hxxps://uyq23nsurdkno6aurk7l65y4pm0wqpsa[.]lambda-url[.]us-east-2[.]on[.]aws/?hint=AUW4xwYnI2aO76JgV_l-HrTwQ0F11NlUmr9cGRl5ytBe8BLzR1HiHlZOYfVCXj2QDKjCU4afLg&to=esty

Analysis

user interaction
yes
max time kernel
24s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uyq23nsurdkno6aurk7l65y4pm0wqpsa.lambda-url.us-east-2.on.aws/?hint=AUW4xwYnI2aO76JgV_l-HrTwQ0F11NlUmr9cGRl5ytBe8BLzR1HiHlZOYfVCXj2QDKjCU4afLg&to=esty
Sample261104-xgsfrstyas

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
100	4996	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{5B046EFB-09E1-4C8F-BF55-C28432512C87}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 2936	3840	msedge.exe	86
PID 3840 wrote to memory of 4996	3840	msedge.exe	87
PID 3840 wrote to memory of 6116	3840	msedge.exe	88
PID 3840 wrote to memory of 6116	3840	msedge.exe	88
PID 3840 wrote to memory of 6116	3840	msedge.exe	88
PID 3840 wrote to memory of 4016	3840	msedge.exe	89
PID 3840 wrote to memory of 4016	3840	msedge.exe	89
PID 3840 wrote to memory of 2944	3840	msedge.exe	90
PID 3840 wrote to memory of 2944	3840	msedge.exe	90
PID 3840 wrote to memory of 2944	3840	msedge.exe	90
PID 3840 wrote to memory of 5756	3840	msedge.exe	91
PID 3840 wrote to memory of 5756	3840	msedge.exe	91
PID 3840 wrote to memory of 5756	3840	msedge.exe	91
PID 3840 wrote to memory of 5152	3840	msedge.exe	95
PID 3840 wrote to memory of 5152	3840	msedge.exe	95
PID 3840 wrote to memory of 5236	3840	msedge.exe	96
PID 3840 wrote to memory of 5236	3840	msedge.exe	96
PID 3840 wrote to memory of 4184	3840	msedge.exe	100
PID 3840 wrote to memory of 2808	3840	msedge.exe	107
PID 3840 wrote to memory of 2808	3840	msedge.exe	107
PID 3840 wrote to memory of 2808	3840	msedge.exe	107
PID 3840 wrote to memory of 1704	3840	msedge.exe	108
PID 3840 wrote to memory of 1704	3840	msedge.exe	108
PID 3840 wrote to memory of 1704	3840	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uyq23nsurdkno6aurk7l65y4pm0wqpsa.lambda-url.us-east-2.on.aws/?hint=AUW4xwYnI2aO76JgV_l-HrTwQ0F11NlUmr9cGRl5ytBe8BLzR1HiHlZOYfVCXj2QDKjCU4afLg&to=esty
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcf701c188,0x7ffcf701c194,0x7ffcf701c1a0
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,8385766305717473567,10869646352393979034,524288 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,18359221526207944132,15789175419194572369,262144 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,8585613376323647080,5373539348933120101,524288 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,6871836316726102486,11964051717827818196,2097152 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,16498283627700952963,5334182050640138031,2097152 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9469244036760653270,940675377033401165,524288 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15610202473255076909,15037144914796250983,524288 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9353302149575631460,14242448617014880102,524288 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9353302149575631460,14242448617014880102,524288 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6104,i,14824264216086950508,18335200483915963013,2097152 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4872,i,2993618025053070642,16178228874806859934,2097152 --field-trial-handle=2236,i,6233370147604274840,17479660700818611695,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

184737b9-d3e3-4e4d-ae8c-4fb82c80a563.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\184737b9-d3e3-4e4d-ae8c-4fb82c80a563.tmp
Size 25KB
SHA256 40c3a6cb12050446a03417cad03a5c2d1d730a76bbb2eb0c58c7265ac0ce9116
MD5 38fdd522ec7dfd23f51e412a227c5d07
SHA1 8c2b772db9e0d802f4f301419597fae99680f839
SHA512 dff69b2cb7b50df1d245d4cab945c61761e6eaf6f4b92b604016e4e0ddce57e24ce7721c2d66ef3a80e6607878bb1ce88c75de8ddaf88aff4d1c8c6707aee88e
SSDEEP 384:nUiFiZcI63sNZ8TUNTUlIm25mg54n4zf8B7w8Esa+VY/ZgL/7IzWcoO:vFQ63MwgS/JBkvhga5
TLSH
T137C24A36DC98D9BBEDEB8FD6A74A7A03DEF01163859C59C4DAD85D0D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

217345f5-5a52-43b4-a37a-acbea6e1d498.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\217345f5-5a52-43b4-a37a-acbea6e1d498.tmp
Size 12KB
SHA256 87ac1d3c7ec67858bc7d587d3c15f513ef6f49dbc4e7e1a3c35d9d64126c994e
MD5 d9db86068d2f2f721f38ac4012e26c47
SHA1 1018f7c61eb5268686cf01f52567459a702e0108
SHA512 20cf80a846cde69e855c0a3d38c09ac9574aa3c717c330b465c5e7278175464e53f51339340421dfcd4dba1bacf52cdc724f11fbb149f556a22a4c3acdb2bb06
SSDEEP 192:sxZpBREko1/fI1sXQZZ90mzodp7fHW6+WNpxaXYbIU/kVYl1Ig55pJ:sxZpBVo1/fI1sXOZ90d7Hb2XFFYzjT
TLSH
T17942D715AE78A93B9CC7D219FA55BF53D3FA1032A0941E48A6FC8A1C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34e1884c-14a0-46db-90a7-2bc6ce180431.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34e1884c-14a0-46db-90a7-2bc6ce180431.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

3abeed78-ead3-47df-856d-8fa1b6743057.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3abeed78-ead3-47df-856d-8fa1b6743057.tmp
Size 414B
SHA256 f7681350833836a59890c2f81d6106d0a3b0bd7089ab884b3ee0ad20a7dc9c1f
MD5 435f75ddaa1f15a5097e84242009c2c5
SHA1 2b6e82ab74de75a81ee6f4a919f252489a0dbfc3
SHA512 d36b7f82b1ee8473f0373813813debc1cf7b1b9b1d50dfd1e7318c0012b115b76acc65abe5ee18614ebb3240e6ca8bbbaae882eb4d7ad27182f8c119f947bde9
TLSH
T1A5E02BF5C825AC3718FD1B1950951645FA5513572A80948F773C901D8FF1A3B468786C
MD5 SHA1 SHA512 TLSH

Submit Download

72a9c775-c83d-4741-9d02-8fee93ee74e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72a9c775-c83d-4741-9d02-8fee93ee74e9.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 27KB
SHA256 48ff64a4459f76f73d362913ab44c94b0f69a5b5bdc11f4fdaef24e3aa87eab1
MD5 3a7176f93bde58101ef4445204153d2a
SHA1 ba18203400d5682df232f9d5049ca3184d94b8a9
SHA512 3366106c625cc833b0957685174fac1c100e7a3485e725d40e8de9ffe834e63777141d0fed3c4deceac2bd72052626e70d415222f89174eb569894dc80a27ef5
SSDEEP 768:cShgV7J+qH29Oq808V+Z1/37Qt/tBQNH/2yED+TwVSjhKcc:MJA808W1/9NH/NTwbcc
TLSH
T1A3D2F28BE4994673022EC7BCEAE819B086DFCBBEEC54E9554D801D3C6CED24782C4957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c53eeeef-09af-452f-a72c-df8d213f85a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c53eeeef-09af-452f-a72c-df8d213f85a6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1cd36f16-834e-4d09-8591-1012d2b98bbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1cd36f16-834e-4d09-8591-1012d2b98bbd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e0140ade-3396-42b9-8287-6af54ca2f9c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0140ade-3396-42b9-8287-6af54ca2f9c5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 77b7e14ef69d4aa047c8ff107b81b19c77691ffdaba70a1d24e3ba37d4722be3
MD5 d17cb77d34c165bfb635971543588063
SHA1 6e4f9f73a7a6741bd014504e5ca480b0891d0d67
SHA512 caab3771524476c405dcb2d91fe777ad2abe42d138ee14a9a91119374a4ce51f82cab16f9f06ac2bd68bf53d850cb3bf9464d3ac43a8daf265aab3c1a19b54ac
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXgHxd:OtfFvpopPxrB4RhfgRd
TLSH
T135B2221571BA121038FE790881B5972F064232B37258E63B7FBD54A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fb94f64f-7dcc-4886-9044-d7025f110dd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb94f64f-7dcc-4886-9044-d7025f110dd3.tmp
Size 12KB
SHA256 d2b31ed1d06725da621732d53ff24329c7093c47e58615cb922bdf92baf041ab
MD5 12c835543b945fe9c4d14aea60f2a591
SHA1 c91b272917caae25220ba3e6eee04c432c87c74d
SHA512 bd5cb5ffa25c359730385f139ae5ea6d272b663c6d87824c216bff707899056ded1bb2b00afeb3f41b62480051299fa51f922e3e71fdf6e64186a57e69ad8987
SSDEEP 192:sxZpBREko1/fI1scQZZ60mzodp7nHW6+WNpmD/YbI7/kVYl1IgjpJ:sxZpBVo1/fI1scOZ60djHbO/FAYzjT
TLSH
T18B42C815AE68A93B9CC7D21DFA55BF53E3F91033A0945E48A6FC8A1C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c05841de-79aa-4378-b356-bab45189d0af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c05841de-79aa-4378-b356-bab45189d0af.tmp
Size 26KB
SHA256 8dd91eb1a49e1f6df9f8da3df1b806fa8b9f44adf6b8711bcc0d3bfe334e163d
MD5 7ee95d36f1e6d5dc8403e24215ffd133
SHA1 69220aea87a960cbe40df674c9ff4ff4d0ef9d02
SHA512 a0cd1d9b37bb8ef336c6c3fdb3a7febd419d8074d84ab5e9880db2e0be2cac7fa8ecb56932cc47f863eed7cfa89726c1c78a6b52df14b2656d3e502737b9244e
SSDEEP 384:n1iFiZcI63sNZ8TUNTUlIm25mgIZC4zf8B7necIsa+VY/ZgL/7IzWcoO:8FQ63MwgSNkB3Ihga5
TLSH
T158C24A72E894DABBACEB8BD6E74A7A03DEF0416385DC9AC4D9D85D5D00CB19D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed81ac1c-d15d-44de-b635-45310a86fc8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed81ac1c-d15d-44de-b635-45310a86fc8c.tmp
Size 26KB
SHA256 05a40ab1282889782ca82ef0a5ef9cd7067e137517b50db4970c759da138a04c
MD5 9c3f3ae2b90ef361d0574057e38e0c12
SHA1 aa9c85ad31479f47ac6dfdd673aa0be480fe5e96
SHA512 562c8db9771ce5ef7b4af7d9ac33e0284de0eaaed426dbdf53ab688a15275787001144673a40b8e26369cf0207e3734a9e66535d0409ea6f58931a333fabed64
SSDEEP 384:nBiFzQkUSvS3sNV8TUNTUlI4w5mgrEfh4zf8B7ne2IH7vBEn1gL/7IzBhIIlo:oFdS38wg4nnBrIH75ElLC
TLSH
T1DEC24A36E898DEBBADE78A95E34A3A43EEE05153C9DC4AD0D9C94D5C00C71DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5876b473dc34f08d2bc4ebf6b56e99063903f3ea6217f3bbf36b0a091ed69684
MD5 fd93238978e846b917538d72be09f34d
SHA1 96c52d364a6ed7851bda96bf86fe1f35c89b2eab
SHA512 ed9444ff0dfe113e6b6a765aa228fc9eaf5f60f2b36e8109ecf12da4ae2db76783073ec6fe77c8d8ea0ae95facbfe4cb25e1c4495f75a5902c064b6dcf75f3c2
TLSH
T19B415B5CBAE91144F3B76F16ABF6A86E487B79372E06945D10000D4F0A22B00D8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads