DFB19-E8BE-4CD4-84ED-328899504AE8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 452	3716	msedge.exe	85
PID 3716 wrote to memory of 4772	3716	msedge.exe	86
PID 3716 wrote to memory of 4596	3716	msedge.exe	87
PID 3716 wrote to memory of 4596	3716	msedge.exe	87
PID 3716 wrote to memory of 4596	3716	msedge.exe	87
PID 3716 wrote to memory of 1588	3716	msedge.exe	88
PID 3716 wrote to memory of 1588	3716	msedge.exe	88
PID 3716 wrote to memory of 4220	3716	msedge.exe	90
PID 3716 wrote to memory of 4220	3716	msedge.exe	90
PID 3716 wrote to memory of 4356	3716	msedge.exe	91
PID 3716 wrote to memory of 4220	3716	msedge.exe	90
PID 3716 wrote to memory of 4356	3716	msedge.exe	91
PID 3716 wrote to memory of 4356	3716	msedge.exe	91
PID 3716 wrote to memory of 3364	3716	msedge.exe	92
PID 3716 wrote to memory of 3364	3716	msedge.exe	92
PID 3716 wrote to memory of 3364	3716	msedge.exe	92
PID 3716 wrote to memory of 748	3716	msedge.exe	93
PID 3716 wrote to memory of 748	3716	msedge.exe	93
PID 3716 wrote to memory of 748	3716	msedge.exe	93
PID 3716 wrote to memory of 4044	3716	msedge.exe	98
PID 3716 wrote to memory of 4044	3716	msedge.exe	98
PID 3716 wrote to memory of 3828	3716	msedge.exe	99
PID 3716 wrote to memory of 3828	3716	msedge.exe	99
PID 3716 wrote to memory of 1656	3716	msedge.exe	105
PID 3716 wrote to memory of 5252	3716	msedge.exe	113
PID 3716 wrote to memory of 5252	3716	msedge.exe	113
PID 3716 wrote to memory of 5252	3716	msedge.exe	113
PID 3716 wrote to memory of 5404	3716	msedge.exe	115
PID 3716 wrote to memory of 5404	3716	msedge.exe	115
PID 3716 wrote to memory of 5404	3716	msedge.exe	115
PID 3716 wrote to memory of 5752	3716	msedge.exe	119
PID 3716 wrote to memory of 5752	3716	msedge.exe	119
PID 3716 wrote to memory of 5752	3716	msedge.exe	119
PID 3716 wrote to memory of 5880	3716	msedge.exe	121
PID 3716 wrote to memory of 5888	3716	msedge.exe	122
PID 3716 wrote to memory of 5896	3716	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.tiktok.com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=lx-sagittarius-star-mail.qiye.163.com%2Fapi%2Fj%2Fre%3Fc%3D%2F%2Fwww.i9tech.com.br/wp-content/AB/#YXJpYW5hLmhlcm5hbmRlekBmcmVzbm8uZ292
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa42b6c188,0x7ffa42b6c194,0x7ffa42b6c1a0
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1542609598778618164,12030567798057696446,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,10124034813411104792,652285909501219995,262144 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,10807983230488903140,8697994759310653945,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,987689535542789580,1975380960552674752,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17094735838365434775,10503175486741071476,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,9112041570016356239,9814315147718666889,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,10211486228712791210,9825352094889711121,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1636802304808320102,4173357632738482220,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5252153179370211733,6393837638033424821,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,9908967012316336490,7375186744199861543,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,9908967012316336490,7375186744199861543,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6372,i,15302638583315273453,3945606193560494371,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3592,i,11024323175596093304,13786413158388512181,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6016,i,14483267217128695154,14718706631229568005,2097152 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,3809152501378507270,2443022602432722408,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,76673029941435201,7000611533587693182,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,8709182714711816565,15584019325859201699,524288 --field-trial-handle=2084,i,7544525974280924168,527761274072127971,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4646ed83eaf3b3685f308fee3a19d7e526a3a836a2bb387aa10d7a7148ccd902
MD5 88aedf5d75172f3cc9eec29a794c00d6
SHA1 2ce4e62167a94e3afb458709d8a5ab4848633aea
SHA512 5de6cbb3c167f06093a4d9aeeb16fd381ed59681f5c083b9e0cf8f737e4ae13d19f63b25a7cce1a26b2e7fadc7205a4b462520afaa05e6cc28aa1006b19b2557
TLSH
T1375178C751524CA0F796C3B7A3F659E3BA34CAC71D9F2E510484ECFA8846FD4C18014A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ab5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ab5e.TMP
Size 3KB
SHA256 05ea073e7ad309985c9e049bffe6def4bf86e3f50a44a2ef13ee030bcd0fce66
MD5 2b91f18d4ec49efa8f099260b869519e
SHA1 c0226978c05c15541869d7c7c09fc33d3b196a26
SHA512 f863301801d1c93865b994042404ed3babc397fd90f8ed82ad123c22a76375ff6c41b82a9e35bdf329eff67dee1a7f568cbfa9e38fe7179d88ef387b6fc132ad
TLSH
T1335166C741924C60F796C3B7A3F689E7BA34CAC71D9F2E520484ECFA894AFD4C18014A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8ac5f3614fd6aacee5ac217440f037b3936a793c0572d49f10d2ed53be603233
MD5 e87821f741bdd895682c50287b3b2311
SHA1 a5c2ea625cb095c155142b3f170e2c2eb2832761
SHA512 610d6c41b3082e703ef7a5360bee435faf2edbff0a85e9c126f891fa9fe25852a7f3fa3e84ad743851d20b824fd94b237b96ddbf321ff13e70eed25565b8c4c9
SSDEEP 192:sxZ10R/Wt/fosXr3IdpJHkl6+WNGY364w+/IgrJ:sxZ100t/fosXrYJHZGX7A9
TLSH
T1A912D7166E28A57B8CCBD20DBA25BF53D6F9503261D41E98EAFC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8d2c852da7794db39d43fd4e83ad02c641a5b15902c4219bd61f435b602882c3
MD5 716203361db51637596e308c8dd9eaf3
SHA1 55bd0b1d316423aea205054d447e6e24fa21a7ad
SHA512 a1a14907251b843116927271b6aeb045f25a47524e8c3451da15a2bda19ab12177de0233197fcfe39e5e01e6897bf448426bed2d54ac9bd50e823733977a143b
SSDEEP 192:sxZ10R/Wt/fosfrGIdpFgHk96+WNGY36aw+/Ig57J:sxZ100t/fosfrnqHRGXtAn
TLSH
T1C022D71A6E28697B8CCBD20DBA15BF93D6FD503291D41E98A7FC861C05E6ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 274aa43227afaccfaa02f233c09965298229549cf403fa7ef12df938bc5328fc
MD5 871973921b15f0c363bba560485441cb
SHA1 9241c3427e9b38c905040ee0d58173448f035af1
SHA512 b3e3d44b0471d78b78f7378fc78602baf5ef877567bae379ca28e922c4b5f01605c6b5e039c696232cc0e57ef23469dcd09572916e396bf5315f1e77958c1ac4
SSDEEP 192:sxZ10R/Wt/fosTrGIdpFgHk56+WNGY361w+/Ig5ZJ:sxZ100t/fosTrnqHdGXOAZ
TLSH
T12822C75A6E28697B8CCBD20DBA15BF93E6F9503251D50E98A7FC871C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7c4b8b6f312c436ea95f19071e2d6ba02914814d55ec6bc223c82e54db721d01
MD5 199fd1b1e6e6140cb3c6d793317ba1ff
SHA1 b79e1ddee761bff91616445aca43cb54365d00ee
SHA512 cf99b617e0bf53492f1d25ecf2ce09a2163b1d07feccea62eb58043aac5fe346eed4b6fee9527895170f138e5fbf5f1de9d525285e4a746bcbc036f04a9514f3
SSDEEP 768:R5Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/eroJt:R5Klm7QWvUYe0u1ja8/L/E/1Jt
TLSH
T1C3C20A3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3babc18fd4ac52b70a852209f49f3c1400927fd1b1711f6351f2eba298327db
MD5 5f0c14f3090ad24cdc9948a4942896d3
SHA1 e9a492e98905b3cfaf8c9085d31a49e0b9240dc7
SHA512 ce41fc3979a13ad3ae6f3f0bd62a54378464755cfef64ddad41fe995921637cdc3f86aa2e97765d72b3230ef295d48fbd5e1fa11f3a44bd9987b54e325cd39c8
SSDEEP 96:KqONkNQsjpfbUmjH5ih/cIPURHl8h4otop5yaDmBKP4v+Y1xf//ojdMxMY+XhBj7:BONl6JUm0QmiUyf2so//ihBjU5BCoGU6
TLSH
T1E802D738BC68BCBB8EE39E45F5477B239FA4107B9A915F84DAD92E1C01D715C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 12595f2946b0f43a5f592bbad5f21da263a5fd083aa1d13ac86504568729b8ff
MD5 ed8398cdd39074b781ee417154c75a0b
SHA1 cf6ae69aa7af9e0c54df6bc2fc88abbdc0e780aa
SHA512 48715e0be8c8e89cbd6cb228ddafa5eaa60e5b0b21b6aa64a4efd4c64a15c60f2b9c1c9ce35af76666ec6e8f76863366105924ec22288a4c115f71b623fd6232
SSDEEP 384:mZcIhsNXUM7ZbXdJh//iDkEYoHItgOIwZOydLoy:0hoHH/aDpPIXsYF
TLSH
T1AF828D3A5878ACB66DEB9181F54776039F788067D7C49F90D9EDAB1D02EA1E8030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ca5852767a148192de03a95cbe05b9ae45ab3fdbb0e1eddc0e27790894d58f3
MD5 48a23d9ba33c5c44c5108237346c88e4
SHA1 afa144a77fe47744ca75335f9fad63e875c58f63
SHA512 411ecf9ff1cfc407d201a9a8bd131af9cd411be55765c9772f660c5aaa3eb3df34bfa8f7341d08423c59281a04bcb50eff7227d646fb7ea31a686f6dcbe1599b
SSDEEP 192:BONV6JUsQmiUyn2ro//ihBjkGnPwosDVNxd/SU6:BONV6+8dro//iDkEYoWIU6
TLSH
T17C121839B868BC7B5DA39591F04376139F744067DB896F90DADC2B2C02EE1AC570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6de123ffb5dd97d11269a0b956ecc87b8489e0dda446b146269dab5b95f88035
MD5 06a3010281dec0355f8042880ee301ca
SHA1 1e2bfd87ca9aa4bde2176c86527120e9d846bc8b
SHA512 89e9367336a1ea2ca4d2ba066c097036f9b0fc2d43afaae18ad865cc771dbc462a58b2a4e9b37d489b48c21bfe699f88653d7471290398023ebc73e4657bd4aa
TLSH
T165413C68A6EE1158B3B76F4A9BF6A86D483FB9332E07D45D00110E4F0623B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads