hxxps://www[.]paperlessemployee[.]com/NYLAGENTS

Analysis

user interaction
yes
max time kernel
59s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.paperlessemployee.com/NYLAGENTS
Sample260706-3fwppadt21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278540851314948"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{680EEC49-02B8-49FF-8020-AAAA6773262F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4488	2400	msedge.exe	84
PID 2400 wrote to memory of 4220	2400	msedge.exe	85
PID 2400 wrote to memory of 4828	2400	msedge.exe	86
PID 2400 wrote to memory of 4828	2400	msedge.exe	86
PID 2400 wrote to memory of 4828	2400	msedge.exe	86
PID 2400 wrote to memory of 4548	2400	msedge.exe	87
PID 2400 wrote to memory of 4548	2400	msedge.exe	87
PID 2400 wrote to memory of 3012	2400	msedge.exe	89
PID 2400 wrote to memory of 3012	2400	msedge.exe	89
PID 2400 wrote to memory of 3012	2400	msedge.exe	89
PID 2400 wrote to memory of 4272	2400	msedge.exe	90
PID 2400 wrote to memory of 4272	2400	msedge.exe	90
PID 2400 wrote to memory of 4272	2400	msedge.exe	90
PID 2400 wrote to memory of 4668	2400	msedge.exe	91
PID 2400 wrote to memory of 4668	2400	msedge.exe	91
PID 2400 wrote to memory of 4668	2400	msedge.exe	91
PID 2400 wrote to memory of 1060	2400	msedge.exe	92
PID 2400 wrote to memory of 1060	2400	msedge.exe	92
PID 2400 wrote to memory of 1060	2400	msedge.exe	92
PID 2400 wrote to memory of 1496	2400	msedge.exe	98
PID 2400 wrote to memory of 4764	2400	msedge.exe	99
PID 2400 wrote to memory of 1496	2400	msedge.exe	98
PID 2400 wrote to memory of 4764	2400	msedge.exe	99
PID 2400 wrote to memory of 2552	2400	msedge.exe	101
PID 2400 wrote to memory of 3152	2400	msedge.exe	115
PID 2400 wrote to memory of 2940	2400	msedge.exe	116
PID 2400 wrote to memory of 1620	2400	msedge.exe	117
PID 2400 wrote to memory of 4876	2400	msedge.exe	124
PID 2400 wrote to memory of 4876	2400	msedge.exe	124
PID 2400 wrote to memory of 4876	2400	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.paperlessemployee.com/NYLAGENTS
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9744ac188,0x7ff9744ac194,0x7ff9744ac1a0
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,12130293757576171484,6188749510821112637,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,6965638825175354910,11167678334792445394,262144 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,4715813481431977671,424153782732879689,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7725927813340393132,1807041572982257289,2097152 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2287774496591820306,17216453478390753851,2097152 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,1143786781106041283,4308627002042017840,2097152 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,18363035093514811040,18052963979318989987,2097152 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,14719815917318193139,9657985116784133307,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13833592279405343217,3333947026645322437,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4722240800236466585,18056278980149497952,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4722240800236466585,18056278980149497952,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,12120181268310691125,11763129052719530427,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13856863283114765452,12992161688953658132,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,12910254252236848363,1859372712518067585,524288 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2140,i,3156910352561115346,9221358611956367985,2097152 --field-trial-handle=2236,i,2177902560397001452,6983815499543588331,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 18KB
SHA256 2342b14fe72a5d40bd1c4ef7ff6b46e820d9361f866f5ec881baa380d58260b5
MD5 211c81589ba877a7a2b1c0955012f47b
SHA1 83831ca45f1edaa0e07d63080f4388022991bc51
SHA512 db4001fa15753e6349bdbf8ca4dce2a6377a4bbc9b119dad7d09fe6998cae72efe78c49645cb7c0c44c83a937b82b224115bf6089fe404001a06cc508b67b0c3
SSDEEP 384:L05hs+YhR7pXAUqP3H1ft4TMTCdMPOMxmDq3kKKDTXNakaxJiGEdposp:LYhs+YhR7VAj1tG4tKq0KKvN+jA7oq
TLSH
T12D82E10651ACBB3182F44955AAD91577E0078E6AFCEEAF84AC3ECD1027CA4D8B5094DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 31KB
SHA256 dd4f5ab9a3e930fe3aed46bff3ba7127d082e94550fa73b0427d564f4a48861e
MD5 2faf6507a8e850bd0184174436c07e6e
SHA1 6f122db25bc69a903c2b7f0df23d390991642e70
SHA512 b55818995419dc594f9a14f0d3ec451a27d3747752487219d85a27a811d3b94a79d3b94d66cafbd52f12d0536867185949ba9cd82809ca9c07e0906d9b1445ef
SSDEEP 768:0RrUQ2IJiPYBL/VUzqJR/Stb1ESvfOKiudif:iZPJRRUWJ94EENVMf
TLSH
T175E2F195A1200369730162E13ED2CE695A51083C1A1DFBEBEFA92DFBB0F8556CD47B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 67KB
SHA256 09046da77da97a90eba59cdfead07866f4fde47428f1373d9f449740adcdba54
MD5 7af94796d41736353a07de1ee19f5644
SHA1 c0ba4c706462fce835c2c3f1d4ae0a34a7526054
SHA512 4fc902ae46fd1f3e2b550b8400143715467988b6cbff9a23fcdf4d2f2078a4c33857840945237b8a71104007d1927af14c607365040fc8bd924a0024fe108865
SSDEEP 1536:EMuBdF2dZZKAoHFJ8JVHv5mbNFVbaqk2HIeqV+vdyXBiQTTR:EMw7oZuMjIBF7F3qVBiQTd
TLSH
T1576302BB3649C9491A61F6143CE628F85B33D5EDE9B0CD35DE073D81F3288424A265E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6f4b8f72dde1dbd1b9c486c4a2cac810320a0571d68668bcda689049e34493e
MD5 8550d0f5ae33ca9fb68fef9275f8c04a
SHA1 ff63aa6ac7426c1efae2c4200c958d1d28102aaf
SHA512 11bf929cba4ace6169861f13adfcaabb1d3e2f6813884325fa741c2c8d1423386aaa2eda44d8f97d04bb4bdf50cc2e6f83886235c7cc839e959cc5150f62d446
TLSH
T13771F93A01CD364EEB503E33DCD3240078B199DCFA3B5EEA696C597D3A02B5549E4E50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f97e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f97e.TMP
Size 3KB
SHA256 a1c836257146bd60b08cd6027170c050a4766aa2c2682b188933bcea6b63dd43
MD5 30ea8fe2f92cc6001173961c7f63784a
SHA1 7e64de1014a07d13e6c13466d1172118999380bf
SHA512 a8be91d4aa686c756485916d0abf3649318933a1b412eb106da9b071b6b66bc3645d031be9fb87e7899cd2714293a42650b0c513bb0d841e05ca3107ab89431c
TLSH
T1E3610B3912CD355DEB603D73ECC31100787195D8FA33AEF966AC587D7A01B5546D8D50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 26329841cce5294f438b75625c6f32fa24bf0a823f939467c28fca4b5293a1f2
MD5 e23fa398aa63b8197901a811ad177866
SHA1 5da787aa708aec83675f328fbd50bffdf4dd33fe
SHA512 6fafe312936539c0dc33c5877d206767838d65bca2e82846984f23d41e230a56b757b2a4f6551af3093582361ca22922f7699123177807573953eb7948c0f424
SSDEEP 192:sxZ7RAyM/jK1Ml8Mk4/fSs5dTwKgaIdpHGHW6+WNNG1xY9IRvFAIg5+J:sxZ7+M4/fSs3ZSmHb6xQY
TLSH
T11652D616AA349977CCDBD209BA45BB53D6F50462D3951E44AAFCCB0C01E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fcaf604a2dc908cef8d4341f6b9f1a2b073976919356712fd7e1ee419d345da9
MD5 bddab188fb937849ca4042a85beaebc1
SHA1 6ba8f8e3502eb613bdd9ce956d9fb43f2c7a630a
SHA512 31b06852f6234e80c821fc25856ec49bc0d508f3a7c9b7c2c2aa749376fefef69736204128a98dce4c7a7be27f642e71ee75b34347046376beebaa6ed4f4dc62
SSDEEP 192:sxZxRAyM/jK1Ml8Mk4/fSsQdTwxTaIdpHYHW6+WNNZ2/Y9IlpFAIgrJ:sxZxmM4/fSsuK/4Hby/+9
TLSH
T12E52E616AA349977CCCBD209FA45BB53D6F50472D2901E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d2fbaecbd38cdfddc59f06b02a41f3acc44bbe92c153534e3ad34b31de126b9f
MD5 5e4c0218d36842694871814bb540b210
SHA1 e86861236097d7c6a1eb81b79c0adeeace7642bf
SHA512 6594a0aa209692b7e1800f23cd6b4fbeab04de46073834db7f42588f97a1f4444ca95884bc24e7d054767c79f6898a1c401792a3dea10517928a19627643098d
SSDEEP 192:sxZxRAyM/jK1Ml8Mk4/fSs5dTwxTaIdpHYHW6+WNNk7XY9IEvFAIg5MJ:sxZx+M4/fSs3K/4HbyXlK
TLSH
T1FB52F716AA349977CCDBD209FA45BB53D6F50472D2941E44AAFCCA0C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3745c86ffe44ccbb8f8bab10d7affcbd6d0fe0bc9dbbdcaf32c24176ec983c51
MD5 1fcec8e963545cad84eb88d62e69ec85
SHA1 0b69a3872be8717b9156afb90279b9eb533df3d6
SHA512 3e7ecff286fc92a65bfe5746a374d1978981c3575a7bd020bbca12c12a1790e7915c0000e96aed412e9f11b952f4fa2edceb4e5ca692ef63d4c5ee99b76330bf
SSDEEP 768:q3cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNJroMg6K:q3cv21wWvu+Z+u1jaeFLeRNiMa
TLSH
T111D21B2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 562c91206da108c08bf79b54a404e324e42d71fee09d1cbb31a18f3c274602cf
MD5 cb88734485bfda5189a32036be4714ce
SHA1 ee3153531a4ab4c6d7f6d0d46c2d95775deb6ed9
SHA512 d330afde01f440c15ff9cb5c156f86a54dca30075cb9d08c73591872332ded33f82433a943bc726023447c9cdd2ef3e3cac72dccdf949330f36fd506923ced1a
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDyeAKTi2+IQZC2QSyhjWD8B+hKZIBQh1YAF:mTnDyBXU8dIsGf
TLSH
T1D8D16402313B02423CBE3908A2A6CA778E4231677814E97F7FB911A25E67E115EFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 274f3763e0d7e81726fddf0a8d9702eade16fcd3826ad93f2d88e6732d603ea9
MD5 5feb4d84a480ff13ef783ee35987e4c4
SHA1 df786ff537983e64a6bb3fb35634cc2eb26b0dfd
SHA512 1b5468718eb7a6ddc55ead749675a8f699f6912ee624a770b8204f5d6b87a8ad899000e020659ad66b9231f9afd587914044e04e79134c56539d56ec1d09b589
SSDEEP 192:JONX6v+YLNQmiUy88Zh+CGEOcs+tVusp0uU6:JONX6vz/6Zh+C9O3+zrU6
TLSH
T14F02E835BD281C7B9FE26E45F58B3A275FA8203BE9912F90D9E81F0C01D764C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9879639bc26606c73c10cc8f7d0359c899e30cbb1231ce8ea17f6a14ec1345f
MD5 8d880202ed19dcb57291e84f09f03457
SHA1 87e73c21b0119cb14f08d730c8c28ba262191549
SHA512 936cfc55404cdcdacf99ddf2fad67d8fc6c1a01ed91cf2457708c850067a337e39191c990bb3c205fe4cd0bed0588be08af2653d205e5b361c1600949697803e
SSDEEP 192:pONZ6v+YLXQmiUyQG8uh+CGEOcs+t1sFS+2KhnCH0qVU6:pONZ6vzNduh+C9O3+roS+2KqbU6
TLSH
T179121B36BD285C275EE2A554F58735239EA95137EA8A3FD0D4DC2F0C02DF69C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fbae04d00e180fb7111c04e3397a4e28f3f54301582ddd0fe23cdcf48146accb
MD5 4344e1cec352665d46c5724cafa452ae
SHA1 c57b20ae18098d882a142abf5f78610f3f8a6549
SHA512 d3b479ddee4661fe741ae0b26299553b815c51ae8574c2989976c1335414f3afa2cc2592012238d95e25ed1db9d4cd6818fd82593904441362ce8504d7d7511b
SSDEEP 384:NtNn/s3n9SfsNofNUziQI7ue+C9O3+roS+2KnbOObjI9G6w79UQ:Nj+9U+ulFO3CLlKnb29MD
TLSH
T123928D36AC284D378AE2A665F54B39279FF8517BD2863EC0D0DCAF0D02DBA9C5306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f74fa6478138ce0ffff2b51fe1eed2eaf3d83dd06b556899ed8615c60925d37d
MD5 2cde19a8ca3ad896a32389647ad2e6dd
SHA1 6bab5b58e75950c1c990d29d55559ff07b64b9e1
SHA512 699368cdcd397544e263e899f3730aa6cfb78b8468853ebd4a5a1457c0adebd1ba55a5fb2310c0bcffe3e89274da5ff06f862879c9b7954eecb3d96afc5c522f
SSDEEP 384:KtNn/s3n9SfsNoiNUziQI7ue+C9O3+roS+2KnbOObjI9G6w79UQ:Kj+9UXulFO3CLlKnb29MD
TLSH
T1BB928D36AC284C778AE2A665F54B39279FF85177D2863EC0D0DCAF0D02DBA9C5306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 10ad5289728989476a3bf3ed019e53ecb8dae2a90bf87557e4053feb90467e6c
MD5 76489b434d21e2f20b1bb24b0f2c52f2
SHA1 610063ec2087e5736ddffb6ddec922943d5cc9cf
SHA512 60e2dee49539203153095d515f43890b6700f1755d3c4332303bdb3fb947a95585a5d691f9ccc92933123c85c18f3a1d863a3c1735f78ac691764ec17d5fd0dd
TLSH
T1BD410B59B6EE1148B3B76F1AABF6A45E487BBC772F06D45E10010E4F0A62B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads