hxxps://bczllyk9[.]r[.]ap-northeast-2[.]awstrack[.]me/L0/https[:]/objectstorage[.]us-phoenix-1[.]oraclecloud[.]com/n/ax0lkgp9orcf/b/cGhvZW5peC0xLm9yYWNsZWNsb3VkLmNvbS9uL2F4MGxrZ/o/3A5b3JjZi9iL2J1Y2tldC0yMDI2MTAxOS0yMzI2L28vUVdFRlJFR1RSSFlKVFVnZWaTlpZFdOclpYUXRNakF5TmpFd01Ua3RNak15Tmk5dkwxRlhSVVpTUlVkVVVraFpTbFJWWjJWd

Analysis

user interaction
yes
max time kernel
40s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bczllyk9.r.ap-northeast-2.awstrack.me/L0/https:/objectstorage.us-phoenix-1.oraclecloud.com/n/ax0lkgp9orcf/b/cGhvZW5peC0xLm9yYWNsZWNsb3VkLmNvbS9uL2F4MGxrZ/o/3A5b3JjZi9iL2J1Y2tldC0yMDI2MTAxOS0yMzI2L28vUVdFRlJFR1RSSFlKVFVnZWaTlpZFdOclpYUXRNakF5TmpFd01Ua3RNak15Tmk5dkwxRlhSVVpTUlVkVVVraFpTbFJWWjJWd
Sample261027-rtcm7avsdx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{C123B410-05C0-4B76-BAA0-92661EBAD25E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 996	3056	msedge.exe	85
PID 3056 wrote to memory of 1228	3056	msedge.exe	86
PID 3056 wrote to memory of 2224	3056	msedge.exe	87
PID 3056 wrote to memory of 2224	3056	msedge.exe	87
PID 3056 wrote to memory of 2224	3056	msedge.exe	87
PID 3056 wrote to memory of 4212	3056	msedge.exe	88
PID 3056 wrote to memory of 4212	3056	msedge.exe	88
PID 3056 wrote to memory of 2932	3056	msedge.exe	90
PID 3056 wrote to memory of 1744	3056	msedge.exe	91
PID 3056 wrote to memory of 2932	3056	msedge.exe	90
PID 3056 wrote to memory of 2932	3056	msedge.exe	90
PID 3056 wrote to memory of 1744	3056	msedge.exe	91
PID 3056 wrote to memory of 1744	3056	msedge.exe	91
PID 3056 wrote to memory of 1856	3056	msedge.exe	92
PID 3056 wrote to memory of 1856	3056	msedge.exe	92
PID 3056 wrote to memory of 1856	3056	msedge.exe	92
PID 3056 wrote to memory of 2376	3056	msedge.exe	93
PID 3056 wrote to memory of 2376	3056	msedge.exe	93
PID 3056 wrote to memory of 2376	3056	msedge.exe	93
PID 3056 wrote to memory of 784	3056	msedge.exe	97
PID 3056 wrote to memory of 784	3056	msedge.exe	97
PID 3056 wrote to memory of 784	3056	msedge.exe	97
PID 3056 wrote to memory of 2440	3056	msedge.exe	98
PID 3056 wrote to memory of 2064	3056	msedge.exe	99
PID 3056 wrote to memory of 2440	3056	msedge.exe	98
PID 3056 wrote to memory of 2064	3056	msedge.exe	99
PID 3056 wrote to memory of 4268	3056	msedge.exe	103
PID 3056 wrote to memory of 2020	3056	msedge.exe	109
PID 3056 wrote to memory of 2020	3056	msedge.exe	109
PID 3056 wrote to memory of 2020	3056	msedge.exe	109
PID 3056 wrote to memory of 1460	3056	msedge.exe	110
PID 3056 wrote to memory of 1460	3056	msedge.exe	110
PID 3056 wrote to memory of 1460	3056	msedge.exe	110
PID 3056 wrote to memory of 1232	3056	msedge.exe	112
PID 3056 wrote to memory of 452	3056	msedge.exe	113
PID 3056 wrote to memory of 3232	3056	msedge.exe	114
PID 3056 wrote to memory of 3604	3056	msedge.exe	116
PID 3056 wrote to memory of 3604	3056	msedge.exe	116
PID 3056 wrote to memory of 3604	3056	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bczllyk9.r.ap-northeast-2.awstrack.me/L0/https:/objectstorage.us-phoenix-1.oraclecloud.com/n/ax0lkgp9orcf/b/cGhvZW5peC0xLm9yYWNsZWNsb3VkLmNvbS9uL2F4MGxrZ/o/3A5b3JjZi9iL2J1Y2tldC0yMDI2MTAxOS0yMzI2L28vUVdFRlJFR1RSSFlKVFVnZWaTlpZFdOclpYUXRNakF5TmpFd01Ua3RNak15Tmk5dkwxRlhSVVpTUlVkVVVraFpTbFJWWjJWd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff932c9c188,0x7ff932c9c194,0x7ff932c9c1a0
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,6900403474223682285,5969504730049541704,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2822862296067238262,726217377784202973,262144 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,15641401348438092531,15097154236109185655,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5556718345518122642,215925095459633662,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14167376608640749785,17311044992473192265,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14558068896721570134,575787890790517679,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4432,i,4078999325617102816,15827665717030522841,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,13302604374075371965,14620886096037552291,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,11609608701740495014,5744825828080118779,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14990089914756970659,4820461672076559137,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,1812107932277953066,278588479583536507,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,1812107932277953066,278588479583536507,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5108,i,14208404581179884121,1762892069692149022,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4448,i,8352941712920049116,353928400536314292,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,10424270671463943439,13352856183726259742,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,4359942934020422181,4779648023369735724,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1368488632071448754,11288154061782464105,524288 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5972,i,2197047649348470507,10083037874333905376,2097152 --field-trial-handle=2280,i,15645992225317044551,162693907773373793,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3628a510-78b9-4998-a6eb-65b85d685382.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3628a510-78b9-4998-a6eb-65b85d685382.tmp
Size 8KB
SHA256 a4462128a2ad67ec19045d98b635e1a1baec77d80caf0c1cf438978d7e0d7e88
MD5 477ad8fd06364948325732e1838ffe53
SHA1 16fdfffd7644f4f6c450f466eed58759102db547
SHA512 e305105794fa7b1fd790164422f5d59adf752442714b17b18da46d79b6215d90c5626fa76cffdbf1a9c7dcfc466fa84a6af781206faef9218412de85de2de6b2
SSDEEP 192:LJONc6DphmqQmiUyivq8wGYX59ezVCNY+Yjkk71r/U6:lONc619tRwGYX5E0S+YbRU6
TLSH
T15702E935E878BC7B8DF36E45B58B2A239FD4112BAA946F84D6E81E1C00D769C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f9c54c0-8204-4133-8aed-f18e6417acbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f9c54c0-8204-4133-8aed-f18e6417acbf.tmp
Size 18KB
SHA256 871dc8e5eed496bb2479b8531482faedbb68fb7e10bdcadac0bae1a2ab519038
MD5 0287612ff07a2c5dbff48a323e239c53
SHA1 8cc83bf1c2abb08e4ae37fe659a8bd28142f0e91
SHA512 329392058293ad314e41dd7ad20a549e6629d7cf336c114d603652b50547d786303274ae36f2e1317e2934a8cd3ce2acdc1d4cc6936ea251c19764931376965a
SSDEEP 384:JQkUSv0sNhrm52g0BGYX5E0S+YpDh0vaTZcwTIIlz:r0TZOGYu0SVpl0vaTZcwTL9
TLSH
T10E826D32A8796C374DE7E651F14B2A03DEB49117DBC42F94E5DE5A2C01DE2DC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d840131-4601-4379-91b4-2f6a1e1c72c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7d840131-4601-4379-91b4-2f6a1e1c72c5.tmp
Size 8KB
SHA256 d7b55beb9dfe0f92f51587a29f3cd947cbc9b810a4b8b79b4cd073034af82d53
MD5 6040aba09af0f00c9430ed96bca58310
SHA1 9dbcf470f37b3077df8352b19a8003f1604eeccd
SHA512 2c0ea4a5a175294f2640c018bb70fcec3ae02738427f71c8061765ad24693b11a81920857032e1ea9d7df6ce9e49ffb0071dac50c6dede75a5a23b5f9c333017
SSDEEP 192:nONE6DphAqQmiUyAvUwGYX59ezVCNY+YpDyeDkIIcq5YU6:nONE61jNUwGYX5E0S+YpDe0U6
TLSH
T1C4120931E878AC7B5DE3A951F48B39139FA4522BEB847F94D5EC1A1C01DF29C130E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ec9f3225a36b6095e8a072aff3977b6c72c6f861a6c339c4c341dbacfcabd0c
MD5 e099eb95a648ea38aff2773c3580afa6
SHA1 b16d4ca0fc492601803a2b8a12e254385f767f7e
SHA512 95eaa01bc1a2e460b0214a4a48369f37b222bf53e085bb61210a0f6e3ccc4421b5ec242c42f8a8098383d4db3086bbcdb25ce0d03ede13027668e705420b97f0
TLSH
T168D0802165753FDDD12F5035041585844E44CA3356001115571F1D2D16944D62D61DD4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

182c7dd3-abc8-4df4-bb43-fa29f85dd022.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\182c7dd3-abc8-4df4-bb43-fa29f85dd022.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b155888-f1f8-4de1-9abc-b216b08e899e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b155888-f1f8-4de1-9abc-b216b08e899e.tmp
Size 9KB
SHA256 a5e72b3730bae33cf3513e61ce7856af861a3fe2f36686cb31f266a6096ea918
MD5 121afc933e5dbce21a8b2d2472e8d575
SHA1 8fb0bc59e700138d10923a6f596565981c4e0150
SHA512 576b0d4284378feec3dbc81744342d5167aa8c9722f8b6c699d30543f72881d104d9cacaccf364ccf1d7ffbc50ad6b4a935283cab3e3c7ba54c7e25faf986cd0
SSDEEP 192:sxZsRSWib/fbsbhlrIdpPZHW6+WNGYgd/KaIgrJ:sxZszib/fbsbn0xHbGr9
TLSH
T1C512B7526E28B97B8CCBD60DBB15BF13E6F95032A1911E58EAFC961C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f99c060-63e8-454d-b78e-c2dc925f2619.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f99c060-63e8-454d-b78e-c2dc925f2619.tmp
Size 9KB
SHA256 0a81cee27c3e2fa8a7f7b169a26519726da78f2f219e5cb1f03750946bb60098
MD5 1ccf0a0e51f328cc5979cc822568893e
SHA1 7e2e9125c002a8f5aa10059e03b8c7fdaa556169
SHA512 ca7c11daf1ac39d4d30767984c03e144156551d4323da128d768624f57ce14992ac5b6f52fee1bc0b3420e0b0d7a09a099e9e54bacc684874de874f4c5ce7da9
SSDEEP 192:sxZsRSWib/fbsrhlrIdpPZHW6+WNGYgd/KaIg55J:sxZszib/fbsrn0xHbGrN
TLSH
T1B522B7526E38A97B8CCBD60DBB15BF53D6F95032A1911E88EAFC961C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fb7e991-eea2-4cb0-9c08-0c666d39f41b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4fb7e991-eea2-4cb0-9c08-0c666d39f41b.tmp
Size 10KB
SHA256 def798219814468c8ede1c0a46e3fa76c8e469dfe73c9d9174d2c8d3aea5ba94
MD5 4016354ed31dfd0dd02be0c6c8ac6df6
SHA1 d512468c476b44464d04cf1b1cd94779c6d32d04
SHA512 a88ffef74577003c3c17f48a13235a435ea9968cdee76f322d538ec4942c02d5011489b2456681251e44444532cb4b9892ef662656b6c738c20708747800b9b6
SSDEEP 192:sxZsRuWib/fbsrhNWpVsrIdpPoHW6+WNGYYEJiwIgbjJ:sxZsXib/fbsr3Wvs0gHbG+p
TLSH
T1DD32B8117E28A97B8CDAD61DBB55BF13E6F9503261911E48AAFCCA1C05E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58b49830-c834-49cc-b8f0-4f80a587e312.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58b49830-c834-49cc-b8f0-4f80a587e312.tmp
Size 27KB
SHA256 7cddc486adec615c09f73a39b2d337935e913d10985a11017474fabfabd69d38
MD5 d64709f566c73d7b68e52a07f3a626df
SHA1 201c6b29b882c33fa55446f0e54bd709f4d039b0
SHA512 f222132c6f9cd019f57d7e6df2bbda1075cbe8db4af4453f724eb59682fbaa8f95fea8c7a97f31180ca80f8f244bc93e9fea091d609221fb0f77cfb34a8af30a
SSDEEP 768:YdichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzjrobVc:YdichfPWvPZplu1jan+LKgzQBc
TLSH
T1BEC2E93B640CCB7E4FC01A5DDD5A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8e060b96f1d7e221ffb6c1269f60f8990bc3fb38addc2d38ca69f04feee90a2b
MD5 78104f98661d71bbc77fe690de6ae03c
SHA1 b40452c500006517a578b9ef78986bc9152478f6
SHA512 3335ae20e32cfe2bf733d04aef5aadf18f766ca6dd05b78922ef1ae3974d05c52a37b9f5817d1a397a81d905f95f57a09a6fe1cedf4481f807773b8bfe1546d1
TLSH
T1B4617479AA70E2B9FFA84479D5DA14CF39325D95B447BEC30EB4E87ACCB630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a01cc5e537b56069b71a00c94833c004354f7bed0f147e7800106f6b8242fe3b
MD5 fcb40b01aab4aea5720a0c2d207062d7
SHA1 89d87ce41c4396a18e706214a47b35e2a6e2fab9
SHA512 223b93eab4653dcc1fcd2efbf01a3c52bf1f1681d397d69d9211415c9e6e5e29c55c7ae262893258bca1dd27a2e44a0c438d01990c4aca800567a85cf8944d61
TLSH
T168618479AA60E2B8FFA84479D5DA54CF39325D95B447BED30EB4E87ACC7630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 ca79df83da8db0fe110b69afca2ace021b5adfcf9b9e8193e6257fccf8286c70
MD5 9a0fd6d582c5e168270f2305ecd31649
SHA1 64caf1be21c98d9e4b4f1d60d7a1a87534bd4037
SHA512 0c7d2b8eacb7de4ce57ed2b08b7c6536aabc0d9d843f87f01b76c605c9dc8f70547bb8208b7d4328a4602ca0893fce262c04045035ce312fa8384d8ee5c8dbe0
SSDEEP 3:MsEllllkEthXllkl2zEkln:/M/xT02znn
TLSH
T14C44040C7FC10405D50011705071D3D04370D41505117753345105335CC55400C00044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1afb9cb7-9bf8-46cb-b7f9-cb731eb3c3cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1afb9cb7-9bf8-46cb-b7f9-cb731eb3c3cb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

688a85a0-98b0-4f46-add9-9baa2938a5b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\688a85a0-98b0-4f46-add9-9baa2938a5b2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8c40d5f3-16d4-49da-92b6-c2ae4a6e36e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c40d5f3-16d4-49da-92b6-c2ae4a6e36e5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ce64cee1-9795-4fe3-8979-79b50ae09f0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ce64cee1-9795-4fe3-8979-79b50ae09f0d.tmp
Size 1KB
SHA256 272469c609f381bef3c790768e0e2e459f0d3f05e43f37f3f00982849cf15e24
MD5 c8bb7f47104d68c306d5e2f9d79eb906
SHA1 efad7f87448a82ef006885f8454019cf84eaa87c
SHA512 0bf7d5163c58245add579336d7284bb528679638d2251c3a8b4c23cc9e2f94bc2b9525ecb9e4f218a3d3075d71842902d6c60b3c12b122adc8b4253a56163f40
TLSH
T1BE118BB787E585AEC90167F0AA24AE2BDE1D0905832C7D29C5D4AF2BD3E3475E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 636ad7b5a782a4cac823ccc7eadd64592118237a26ac41a0f54a7602cdb2a092
MD5 8b7c1d5f94ff4edfc25560db8da1d63e
SHA1 d04478efe457d98ffd687ac146a602b63bfde501
SHA512 679fcfd450f83481d14bbe65abe2a309bf87bf43f8c2efd25a624a5aba5747cba08a55b0e306f4a887c77d658289096ba4867423d7d25929eddca6159a40bde8
SSDEEP 96:K3idmC3TeK8ouayDsYy8cxt4dsbAxKT4bSx36ilAcSW/uKgA9:WidmCiVayDsYy8c34dsAe4bSV6ilAcSy
TLSH
T13D916180367B5204387D36495068E66B129334B7309CB9FF7BA891E20EAFE000DFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 3ea2817fb91281a6010e48bade13c31b8c1e5c4eef67bb5eeeee98b2d717749a
MD5 75981b783a9dfae44decc876b21bb39e
SHA1 d72cd6b9b6b1614086d2157641ed8f6394e64bd5
SHA512 73584035232d68ea7bc565c2fa8d0eec9eb16f100ecb45a6e10101a12739cb6ef335ef1698f5802e0717166ad54b7c2eebbf1c1cf6b4fb1229b4fabfdeca97cc
TLSH
T12F2124C097BB90987E89BA41810DF40370B2297D264D68F6735DC5F54F8EC140B6FAA5
MD5 SHA1 SHA512 TLSH

Submit Download

b0eaef46-edb9-404e-8d6f-b83d06b5f937.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0eaef46-edb9-404e-8d6f-b83d06b5f937.tmp
Size 18KB
SHA256 3ba4766bc1f7f9a2c7acfeef9200ccbce46b4fc21b4d61e3f736aea3b113f1cd
MD5 1a24f62f8b777601f9e153643eb24bfd
SHA1 476b2c9bc480eb5942ab5179c49201e56c4d20b2
SHA512 2e96ea8d673307440d9428addb50e0113fdfd86df0be06eb87abef686ef40ad85b7b8c71a87845a70301e87a630a31d76699bbc53240ae484285ffc307214b5c
SSDEEP 384:YQkUSv0sNhmm52x0BGYX5E0S+YpDh0vaTZcwTIIlz:Q04MOGYu0SVpl0vaTZcwTL9
TLSH
T169826C32A8796C374DE6E651F14B2A03DEB09117EBC82F94E5DD5A2C01DE2DC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb1ac493-f12a-4237-a37e-b22b84ac75fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb1ac493-f12a-4237-a37e-b22b84ac75fb.tmp
Size 22KB
SHA256 94f2e3b1b3e440836655681e996c64412ea9f9d4cba3fe3e899b933eb09962f6
MD5 343e5d83180a7c1f8edac5756ec270b9
SHA1 d687368e6be7206d7aaad7476c8b8b0336235ca2
SHA512 c5e3b23ada0da37a98194f1998a4f21c006eb39ce00e63789c90eabca075af86759dbc235d62ba17ce356365262ad572a4eee42203f3b8151a940013cebdeb49
SSDEEP 384:KQkUSv0sNEmm5270BGYX5E0S+YpDhKfA8t/eK5oT9aU5vaTZcwTIIlz:y0xoOGYu0SVpln84T9aU5vaTZcwTL9
TLSH
T174A28DB0D8656CE749E6E5C0B14AE603AEA45137CA885F9CD1F9B63C30CF1FC271A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48a3953e-e2c7-4211-b22c-ac13eb7d0b08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\48a3953e-e2c7-4211-b22c-ac13eb7d0b08.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8be6095c982666dbe2a3688c0feb8950b3c4a3128978648e624c1722f4d032a4
MD5 e81e50521c580283d7665cccb8270c6d
SHA1 606b5bc4630af90ceb9517a5a1638600f0f0ab69
SHA512 7a7f06caa67dffbe09d4fc4997ee5d65598167b0ad590ae691ed9d681524a3423ab5629dbf10180ac2a7a3be7fb5ed10589ef4f13d58fb52dfe2db2dfcf1fecf
TLSH
T187412A58A6F92148B3B76F1AABF6A86E487FBD372E06C45D00110E4F0A62B00DD71737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads