hxxps://therapy[.]com/tennessee/

Analysis

user interaction
yes
max time kernel
21s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://therapy.com/tennessee/
Sample260723-rmse3abd64

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	20	https://therapy.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1fb517b38d20c3c	7

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292899503968438"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{BF71B92C-F789-4CE4-8985-A48184E1AD1A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 4028	2640	msedge.exe	84
PID 2640 wrote to memory of 2680	2640	msedge.exe	85
PID 2640 wrote to memory of 2100	2640	msedge.exe	86
PID 2640 wrote to memory of 2100	2640	msedge.exe	86
PID 2640 wrote to memory of 3716	2640	msedge.exe	87
PID 2640 wrote to memory of 3716	2640	msedge.exe	87
PID 2640 wrote to memory of 3716	2640	msedge.exe	87
PID 2640 wrote to memory of 4108	2640	msedge.exe	88
PID 2640 wrote to memory of 2832	2640	msedge.exe	89
PID 2640 wrote to memory of 4108	2640	msedge.exe	88
PID 2640 wrote to memory of 4108	2640	msedge.exe	88
PID 2640 wrote to memory of 2832	2640	msedge.exe	89
PID 2640 wrote to memory of 2832	2640	msedge.exe	89
PID 2640 wrote to memory of 2512	2640	msedge.exe	90
PID 2640 wrote to memory of 2512	2640	msedge.exe	90
PID 2640 wrote to memory of 2512	2640	msedge.exe	90
PID 2640 wrote to memory of 656	2640	msedge.exe	91
PID 2640 wrote to memory of 656	2640	msedge.exe	91
PID 2640 wrote to memory of 656	2640	msedge.exe	91
PID 2640 wrote to memory of 1780	2640	msedge.exe	95
PID 2640 wrote to memory of 1780	2640	msedge.exe	95
PID 2640 wrote to memory of 1780	2640	msedge.exe	95
PID 2640 wrote to memory of 700	2640	msedge.exe	97
PID 2640 wrote to memory of 700	2640	msedge.exe	97
PID 2640 wrote to memory of 700	2640	msedge.exe	97
PID 2640 wrote to memory of 1720	2640	msedge.exe	98
PID 2640 wrote to memory of 1720	2640	msedge.exe	98
PID 2640 wrote to memory of 1720	2640	msedge.exe	98
PID 2640 wrote to memory of 2316	2640	msedge.exe	100
PID 2640 wrote to memory of 2316	2640	msedge.exe	100
PID 2640 wrote to memory of 5000	2640	msedge.exe	101
PID 2640 wrote to memory of 5000	2640	msedge.exe	101
PID 2640 wrote to memory of 4468	2640	msedge.exe	103
PID 2640 wrote to memory of 3784	2640	msedge.exe	104
PID 2640 wrote to memory of 3784	2640	msedge.exe	104
PID 2640 wrote to memory of 3784	2640	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://therapy.com/tennessee/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbcfb4c188,0x7ffbcfb4c194,0x7ffbcfb4c1a0
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,177580640969717824,7771645136634561250,524288 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,15258227549055882375,10839082862603211822,524288 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,13860082336099720613,2432036396861286670,262144 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,438019029235787186,13235549670763890110,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4171017227455881625,5663660237455316905,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,1289347872470527676,14703127262605588414,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,13546946306227291493,5568357121156215549,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,1697454117660999620,1661592688308722501,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5328,i,6278919503865297789,10946522175760097116,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5404,i,12288360183769736233,3088556129747542792,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15435698884419861161,6574415258818117677,524288 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,6946195719256185830,8482301804546942555,524288 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,852767903442178790,6350749589860513642,524288 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,852767903442178790,6350749589860513642,524288 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6796,i,9119916195228335983,1439254716654124037,2097152 --field-trial-handle=2556,i,1091444045461309599,4116356363174350665,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3513cf836dfde12b4a1ed36ff7df315ba0b5a4a30f8bd4243e41fe96f0769ad4
MD5 6efb43d758f1a1c6d5bdf0bce3748609
SHA1 d40bcbf15731ad9ccab9ac25c808720483711f85
SHA512 bd70a6983758c03d36bf908709f4742304f0cb18d80b81564488e0042da13f02d52588d0ca05465cbef573295048d3b44bcdc158bb2b667461b2f8754be64b18
TLSH
T150D080327F95E6D1E115317E951007416E19066617D682176524480CDC7844556D9AC7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 35cbfc2ea7c9f9020ca66b6e034024f9b889eb82cdbda3a20365e8f804c110d5
MD5 fd5507d14ddfcbcb61bc2c5f905a6f94
SHA1 22a6eadd417f746e9910f183e05abeba84647d68
SHA512 7c9b49bac9d19c6829f04aa2897f0a03aba23c2f4c3bcff7a763bbf6981ac9b92c9d67ed76d6877c5faea7bf3fa85b743a4463bdd6110652916ff4c4d71255c7
SSDEEP 48:9Wk17og59nxpwyTAvrKCatTRnt9mdeUOl3fuXgnkzcE2aO8wGe:jH9nxpwkAvrhY2gUGGXgnmcRj8wGe
TLSH
T1DE91B3D421AB69DAE7223830F0D2E742787077B50B97DF56C054687EB82A3A14FB1C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b981a53bd88659c0b6eaa3d1e923d1d761ea07740aa440fa88593f1a8faae62c
MD5 9e52b79c3b67608a91dde06bbf3c5f22
SHA1 9377d64a455771a9f5ebe475c77239a0c370a430
SHA512 5d872ec07f06ddef5cf6541fc1b726a1b38c5da56262db6ececcda07bf756bdd3adddfb13d2d77f9f1fc8188ffa8148f0ccd71494172f59897e728688ef22261
SSDEEP 96:DFfOu3PuIuAuGuyFEeueu+eubuNKz7ujuSwuuLu4IuXu2u4V1uJsuvEmubuVuuuO:DF24PDB9EeRxe4j/ex/e9IwB9V1gsTmJ
TLSH
T1EFC19FF383E44F6DE81252F15B546D6FCE6D092483283C2A89E5EF1BD7D14B1E20660E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f09e49af6cdeb8a5f27b34ea0333f5cb81f9b1218ee01dc8772de5ce26ae8416
MD5 af9e302e3d96004564c75f7e5ab012fc
SHA1 fea801b63c3f17fb0ba99f23d00e4ece309e5a49
SHA512 67cae4f0316e6737c2475a8db5a712f57ed1ade3514dfc481b47fc3eee2c9afe14cdcd56c2776f5485cb96030129ee23af22e710c15f4e18b8d8b6db04ab96a2
SSDEEP 192:sxZYRHk2/fhsR+NIdp95eHW6+WNafj/Y4LoFoIgrJ:sxZYi2/fhsR+uSHbA/59
TLSH
T14822B8566E3869774CC7D219FA29BF53E6F9003295D01E88A6FC960C05E67DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6a100df4125f180c10c1ac58d1198a032fdb041239db424f1b00bb8262301f6a
MD5 a8493f7e96f2579a5e4d2b7503c06776
SHA1 4da8f9ebb39bc2cf389b63b5e0c3b496bf40503a
SHA512 f78ee60c0d8830035f6255fe94b918c134b3b541f23c49b0fd99f42db3dcaa19d2b847ec66ac389934e23105ead4cac49c91a402534d2030d53c93019a5c1d7b
SSDEEP 192:sxZYRuk2/fhsVWpVn+v8Idp95eHW6+WNtAfj/YQRZlG6IgbAJ:sxZYD2/fhsVWvn+tSHbQ/Tg
TLSH
T10732C8566A34997B4CC7D21DFA29BF13E6F9103295D11E88A6FC8A0C05E77DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 24285c9a66e1ec5b668e1776b1f9c2f3d64cffd5003300ce2bc9fb46d8e61b37
MD5 8d604ab859353ad87b470ada9819a828
SHA1 6858fc4617ced925da53e1fa8a526d20becfa071
SHA512 105ae00edbfcaf0308f9bac1f25bb3b40f8777ee6081382211d6a11a3806c2f42e38558791a2a226eea709751e342c7ef67cd28da9f28fe585c5e6af90d22134
SSDEEP 768:pgqirTNWvx7rr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opT6roL4fUnZ:pgqirTNWvx7rru1ja5ALocTxUfUZ
TLSH
T169C2EA3F640CCB7E4FC01A9DDC5A6F963EA802CB5A548D4047FA994C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dde3e0a91cbb7e871937633c991e6b42d4174059cef42b90555efc71b3004332
MD5 80e9211058def5ff03fb30dae66aeb94
SHA1 55ea877bf95935a95c605397dc8af8a0e4ccc198
SHA512 69caa09c18d85ae2c421e10360fb880da33d96a4289e22b433d8fbeaeed620d6e128316a4f8c77909320b0066ef443aa6d39d520d55b7db1cf249852fe0388c1
SSDEEP 48:K0WoIbKxiMPyvdGxNHzvk/zQPIQVkKpBRPkFt0WwH3OInKTacvyD:K0Wo4Kxi2qCUKbCMO4KTa+g
TLSH
T12791464634BF12513C7E2509A1A2A727578276A7B25CE43B3BA800F24E27E650DFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9cbf4df18b0258cdd1454790de8e4e9c66ed7bea013df79ba3f5c1e7f3dd7f80
MD5 d1f36777597cef86d3a21407721c1584
SHA1 386f537a129ab7af64283b46f2af047286881fd4
SHA512 a6b19eb1b396d8db4e0d79211acc083cd74e560d1b32589ecaabb039cfe0b60957012a7fca254923411c5438ec32a939dd61ad4951509910efe599c4732e3c67
SSDEEP 384:nTsNWETHxEjukIKyEHUyASt6ndof9Usvor:nTjLjISTf9UsAr
TLSH
T1D77209B598A45DE748E3E5C5B546F2132E680077CA885F8CD1F9BB3C309F6F81726822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 881b3e4ae9ac75bdc273bd072ba58e31c076603514fe0a780a8af87d5e8c3131
MD5 ac2f63c3630535cd0d61e3026d5d5899
SHA1 895fe049367659618ab0775c47ff46efcea5fd3d
SHA512 61c23be48f04318af753fdc07660dad524cfce59e751c9b561ee9ffd9ad077d854c2bf00d798352a88fb87161ebac687d11aa86ce9cf96dd577cc6afb83590c5
SSDEEP 192:u6LsNWEQ6bemswQmiU1EqjB4k03lKygFaLIerqNvODr:bsNWETHxNjukIKyEHxvor
TLSH
T19A42293A68785C7B9DE3A585F54B32135EB9807BDBC82FD4D5EC6B0C05DA29C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 29d5f62edfd9c32329a4d39b1c9d5f081056c2bfc63ca9c4bbcab8852c686f63
MD5 31d599f20204c156da8fe65136f5ca4d
SHA1 63a339d800b4f3056422197b25557e7178efebee
SHA512 9a1e54597f5f04d41fab7a3d7e1be7783793b928a94ae3cb545a3d5a9f936d938916e1d9580d6f95573f86b0323e20edc91656a8ee5ec7e90d4226a9fac75fe7
SSDEEP 96:ZqONkfQsjpfmUTmDK5ih/cIPURHl8h4otop5C5DUBhPwivh50xy0SFYKcAxZYDMD:gONf6kDfQmiUycYZ903lKvQi5RxU6
TLSH
T16602E739A8786CBB8EE3AE45F48637275FA5216BEAD42F84D9E41B1C00D764C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 81771a33a009fe32c6b7b271d63401369f4da2b6caf278d77a88c8362037e008
MD5 e388140d4c9d5b2c23a0d9a398edd8df
SHA1 0e5b19fda15ec8cca0cb789d90a1fb8f6453cbb5
SHA512 7d017a9ad27471a1c8503a9efecd5fea5c7e054cb924a5cc39282bf5c5d1f31d6f34f93f057f10b4d6d459de9c49fd18942ec1d75db272ff7f887eb5b66a18cd
SSDEEP 96:hqONkuuQsjpfmUThK5ih/cIPURHl8h4otop5CwDUBMPwivh50xy0SFYKcAxZYDMj:IONf6k8QmiUyRY2903lKygFicRerqNU6
TLSH
T1C0121936A8A86C7B8DE3A545F48732175EA58137DB886FD1D5E82B1C01DF69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b64006978928564d912fa3b004652345dd8495c5cc1c3accb1d0890c46869a82
MD5 8c1a6dea233f6d0519abe62923d57223
SHA1 87bc1bc53d725c15ff3ef17bddf54793020d6966
SHA512 e5b8771c8e8dda8b631a053955eb2768306e33966eaefeac0df3de658478cd419a6056e4ff9a789180adc5902a99596eab7c78d6b8e4424af1e1238ab9b43d47
TLSH
T1D1411958BAEA1118B7B77F1A9BF2A46D487B78732F0A945D00110E4F4627A40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads