hxxps://login[.]microsoftonline[.]com/86dee0cd-d165-4c56-8012-ff92853ff361/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000

Analysis

user interaction
yes
max time kernel
105s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://login.microsoftonline.com/86dee0cd-d165-4c56-8012-ff92853ff361/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000
Sample260929-y89pssssh1

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 5 IoCs

phishing

description	flow	ioc	pid	Process
Email address	157	[email protected]	3852	msedge.exe
Email address	158	[email protected]	3852	msedge.exe
Email address	158	[email protected]	3852	msedge.exe
Email address	153	[email protected]	3852	msedge.exe
Email address	156	[email protected]	3852	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{06206A37-8DC5-4FEE-89FE-6AE565C0AA3A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2280	1316	msedge.exe	87
PID 1316 wrote to memory of 3852	1316	msedge.exe	88
PID 1316 wrote to memory of 3776	1316	msedge.exe	90
PID 1316 wrote to memory of 3776	1316	msedge.exe	90
PID 1316 wrote to memory of 2032	1316	msedge.exe	89
PID 1316 wrote to memory of 2032	1316	msedge.exe	89
PID 1316 wrote to memory of 2032	1316	msedge.exe	89
PID 1316 wrote to memory of 3856	1316	msedge.exe	92
PID 1316 wrote to memory of 3260	1316	msedge.exe	91
PID 1316 wrote to memory of 3856	1316	msedge.exe	92
PID 1316 wrote to memory of 3856	1316	msedge.exe	92
PID 1316 wrote to memory of 3260	1316	msedge.exe	91
PID 1316 wrote to memory of 3260	1316	msedge.exe	91
PID 1316 wrote to memory of 4008	1316	msedge.exe	94
PID 1316 wrote to memory of 4008	1316	msedge.exe	94
PID 1316 wrote to memory of 4008	1316	msedge.exe	94
PID 1316 wrote to memory of 660	1316	msedge.exe	95
PID 1316 wrote to memory of 660	1316	msedge.exe	95
PID 1316 wrote to memory of 660	1316	msedge.exe	95
PID 1316 wrote to memory of 764	1316	msedge.exe	99
PID 1316 wrote to memory of 764	1316	msedge.exe	99
PID 1316 wrote to memory of 2352	1316	msedge.exe	100
PID 1316 wrote to memory of 2352	1316	msedge.exe	100
PID 1316 wrote to memory of 4948	1316	msedge.exe	105
PID 1316 wrote to memory of 5988	1316	msedge.exe	120
PID 1316 wrote to memory of 5996	1316	msedge.exe	121
PID 1316 wrote to memory of 6004	1316	msedge.exe	122
PID 1316 wrote to memory of 4820	1316	msedge.exe	132
PID 1316 wrote to memory of 4820	1316	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://login.microsoftonline.com/86dee0cd-d165-4c56-8012-ff92853ff361/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff9750c188,0x7fff9750c194,0x7fff9750c1a0
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,10516654577127074961,9520043358999227740,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2745161431269081920,3761131786882653517,262144 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,8950770916514034858,9685672233251610466,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12844876816887449448,13854176825393571409,2097152 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1734349459329242968,2811011903736992495,2097152 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,9079866525170524252,12411050470550506682,2097152 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,2855287389361316375,7763017418575361908,2097152 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,12024902740456094791,1317889102617696561,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,713488300938458149,18396039072575833128,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,899244037476854983,9015754946237446739,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,899244037476854983,9015754946237446739,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,13744426146349039797,8230831306411328388,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,7866031043474819938,12945354262315984515,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,13541730897375419466,12244234843923150776,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,15513018204053810037,16970727150173609666,524288 --field-trial-handle=2060,i,2729225889904880290,4491931581671850825,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 26KB
SHA256 b208f707d37cd880a1d68936fb7aa0e9a2545a0e707186083e7302af01972e39
MD5 24fdfa61cce15fe109b3336ebebe623f
SHA1 82713361f54b5f92eb9cdfe242a35e24148be1ce
SHA512 1ef9277005aebc30363975eb6aedff686ef933181c5e8bfffd580fd075f7008d2a2ad5f85fc505c382027554f44e1e7389075873e8463dd5cc11c2e860d0d1d1
SSDEEP 768:CK7ciDKe6A+ioxS7NvM1S7qoLxu/jpdxy:/KEDNvM1S7hxuJy
TLSH
T17BC2E23BA832AD3620815E97709C0A9E72F4E7A44F2543D097D62D1FE5694CF2050AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a77c56d0f86473205f8b4d5b3f3cbb46b99a6844933a265fb7280e9351e40b2
MD5 161e111af9594233c0d445367ccaa915
SHA1 7abd484938fa2461b1061a3916784b839652d182
SHA512 dcc09b0658fb87033d9cf46f8e52f0ef2fcdf72d0d2bb39ef7ba753a5cac04b8eeebe8d7fbffe2222e9006bf1b9c236f8e8a7ac98b9d056e0fef27f1bf283dfd
TLSH
T13A61A2CAE1E34C95F7A806B047D70DC73337DC83556B2E5E9468DDF8788A3922109314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a9a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a9a9.TMP
Size 3KB
SHA256 faa8dc804ca469588ede1c26986b679e3b380f82d209c0c9301f33a70c8d5249
MD5 d1dd955531923ed57fcbab67b99b127b
SHA1 346e880e8da34cbf5654e0c4199756774ad4cbc3
SHA512 044c9b1e4839f2912687f0c8dcfce2315c9f7e093209c3711bc5f27b592e310544716044952a13efbf05957f0262e00a691181e07af13e255a08428b8d296924
TLSH
T10E61A2CAE6E34C85F7A806B047D70DCB3333CC8364A72E5A9468DDF8788A3926109310
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bc72f1faa3841f19183d845397cf8c2ad65650db6f8d034e47865a2791b6a9ec
MD5 1c0167f504b4ebf8f5774b5e8dc9e139
SHA1 c7fff90d9abcddb8a0a688313efa4bba5302810c
SHA512 d5e98756d47636459c49f68fbe4938f91a112699e6c0a49248c2c753f6801a0bbbca3953fa98f998b56456333764a1366e876c3927aa179eae48b9a6ca878b82
TLSH
T134319CF387F1456ECE1096F49914DE2BCE1C0511436C785986D8AE27D7F34B0E012A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a57c2c8fa9c04aa47c7adede60cc84840f800d47a7a6a0e793f5c1ece738bef0
MD5 ea436c6a80ca5da81267533b98dc551a
SHA1 790c0ee5c156986e69366d5ecaac4f21b8248fe8
SHA512 8739a93cdb6ee979341dbcfa5105c3245cca6e7a1489e21915aceca22028703619879044c2ac4b73cfce334e0140f9eb727a20768e7ac5b3c9bbff31d040f9af
SSDEEP 192:sxZ8REWh/fksQQIdpLhHW6+WNfjYdYRPfxnIg5jJ:sxZ8Jh/fksQx9HbEdm5P
TLSH
T1E122C852AE28797B8CD7E20DBB15BF43E6F9503251911E48EAFC861C05E76DE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 68581ab4bfb7efb52b78719c1b2f5560101ce23d84d73056c0a68600454f0297
MD5 3c35555638b1346ef8fa1a8f4cd9bea7
SHA1 6745d4d6ce131054a263a79514c597315182da43
SHA512 a464175e54b85a75b09d779186d858ef622431724a7100ff0bc0241971c599c5c575c285e7db3899eb3aeae0bea965f5721c351d68226e8824a9f16ef90965a7
SSDEEP 192:sxZ8REWh/fksjQIdpLhHW6+WNfos/YRP1xnIgrJ:sxZ8Jh/fksjx9HbD/m/9
TLSH
T1AD22B8526E28B57B8CC7E20DBB25BF53E6FA503291D11E48EAFC861C05E66DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 39eb56048118f993833de723e577415554bf2aa97dad83878c2798290f9610c4
MD5 f0d20df4b98e724c4d3ac96bec20b482
SHA1 f985ce38a88b9c12ed0e1dc35c967db506e1b18f
SHA512 906d7a9c223089c71ea350fbdef4f8e8b2ad1171fd5035b4029c2f21b6381f7d0d94027998916121537db61a11aeb84814a1e88169010b98b73c7e6b7ffdfb90
SSDEEP 192:sxZNREWh/fksQSIdpRFHW6+WNCU6BH9h/YRPdxnIg5jJ:sxZNJh/fksQb3Hb2H/mXP
TLSH
T18132B752AE3469BBCCD7E21DBA15BF53E6F9503252901E48AAFC8A1C05E77DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7fc5c6afbc0ee8b032805b26046bdb5477266ffa20744673eeb6018bb82701a2
MD5 b61691b931ce57752a889a7894bee689
SHA1 b837fd9d636e48e1ae1ba65c50034de7d33e66ae
SHA512 47929465df8904b7c906ca3f22b17f778cae2e5e35ddc95f4f5e2ba726c2aa3c560debd01c8fce68824f9065a94ca426781335f275dea30e78ce05fde4cd6ca4
SSDEEP 192:sxZ8REWh/fkszQIdpLhHW6+WNfViXYRPQxnIg55J:sxZ8Jh/fkszx9HbMXm65
TLSH
T15822B752AE28B57B8CDBE21DBB15BF53E6F9503291D01E48AAFC861C05E66DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1aae64491f127987bb9f3f40420e57f66ab577c910dd79760e9ec52bb940eeaf
MD5 c6c6717aedc4d1804cdd34271af549d5
SHA1 791b36eceb84c24f0730ca6a8a73e7f49f226b83
SHA512 15fe4d3e45b62f0f5634b1aa1de6bb0cd7650c50a9aeb4e3c2a930a0058d8b70328e101c0700cccbf1db59053d17fb1f5eba7dd3e293ca8b3bf8ede0ea0cfc32
SSDEEP 192:sxZNREWh/fksQQxIdpRWHW6+WNCU6BH9h/YRPdxnIg5jJ:sxZNJh/fksQxIHb2H/mXP
TLSH
T11C32B752AE3469BBCCD7E21DBA15BF53E6F9503252901E48AAFC861C05E77DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e62b72129a4cb5d1d0a2b284810cf5389893540c12214e2a0d8e41781385b3a3
MD5 6282ff4f460b91979b7360a0dd3165b1
SHA1 c31d606908d4cac42a4d5a439dd756cf23df348d
SHA512 e0098582f4b86c2169db6f7e03bb36eba1f53f02ae5a529f3f9a0194c06eff87ff8a7e36b3458a1255a97d3b6f7a243f2d6f6189fb60c4cd74310b7bb84be25f
SSDEEP 192:sxZNREWh/fksQEIdpRvpSHW6+WNCU6BxYRPuxnIg5jJ:sxZNJh/fksQdVpSHb2xmgP
TLSH
T12A32B752AE38697BCCD7E21DBA15BF53E6F9503292901E48AAFC861C05E77DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 079c6e13d1ec1b9898fbb369310acc37ca418e124f7aa34e721783eb4d89ca1a
MD5 2d2ceb8bbca555631ad91f4686cd1d1c
SHA1 c289b1309027c25736a79fba30695f5c96e3b9a2
SHA512 08129b1ee078ee3cad8cea283e2185f70e6d1e207de051ed21f381119337f806fef42ae3843e82e4f255d0c2c9369e34750a3c473ab64878cd1e8145914c30d2
SSDEEP 768:0WK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Lroa+GL:0WK9uzYWvcQWsu1ja0HL7Q34a+GL
TLSH
T1F2C20A3F640CCB7E4FC01A9DDC5A6F973E9802D7A6584D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 77673f04b088c9577c12528799b3c004b85d0e88f6eb0b467832f0b89dce8ef4
MD5 352a782b711e18bd771f604f8cb17517
SHA1 3ffa2f56cbbb8880fba365521fdcb4577a332722
SHA512 cd924132d547eb898b755869618b096801afd7d158060005f038752e1c64def4a61539886b60cf23dae3fada6938a44bcbaf77e937ebd4d40c5a54de3e72a4b5
SSDEEP 48:K0mImRAthrvzMb/KXIS5MK9Z1zMxxcYKbRRylHI9KUUovyZGI/Kval:K0mJGQKjiO+H+KUUaqGsKval
TLSH
T1DF91720170BF16193C7D7958A2A4971E524131B3305CF6AB7BBC10B98F2AE084DFE9E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592bc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592bc9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 267f92f643ed569e5b24d57a611ef52c7591e7aa10d456bf83ca2ed9b385feb4
MD5 98167f327b6aea7f3f32030c73881c87
SHA1 e783bae91658bf880e3b97d295b6cf0fe6f0d1ad
SHA512 c592ea2fb215f2e98dff4d165d76725ecb1c5c07764693f0526565374b404d811c14f6ad56de0ba072891a1581ca7d87dacffd544ea13a1755a4b9a1d577b6af
SSDEEP 384:cZcI1sN1DwFCEWU+OjTVHglhBmUtgOIwZOygUoX:K1bCy1nOFmUXs68
TLSH
T15E828E72AC785CBBACF7E141F88A72035FB88067E6C56B4494FD5F1C01A65A8130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 437fd80cb88182b4014913d1546704f659e89ba56175783e8e137221c3ca172c
MD5 95c1d0f7b32e60f5c8bf3742fb780183
SHA1 788aa3df2c9392e8d04ce011374ed0286ee27d8a
SHA512 0d5f4255cca8e053ead358e0c4788e8d2a3d5d284c5b66355d50648a191551f9bf18e01c62146cc503bccec37d70864fb330b4441e16fd0739f023f8f38644a9
SSDEEP 192:SONk6ygpQmiUy4LtOCTVgcSMosSPzPVoU6:SONk6lHJtOCTVHglb6U6
TLSH
T1C502E935BC687CBBCEF3AE06F88722135FA8117BDA552B44D5E85A1C01D766C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dd1c22926d01565fd55a00cd5aaffcd159c72a16005608bb9d9ef0de5276eed9
MD5 1222c1d1bd022ae8768f752c425cc70b
SHA1 2e679affa5d28760a281e83d768f2023b60da3e9
SHA512 b4ef0517a6c9c8fffed4c6f36b4bdd2f473f0e8ee833b0fb45a41f7086b5f3716c0ffeb7b3bdd40cb6e271dab39989b888ba66827122a6701f3eb051ee492c74
SSDEEP 384:hiFiZcIxTsNP8TUNTUlIlDwFCEWxT+OjTVHglhB2UtgOIwZOygUoX:IFQVOwgGCr1nOF2UXs68
TLSH
T1B9C208F258D7987AD8AE9743A77D2D028EBCC067F585A640B3D85A0CCC561BFD307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a432632ba23a0f4320def13d6275f46806ae16eae1181251cf291dbd90e1469
MD5 60ec04cabb8037b43f0951717e817370
SHA1 5733bdae489638c1b808f30f9130e88b950b8b37
SHA512 87d8a3d32fafcbe6f9abcaf73abe9ce3423c8386048e4b8729972efea1aee9348a3a7a5df63ddded1a9af85e3019249a3515610bf84cb0dbb516806bfa9cdd98
SSDEEP 192:SON46ypQmiUyBL6OCTVgcSMosSh2BEw03UNq9U6:SON468C6OCTVHglhBSUU6
TLSH
T1FF12F936BC686CBB9DE3A541F4C631035FA85267DA497B41D5EC1E0C01EB6AC630B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9a9f5aa0459679873d57bb07fcafe6a4a7cffe673086f79f8da6d538552852b0
MD5 750c8287a7c4656974887e8a6d6f094e
SHA1 d4512f965b29feb94a151e9ac6c095d7e811b94b
SHA512 a0b15c16d7f466d89459c4c827b45e33366dc3a0ab31f5f3fb448a4db75f58f4f3814d924d48fdc8af78a0568f1937bd16aa547f9047d40b25801d84096cb4e0
SSDEEP 384:5ZcI1sN1DwFCEWU+OjTVHglhBmUtgOIwZOygUoX:R1bCy1nOFmUXs68
TLSH
T18C828E72AC785CBBACF7E141F88A72035FB88067E6C56B4494FD5F1D01A65A8130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 11f6eac3812ff0998f6a78109afaf9cf6ac6236824f79d78e4a3fa621159c052
MD5 b65380287e9c321dc98d36511e63e637
SHA1 f94abb66fa6755b20996aece979068351886c96b
SHA512 03c7449f5b265824b2ec924b76c2032491a2368248e9baf137ba6313fec90995b921144735fdd4749da15d843bb389b3219b8d83ac0d9c2ac5c3f0a5fd3e8da1
TLSH
T10AE00242574000D3C409437000C723003F72D024178313579A1011740C303052E14400
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59619e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59619e.TMP
Size 392B
SHA256 9e2ff2dcef6ddf27543d6938a1055a00bf5031a9e4f6d7ab904f6d60f76bcebe
MD5 39e7dd451dc01dd00b226a3ef523dc87
SHA1 23dc47395373f3d17f94579611f84ba20b24ccbe
SHA512 7e837c669b43c59848701ad996eb015d259ce1139dfccbb26930ef26457cf061d1091656b8bfacc4c2de827bdd713a0ff2e35000a55375677481c7fc3f54fa8b
MD5 SHA1 SHA512

Submit Download

e1e06c66-3973-4ec0-82a6-8f70f87af784.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e1e06c66-3973-4ec0-82a6-8f70f87af784.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b21f5fda9b70f7f33be9215e11b0ca7963795af9083f4a3ec051e7824bd14fd6
MD5 0aacad1b879f3a9e01111ff13c2ce58b
SHA1 1bc2f60446211961c266fede2e4bcdb825db9537
SHA512 825af6b4bdc76e77c7f2198c06b50c44f55732cb3df1f4a9b1c2ef27249b44b48621a6c5a01fbedec7fb9253f43b052ddf21fd6268e51d4531055c822ce8eb99
TLSH
T19641EB99B6FA1148B3B77E5A5BF6A8AD487EB9373E17945E10010E4F0A23B00CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads