0528bfcb234bf8ec7812fd18f5995d2819f097af1ffb5a7e9c17617a088f9411

Analysis

user interaction
yes
max time kernel
898s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 51KB
Sample260729-vdbmqsbf86
SHA256 0528bfcb234bf8ec7812fd18f5995d2819f097af1ffb5a7e9c17617a088f9411
MD5 8a851677b7b831457ec7ba24c33b3cb8
SHA1 2fa4915ee8062bae9bc6d03565148f5f723a5961
SHA512 ef0086f57381e21f05199a98ab952913e8f9acb08dc6042c8feacd11d4452500d79930d90b7d58db45fc5098b4e00ad671adfb9a0e0f4795dc44b712be7d2279
SSDEEP 768:uqZRnFP0PwPjPIPsWJI24Dayn8iwrn4v1tMivJngwg53pf:uqZLMobQkWJr4ua8iwQ12AndgHf
TLSH
T13C33C67BA24A1B7704C740E136727B4E6756C28AE95BD58173FF43D80B81E82AA7370D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298175318630095"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{47348020-19E6-42F3-B676-FF77E0908FDA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{93701E6C-CFEB-4F96-9B83-D88BB683FA27}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2856	1104	msedge.exe	84
PID 1104 wrote to memory of 1648	1104	msedge.exe	85
PID 1104 wrote to memory of 4348	1104	msedge.exe	86
PID 1104 wrote to memory of 4348	1104	msedge.exe	86
PID 1104 wrote to memory of 4348	1104	msedge.exe	86
PID 1104 wrote to memory of 4912	1104	msedge.exe	88
PID 1104 wrote to memory of 4912	1104	msedge.exe	88
PID 1104 wrote to memory of 1744	1104	msedge.exe	89
PID 1104 wrote to memory of 1744	1104	msedge.exe	89
PID 1104 wrote to memory of 1744	1104	msedge.exe	89
PID 1104 wrote to memory of 3692	1104	msedge.exe	90
PID 1104 wrote to memory of 3692	1104	msedge.exe	90
PID 1104 wrote to memory of 3692	1104	msedge.exe	90
PID 1104 wrote to memory of 3016	1104	msedge.exe	91
PID 1104 wrote to memory of 2004	1104	msedge.exe	92
PID 1104 wrote to memory of 3016	1104	msedge.exe	91
PID 1104 wrote to memory of 3016	1104	msedge.exe	91
PID 1104 wrote to memory of 2004	1104	msedge.exe	92
PID 1104 wrote to memory of 2004	1104	msedge.exe	92
PID 1104 wrote to memory of 3220	1104	msedge.exe	96
PID 1104 wrote to memory of 3220	1104	msedge.exe	96
PID 1104 wrote to memory of 984	1104	msedge.exe	97
PID 1104 wrote to memory of 984	1104	msedge.exe	97
PID 1104 wrote to memory of 1868	1104	msedge.exe	99
PID 1104 wrote to memory of 2124	1104	msedge.exe	108
PID 1104 wrote to memory of 2124	1104	msedge.exe	108
PID 1104 wrote to memory of 2124	1104	msedge.exe	108
PID 1104 wrote to memory of 3276	1104	msedge.exe	111
PID 1104 wrote to memory of 3276	1104	msedge.exe	111
PID 1104 wrote to memory of 2968	1104	msedge.exe	114
PID 1104 wrote to memory of 2968	1104	msedge.exe	114
PID 1104 wrote to memory of 2968	1104	msedge.exe	114
PID 1104 wrote to memory of 2000	1104	msedge.exe	115
PID 1104 wrote to memory of 2000	1104	msedge.exe	115
PID 1104 wrote to memory of 2000	1104	msedge.exe	115
PID 1104 wrote to memory of 452	1104	msedge.exe	117
PID 1104 wrote to memory of 1608	1104	msedge.exe	118
PID 1104 wrote to memory of 1608	1104	msedge.exe	118
PID 1104 wrote to memory of 2364	1104	msedge.exe	120
PID 1104 wrote to memory of 3644	1104	msedge.exe	123
PID 1104 wrote to memory of 3016	1104	msedge.exe	124
PID 1104 wrote to memory of 5020	1104	msedge.exe	125
PID 1104 wrote to memory of 3496	1104	msedge.exe	127
PID 1104 wrote to memory of 3496	1104	msedge.exe	127
PID 1104 wrote to memory of 3496	1104	msedge.exe	127
PID 1104 wrote to memory of 2260	1104	msedge.exe	128
PID 1104 wrote to memory of 2260	1104	msedge.exe	128
PID 1104 wrote to memory of 2260	1104	msedge.exe	128
PID 1104 wrote to memory of 4512	1104	msedge.exe	129
PID 1104 wrote to memory of 4512	1104	msedge.exe	129
PID 1104 wrote to memory of 4512	1104	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7ffc2c00c188,0x7ffc2c00c194,0x7ffc2c00c1a0
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,1061571680870197774,12035203570714906444,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1789765734531634617,13731909758399439645,262144 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,14318360615313859089,4446718605439216148,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,1643294604539390412,8279589324236686523,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9783944345793769243,8556625698676224971,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,11919749404944147663,15549127522240558192,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11028566738585086739,4023136316943337210,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,15352119870676268275,420531968392528489,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4211723144591266358,10947166481929943329,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3756162505020537238,1373284615989909331,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3756162505020537238,1373284615989909331,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4524,i,1304603389052642648,3619531824059361100,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5771653022224208911,4896038896848388183,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5868,i,3969577035105204882,13883128420279521397,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4344,i,2724225490797655000,16037462659613929528,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,6597082031980164898,4575972567631413630,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  - Modifies registry class
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,4660652314491138015,4833370661198852183,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,11028822464182059028,9607277982447426759,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,11028822464182059028,9607277982447426759,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,5973027216691287473,10462232160252622937,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17965110475646717523,5662378063733482322,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,9419443259865938219,5013856515068625621,524288 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3476,i,4600644146363077473,14347323777168324850,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7084,i,11359529521892569477,12386393107063363115,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4332,i,8061122383783936624,9641036567084529465,2097152 --field-trial-handle=2172,i,14238226274028434414,10900723897098463307,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fefc70e3479a9c72635046c14d26d4a2f1c4847958a757afc9a2769eb32e5b35
MD5 6c286becffec100dd35d20c5840f4d28
SHA1 e9f9422b395879ace1a4616500d02e646d2d1e30
SHA512 10fc9eda794713fc1622d2edac895027b73319e86c5c84f16fa8218eee53b4a93665c6dc47468337dc9c735f92b85193a8c12a503dfa2801f923095699057acf
SSDEEP 96:Pp07QX8n36t1maWEOjJA96nQyHeCpiMi9WD6Nv:PGD6t1mvVGcQyHnpir9/V
TLSH
T16BA1B7E001A050C8FF30D931D1EE96693374FBBE210F6F0E48A6A1B2994B399497D47E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_zefoy.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e5e4f63ee45f3bb8ff7271fcf8359b0ad3411dc020d566aface5eedb1a084e61
MD5 0d95be899cdc64811a9f5dd915e14970
SHA1 09206735b157232d2aa8f058a81eac494ba53426
SHA512 05a76ae44a94a56c043120b5448e41a4299b0fdaab9ae673c99d7d9608e6b94d6e945b8b8734cee23a21f87dfecef91311a9f9c5bf2712b4b23040df67ceb5d3
SSDEEP 192:DHjFTJt+nH/mPvJGSWhWej8JT1J1JG2p9ZpGF2FhV56PoxolosPc/PwtPawiQvom:DHjFlt+nH/mPRhWhWejYT1J1JG23ZpGp
TLSH
T14622ADF7C3E9421DC86252F09A146E2FCD5E051883683D2ACDF4AF4B53E21B1E251B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8b1dc6e20cf9139f240e36b60fe2914dcb65fd7953d3d9fc2e6e353b81a46c27
MD5 4401be0a9a5134cc9cf2c2c0df8bef3e
SHA1 6177de352c4766a5c060e9c7e3e1dd28dc8c0a7f
SHA512 c1444cbda20861055b00d9ab4eca73ba30e5eb0e0da4ce759e4e91cdc39bc7abdb68ccda000a94f1de83da6d60f04ec6ddecf48679a5437e4c3393c1359512d8
SSDEEP 192:sxZ3/yM/jK1Ml8Mkk/fisyaV9VaEdpdMHW6+WNGYvrrijvnzIgrJ:sxZ35Mk/fisymVyHbGYUPL9
TLSH
T1D642D7166B345977CCCBD209FA51BF53D6F95463A2900E44AAFCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 59739b20aea33adb6c590f1b6cb8483ffcd35b1fb11845a22bc00c96d308f3fb
MD5 a58318f4d150db318c65df0c0adde978
SHA1 8360b1633788e638aa900358ba07b5ee24a70670
SHA512 b28b5cc786fca15dd2aae1ba36d3a02b597628b0e66befdc280415b42d1e4202b460b52edcc49d93eff5baf1d78d4c2f71a66f70e32a0842e93eb71220661c21
SSDEEP 192:sxZ3/yM/jK1Ml8MWOk/fisUKaV9Vasdpm1MHW6+WNBxG/Yvkri1vnzIg5OJ:sxZ35uOk/fisUKmH1Hby/V4PLE
TLSH
T1D652F716AA345977CCDBD209FA41BF53D6F94462D2900E44AAFCCA1C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5be3df44b769a4a0269740a349398771d726c10412723d958927b663d1184c68
MD5 e40a56b34892a6115c6853522eb1ce66
SHA1 daa16f6cc24b82d3ff7e867ca401e9db1e026fe7
SHA512 cc1998d25111f72cd99129aba2b9173316681ba252d2a7eb58e614a0c7ba04d196f0bd947dbfd3a2a2e59b70834ea489a21b19c993734d144d3fd3412758b171
SSDEEP 192:sxZcQUnR/yM/jK1Ml8Mkk/fisUK/VOVkbZ8lddpl51G0HW6+WNYwxGFyR/YvorWU:sxZCnR7Mk/fisUK9z8HdHbku/FkPLu
TLSH
T1A872C61666244977DCDBD219F901BFA3E6F95163D6904E44EAFCCA1C04E6BED230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 159f401b11bd6d351073034f4b3a5cc15e0843affd83d44a461c4233ceb6fa80
MD5 685dcf0f60267d40d6d2d50b8f950154
SHA1 be2a10f38b8a5298f52b2d751b716765728a1f25
SHA512 92fbfd74d69b6386b035b634269a49f5c7ca121063b3778a78bfd5f7f2d976fa5966896cdb2c7d61b5e089a98e343a4170987ecb9831cb7b8368cde921931d6c
SSDEEP 192:sxZcQUnS/yM/jK1Ml8Mkk/fisUK/VZVTW5VbZNddpl5OG1HW6+WNYVXxGFyIXYD4:sxZCnS7Mk/fisUK9WhfXHbdvXvkPLu
TLSH
T18972D6166A244977DCDBD219F902BF63E6F55163D6904E44EAFCCA1C04E6BED230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b454a211ef237e2d0ca1621770df63747aa52977600a12cfcc1871bab35804c2
MD5 8242cd6577e88550c0d53fae191a94c4
SHA1 e3670bc319ccda0a68414bb0f7006698b0629a93
SHA512 358c75df591c9f05adff42981b1c68f5a41c34b3ab72b0a1438acbe14da42b8383b97f62ff18c8f4f00e7cc0269e2637bbbbd87f229f0df4eefa6bd937e74c25
SSDEEP 384:sxZCnS7Ik/fisU2Wv+9RhfXHb8vX5rNLI:skSkk/fxY+9RRHbY5rNs
TLSH
T1F682D7166A24497BDCDBD219F912BF63E6F91023D6904E44DAFCDA1C04E6BED230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 88d52b5a1c6d95d5267628b38c13e6c2210b799d441ad2a3ccf16872ff4b0e49
MD5 3d9d90e8774dc9cf2fe8b529dfde0ee1
SHA1 ae7e5f88905db42ed59e564288c84a308d46183d
SHA512 050e51026ebf1f42eea4cb64b0325d401226adf16c9cb5532fdc15ec5f57ca616f603b3f15b1efd5a3fd234ae1737a6b2745e43b5b4934b38d6954159479770e
SSDEEP 768:RxseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp2roBq:RxseJ3xWvhfynu1jaVcL88pNk
TLSH
T18FD20B2B680CCB7E4F844E6CEC266F966EE801CB67984D5487EA880C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 e4f0a7a4379b0a88674867859240c88292745c641ed0270a14082ac2449956ce
MD5 91378752d93cd618d8b3978da42375e1
SHA1 7201edf4813b4e5de73a2292e646ed4bcbc62351
SHA512 d6838b6645573b408eed6069152e3cb21e5df9199a368935f587258d5fe9057c4a4fe0644ebc74390e4adbd5ad6a6bf8aa5b85ef22b37509c6e55d22f60b3a81
TLSH
T13BA0021712924009C02352B129D7565237F7C92D024663065190C044D8616664E7104D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a69b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index~RFe58a69b.TMP
Size 72B
SHA256 94b77812aa02776f1c79627c6749cce03de3434fdd48784decee16cdd20e435b
MD5 6803c97cd7a6e8c5cdc4be0e807655d7
SHA1 f25ded8657b8eeadfb02edc86ccde06689997c11
SHA512 b9fc68c64295ede3f7888229c44abc526c1a063fcb152b380458e44af4039a69bd6433d5c7c0d7191a470d8eaf13baeb5f375d1d9e5d912fc82de79f269c80ec
TLSH
T1B5A0026563D10086C05252B526D696455311FC245101120664D60956CC61840454601C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45dcec6f-aa01-4d60-b08c-c87ce78d75a5\index-dir\the-real-index
Size 72B
SHA256 91c520d6b567fde7fd66b76eb663826607cb60c547cb9ea580441470e36e5f8a
MD5 dd6d5e55b8ac0ade871a3e65780ab5bf
SHA1 bc516182a97084a51cc986cedba40f6336c9ed44
SHA512 16d50a9f1086f3d4c328170ea9927c7db56c1895743302d3c8f17bf1be7f98baf2d9fa15e3022ae91836a3887ecc441d8b78ff82d7858c3136574ebc8c7d3549
TLSH
T126A002F4056400A2C206DD706542216023089D151302472F44A405559A5A16B4F215F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b991dca2-5a29-439c-bf9c-f32fcdf1ede6\index-dir\the-real-index
Size 72B
SHA256 3544346c279eba30fb1e25daa3bd4b2a9119d8a152c3e83ff20945dd84b3d0fa
MD5 d09d806919d4e2e7866e7f9ea0970e9d
SHA1 bd1d10d66fef5ba5ff50a79fa1d3c4d7ea970c1d
SHA512 c4eed3f3858db3e66ed580fb51647e8758c7a170f938494172844b77719ee8d84198a4d6d91fb98fae0e0b30c2f0676bcc13c7025b376d468e743f3db3d3a124
TLSH
T195A002294344170CD0E5477858B202441798DDA83400624194F21895BDAC042D5335C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b2b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b991dca2-5a29-439c-bf9c-f32fcdf1ede6\index-dir\the-real-index~RFe58b2b1.TMP
Size 48B
SHA256 3c55feeb0f6a6fb1d0a6840d55214b84291dcee1240efd7ad96224943ae51a06
MD5 c2d8e58bae02616bc74cdfac83d1b1a2
SHA1 c8518ef5256ce3e7fd109a6027633acbf3e82d7d
SHA512 ff53839d9249b2623eb5bbb5109ce967953de0c0cb606974b19c449878ec8fd985178a84eca7499eaf5eed5657462979764987b2e35ec2447bf0c01702528787
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 408B
SHA256 b41a62a6d6e33461bf5e0fe356d377946110bceec37401500737fdb96979df2c
MD5 79c335d02ba3f8d3071f6c4153a53a66
SHA1 226005cf64c7aa783ea364f2b2908d06f86fefbd
SHA512 8bbb4a4d960aba57648152fa8e815bbf420702433e3dce5e6b73a6548ec2aae0f7d6f3f8db9cf6fcf925dd8b654b0c9e488f7c7cba83f80d3a8e0499fa4f9095
TLSH
T10FE07D144E812466D6248E7220B311E8B3B08CFC3361984B146C5C7E2C2B3CCA42A298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 cc80d4d25373e484699cf4300eea1cd9aed3e6d7e20402a770fd05e76e725910
MD5 d2d442e43546d92e237485e1a195c98d
SHA1 d1d292ca5dbd9d4dd870c9f31250f99b799a4a5d
SHA512 9992100238015ad6953df01b63bf0623fb859837c9f32ac8e1d6277b3ffb80e01a3105391d955085c984f0ed00b9e6332dcc56a1c2ca25ee4547dabcc2d6778e
TLSH
T1D151A84E4D4B7FB6CD6D20F328FB4886333564FF8A848B07559CA53468C32252D69519
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584fc1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe584fc1.TMP
Size 408B
SHA256 fde21b704a07b026fedca0aa82dbca31745f8a9ba9984337d117f847ae8814a5
MD5 2626722b625188b4e13b82f019d4e5b4
SHA1 d1c750b63de7c13d72b7ca7c6a095b7ad1fcbf03
SHA512 5e7b9c1dec7507cf06c8239e1e31f70e245a0c5f50f0ae8d0053194641968641af07f9dd75a5bcdb06d9c560d9378887f8b623afcea705365e04bbe8084aba29
TLSH
T18DE0EB4487C21462D9210EB720A250FAF370CC703220BC8630AE282F2C3A3C8896228D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 0094608786389cb46c09682d4b0af4dfa338aa4f2840410cfd5b3da5de8eb464
MD5 9bd9ba7b90ab16ac42cbdd1b55cfe827
SHA1 73db1cf44be72690008b93eac71ec24914cdc26e
SHA512 d529b70f75611559dfcb30e4f970b0889652eb7c3db279de36bf5f74fb4ec9ad830a6c1c0996830063fff0fbe5f3cdc98d83aec5f8d4f98804838630b28642c9
TLSH
T113F05C772EF72814BDABD3D67030C0A005097C58D852ED4F591BF5875071329349EC65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 c5cc8fc2cfcf04df2f6b2a2c9e73a4fa9fe699c30dd2a57204b9929c1ef396c4
MD5 20785bfaf869595495b10611dcc3f1a8
SHA1 9e92318b2061f29d44f3cd3e2e972bd24e8d82c8
SHA512 869d0bdb2dc07ef67eec85d155c3ddc8e50ab9f0b1a8192ee33c1680bfc1e00699bcf2ddd5019da4f169e2462c58426f8766c3a83a5d1ccab7d78789844d9b69
TLSH
T1CAF05C772EF72814BDAFC3D630318060060A7858D851EC4F595AF587507232934DEC66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7ac699eadf77c5f55ca0df028b185137ef5b048e387329c95bd7a29102f4cfe4
MD5 440aedc09ffd78678815598f9d01273f
SHA1 0f6f533fa77579e31421d6d29ec43b165fb0139c
SHA512 7e042b7805ff9c8f75f7b5d68994f27588551545a03f3d751e6a13af5d829a293ee73116587530d1b56daab3e3009170bd8da3fc9d75587458c101ac3e728511
TLSH
T1CFA00260C9669431C15043F42BB242857FA0CFB885062321D2B81057C876140C2C5100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a8af.TMP
Size 48B
SHA256 c9dac8154764c4a01161d94570c47e6d6bfb05eff212c833ae1e9076713c6240
MD5 443d0ac7f87dadecb749a9e2678404fc
SHA1 6675af19a991bfe6ca749a5d07aa0a3e968a2e9b
SHA512 f4d9d7094d2851bdc074ed01c056528390e627448b7ed1b83a9018ddd3c6e159f354676d69ebf9e7e707c6f0cb6e85a6c5dfb021aab5c666bd38b00bce7b3681
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 779c42259ea72ca5c16d9e8f3906997fb448ae750db1dbf2db96a3241edc747b
MD5 38a59245ab6f65fbeeb25f78900ed1ee
SHA1 a7c6caf184976a3c004a51f2f54a8a10d71428fa
SHA512 3c2eb4d10abc98c1163fa5247423f9b349581b7c4508b927ee4c219e8e902a3f30b5415876b8cf074aacf76332e39cd1689fc5bf9344fbd3ba68aba5addeb46e
SSDEEP 96:KYH+Kggm2lyKuUaGlyKWQx0gKNuO6sQKF+J:49ZtFV3rO
TLSH
T17EE1461A343A07122C7D298CB3A695360F4135B77054A4AFBFB820954E2FE162DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2a5fee26c556e1a57fa705490f564795e30bb8b48d1c31f4e9e728a59e5ed61b
MD5 2bbac530e32b92b0b54a9e344e24c263
SHA1 a7dd425c00b7887be7eb36cd9d596f14556e0c3c
SHA512 ef512dd643cb6e3f6e9c0332646f26b4e42669cdc34e2c1e9d6bd6591575281008766bdb3084f9856974c155ccce5377c9962269da9cf9887bc57fe82db10fa2
SSDEEP 192:uVLsNDSLQo9M7vpK4QmiU1SrB4MTlr+FdLPxuauQdf8z1jqxUMZ:EsNDSLV+7BF6uLdLxoqUMZ
TLSH
T1F0422B36AC789C6799A7A141F08A36035FF48167DBC46F94E6EDAF1C01DA3AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 acb6b2bc0426f793e0d4330e5d6ad56e6223985a1080861378c02b28919fcdd6
MD5 c5de86f9634133f8952b60c616d20fe2
SHA1 5ea28afcf3bc4e97d864152d680db7d139a709db
SHA512 6dabc817690b93823263ac219dbe739166eb83a06405fd73e1a2161af847513feba72bbcabc61b1dada08ba64e657b521bbbb611ca6a640c94c7ff5060e8dabe
SSDEEP 384:1ZcIhsNlHvTm+7BX4P2LdLxoovKSt5uSXEHmOK+Y4MkUEV:Nhk/yPaEXSk5K+Y4MkUEV
TLSH
T17DA239B1D8E55CFB5496E0C5A582F6132DB85037CACC8A0CE2F9FB39309F6B81716416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca2296b7e6f096b6ad911c10a297867ad407532e199299d8178ae83c76570a71
MD5 5839a3e37de55f83349d70a929a0a9a9
SHA1 4def003f7e45cef092ccfdf703945f72c55a3b2d
SHA512 c4b105119af9d8058d1d4a650968f57d81911974213716fc999cbc40ab48c3c7a025a9571545fd7ccb4cfc2fccbcd5f7ea0157dc0c798ad9e8a624eac7c65638
SSDEEP 192:lONQ6vMtPQmiUyy3ThTlr+FdLPxuaU847hxU/u:lONQ6UtRFT4dLxI7U/u
TLSH
T10602E735AC786C7BEA73AE46F48A37171FA4616FA6905B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d9f8c34c633cf6dfc80ebdc4ba85117d48cbf810f46777b596a9b0732dda8327
MD5 3f356794b2b1d207a6923bf7acb316c3
SHA1 c2600d463c3551062501821336f416228d7dfb25
SHA512 7effb9622b293e5194dbf24bc847b00d4ef4aa57f61d73a808e8b438a4c6693f3d6e0941aa5863c9a865cac9ff48729f5d7eed03ddb011feced917bcbc2663fa
SSDEEP 192:uVm+xasuheOwQxMGsNDSvTFo9M7vpK4OmiU1jrP8BMTlr+FdLPxuauQdf8z1jqxM:NZcIhsNDSvTm+7BXRP2LdLxoqEV
TLSH
T1E8725C329CB45C7BA9A7B142F48A3A034FF4C127D7C4AB94E5EDAF1C01DA66C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 bb16ca67448b37ef3c94bbeda56b9d978e9865813526f4050b9298a788c4d6bd
MD5 6eed6d73b9ceedfdc5c9ae8738dae164
SHA1 83a55775fd1f484c1bcbd588262050ef1757acab
SHA512 038c70b9d2bf5fd75d8cb4fd6f7cdf86fef6c019dbf6afa40f589eb10491614d66a13d27bcdff7eb6a2670989de6575a24135020a45c5908cb4b76887f20ed94
SSDEEP 192:uUm+xasuheOwQxMGsNDHvTFo9M7vpK4OmiU1wrP8BMTlr+FdLPxuauQdf8z1jqxM:AZcIhsNDHvTm+7BXcP2LdLxoqEV
TLSH
T16E725C729CB89C7B99A7B142F4863A034EF48027D7C4AB94E5ECAB1C01DA66C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 807676d5f838f880fdb2447591dfa08cd167a817148f73433cef038acd42ebda
MD5 1665344e951fdd16d93973f1e4d62a49
SHA1 834bf51f204539de13b5f7bb0cd72cfc85bfd0b9
SHA512 8a37fc7d0cd9c41f14630dc1620f852b04bdab991c78c2bcf9fd2ebfd80e5511a5ece567bafdc18338ea5df55601f7abbd9e6c1be997f0026e9e3f7c2463338b
SSDEEP 192:MONO6vMDPQmiUyn3KhTlr+FdLPxuauQd+80IjqxU/u:MONO6UDRaK4dLxDqU/u
TLSH
T162121C36AC64AC6BAD53B541F08B36071FB4826BDBC4AB50EADC6F1C01DB66C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 46ae013559ff8184911858c64365f36ee9e92823ff11d5a7e852549ad18f5e26
MD5 e19aea47e1ee007bfe795729128e42cc
SHA1 497d344e0583c2303727a739e7fc84edab782a13
SHA512 b5554f4e1a2cec94308a1ed3b42b0d976022737e2bb49811754f93523370217b516eb1c5226d36a94d286255186642cdd69312d6ee595d5ad553be7dcd6ec1b1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58724d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58724d.TMP
Size 392B
SHA256 3a2283e90758a118e78d22431478a038eaca98ca77dbc9d28bffed9cd39a491f
MD5 216b684f0514c432ac7d0e4bc4def2e9
SHA1 e97445c4903683fab360e494dd6f5025a3c687b9
SHA512 efc5f2e5d599d156cedc3a59380378f0d158baa9b9d9ca870ddbe7d183b0c7d9615c5ba48056c906c2f76615d7c6bb0da4937fe0069fde7dc73e0694ade9bcad
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8dcca1eeacc02049d1136c7ec803fe8cfad4c81664fd0aa4c51bf5cb61471910
MD5 ee2293c0ee8b57737944659058d5ce7a
SHA1 c74eef85d3ebe9d0edbd80cd4d46ba90720f81d8
SHA512 0ce0865dcb5e6c8dc841597e39478e9b1320002f9b25b5d4fca7ca99b59bcbcfc4436dc5aca0c1ff5b049e1b5bc1955abedd20c65180ebe5d0a0aa32572f10d2
SSDEEP 3:MsEllllkEthXllkl2zEklsl/:/M/xT02znsl
TLSH
T12B44040D7FC40505C71450344011C3501371D4100511574334510417DCC77400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 05ea11d7cc788d77bc37a75b7bfb5c7d4fca19d4e3a20ca534da8cd967a001d9
MD5 f54b6a50654fba77e0fa609813e706d7
SHA1 dd1b56fabaa54d6d49ca7bdbff7232d90db0bb3e
SHA512 87e89ebbb8035544f2c3e42af3c7455bc7197b307b65215ab09e728a9afa8143b5bcfca26042de9bd884601f6f846a4411dec55c5a3edb240a5b2a0ff576928f
TLSH
T126515C13308526DF38E8186999C408C3E17702FBEB467ADB84FA7C4BD2346E6485B276
MD5 SHA1 SHA512 TLSH

Submit Download

347c3bc4-d711-43be-90f6-493d2ef7386a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\347c3bc4-d711-43be-90f6-493d2ef7386a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9340067b9e327ebe1e2e92f9271478bd753945f277f4890c84857a9f1204cc2b
MD5 af45ca9316a1bf5026fe90b229525fe9
SHA1 c42d532358d5f1a4ac68c7ab9d769057a482fbf2
SHA512 a445d40282f55dcb45e16161d947b58bbdfc3594435e718eb4e1a3ec8f43f67ad68e47ccb054a3f453d73f8f1b2b88ddcec160d7e24c63cbae5810f75aadd8f9
TLSH
T15541095CB6E91158B3B77E5BABF7A86D487BB8372E07845E10110E4F0A22A45C861733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads