hxxp://realvelocity[.]xyz

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
56s
max time network
58s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://realvelocity.xyz
Sample260804-cc4m1sem3t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302822235265977"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{946E1C24-406D-4878-A3FD-56798C20D2CD}	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4824	4300	msedge.exe	79
PID 4300 wrote to memory of 2052	4300	msedge.exe	80
PID 4300 wrote to memory of 5076	4300	msedge.exe	81
PID 4300 wrote to memory of 2052	4300	msedge.exe	80
PID 4300 wrote to memory of 2052	4300	msedge.exe	80
PID 4300 wrote to memory of 5108	4300	msedge.exe	82
PID 4300 wrote to memory of 5108	4300	msedge.exe	82
PID 4300 wrote to memory of 1656	4300	msedge.exe	84
PID 4300 wrote to memory of 1656	4300	msedge.exe	84
PID 4300 wrote to memory of 1656	4300	msedge.exe	84
PID 4300 wrote to memory of 2452	4300	msedge.exe	85
PID 4300 wrote to memory of 2452	4300	msedge.exe	85
PID 4300 wrote to memory of 2452	4300	msedge.exe	85
PID 4300 wrote to memory of 776	4300	msedge.exe	87
PID 4300 wrote to memory of 776	4300	msedge.exe	87
PID 4300 wrote to memory of 776	4300	msedge.exe	87
PID 4300 wrote to memory of 1140	4300	msedge.exe	88
PID 4300 wrote to memory of 1140	4300	msedge.exe	88
PID 4300 wrote to memory of 1780	4300	msedge.exe	89
PID 4300 wrote to memory of 1780	4300	msedge.exe	89
PID 4300 wrote to memory of 2532	4300	msedge.exe	90
PID 4300 wrote to memory of 5296	4300	msedge.exe	92
PID 2532 wrote to memory of 4200	2532	msedge.exe	93
PID 4300 wrote to memory of 3528	4300	msedge.exe	96
PID 4300 wrote to memory of 3528	4300	msedge.exe	96
PID 4300 wrote to memory of 3528	4300	msedge.exe	96
PID 4300 wrote to memory of 5444	4300	msedge.exe	97
PID 4300 wrote to memory of 5444	4300	msedge.exe	97
PID 4300 wrote to memory of 5444	4300	msedge.exe	97
PID 4300 wrote to memory of 3476	4300	msedge.exe	98
PID 4300 wrote to memory of 3476	4300	msedge.exe	98
PID 4300 wrote to memory of 3476	4300	msedge.exe	98
PID 4300 wrote to memory of 6036	4300	msedge.exe	99
PID 4300 wrote to memory of 6036	4300	msedge.exe	99
PID 4300 wrote to memory of 6036	4300	msedge.exe	99
PID 4300 wrote to memory of 5556	4300	msedge.exe	100
PID 4300 wrote to memory of 5556	4300	msedge.exe	100
PID 4300 wrote to memory of 5556	4300	msedge.exe	100
PID 4300 wrote to memory of 5644	4300	msedge.exe	101
PID 4300 wrote to memory of 5644	4300	msedge.exe	101
PID 4300 wrote to memory of 5644	4300	msedge.exe	101
PID 4300 wrote to memory of 4356	4300	msedge.exe	102
PID 4300 wrote to memory of 4356	4300	msedge.exe	102
PID 4300 wrote to memory of 4356	4300	msedge.exe	102
PID 4300 wrote to memory of 4508	4300	msedge.exe	103
PID 4300 wrote to memory of 4508	4300	msedge.exe	103
PID 4300 wrote to memory of 4508	4300	msedge.exe	103
PID 4300 wrote to memory of 2536	4300	msedge.exe	104
PID 4300 wrote to memory of 2536	4300	msedge.exe	104
PID 4300 wrote to memory of 2536	4300	msedge.exe	104
PID 4300 wrote to memory of 3692	4300	msedge.exe	105
PID 4300 wrote to memory of 3692	4300	msedge.exe	105
PID 4300 wrote to memory of 3692	4300	msedge.exe	105
PID 4300 wrote to memory of 2208	4300	msedge.exe	106
PID 4300 wrote to memory of 2208	4300	msedge.exe	106
PID 4300 wrote to memory of 2208	4300	msedge.exe	106
PID 4300 wrote to memory of 5016	4300	msedge.exe	107
PID 4300 wrote to memory of 4892	4300	msedge.exe	108
PID 4300 wrote to memory of 2216	4300	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://realvelocity.xyz
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x124,0x23c,0x7ffc2f04c188,0x7ffc2f04c194,0x7ffc2f04c1a0
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,7036923026931333116,4811836239127153516,262144 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,14713556768622714273,15640035840559386558,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,18177980920213016335,3166256034575186829,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,10479481303802367002,6244930416231131235,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,15530574000427293750,1964122106792854245,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5056,i,894490935266854340,2878028737812772854,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,1239803537442454874,11744334790716306396,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,6505264950373191917,17704979644264611146,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,8198591133445138765,11560245946419709227,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,14894270396735428554,4746649251899529866,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,14894270396735428554,4746649251899529866,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6380,i,10943282850824815045,13448594853586505311,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4884,i,10192537216013359714,5342251279019171688,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4796,i,18026926819364040197,7437139553064217046,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6512,i,10627932886349056115,14245376298837028019,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7068,i,355717580918715255,6304447001606990801,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4836,i,17834763653432395892,11060675490289140056,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6604,i,11176790145329197219,12082270099871890016,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6916,i,14435439087165384982,9880667275434297459,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5912,i,13501915876801026343,3743826574482169282,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7252,i,12402288759292425434,18320065907105813353,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7416,i,424069732838179475,15268622900328236315,2097152 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,5197017246022845915,13114988839185081280,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,13850097115980804009,2372315532082306400,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,16596619931480844887,15659472127729602965,524288 --field-trial-handle=2008,i,16668101702274250629,12981528447350762266,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab2f3ff17feb139df3682bd1263b6efd6de2401153bd5b8f81e9f0935f75caf0
MD5 099fadf87cd918a9dae1c1bbeed9c252
SHA1 4717ba5d5415f81ce9a49c4e884fe64b9f240fb0
SHA512 846b8fb3c8ec1ad4f72f1844077147185e541ffeed67e72e181392623071eeb56ba0706b8453c0e0c27d4ffc38d0c5d2eb3be30f70b1410b97f884986dbb43aa
TLSH
T1BDD0C0323A293003D3055331E082C703332700711C43E201E110C00CBD784F1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0103d8de6a38f3acface347401bca16e7b02e6e54a9572257b9595c892b7d124
MD5 c4fed21cc6ab05f7381dc7813a4c48fd
SHA1 556676fa1527a15ec4dbf31976fd52474b83d8db
SHA512 65b7361c9b258519e9b91e533406330c6eff05fef6374df5d349fcddea76bbb647ff621cf53bdaccf8f600fbe5a99a060ab3d7b83863ec99fc11ab0dbff74a25
TLSH
T11BE02BBEC920EC2715FE0B2EA0550B4AEA9013671680946F3A3F550C8FB073A46C681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 23KB
SHA256 d3928e16dd8f94a97b31d23621c13ac03220f8835c9daff72631c1a1589b46a1
MD5 34b3f7eeebe06f2597752e986b602cf2
SHA1 7ddfeb07cd199ecfb6a5da6dc16c9237a34e94a0
SHA512 d9dbf15e25995ba1e29594c058afdcaf4f1c32f145b0da886cfea4f11b7f0ea6ba6bf43f04e2f8e3d0256b4b0f5097ec4e9870a5d38ef5d621085084575e9165
SSDEEP 384:+4Mm3p5ikxHT41BTNM1PK41FzxYtu4weV4ajnBnnrShVlwk2uwgePW:xMm3p5imaQPxMUeGaZShkywgePW
TLSH
T1C6B2D0138EBDE145E261C07733F3A29AD37E3148B8DA02398289D4B358993D2D8ED81D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 8053bed0232dd5afc03c2f1bc7f407ee5442643c136b8d11d6ee64baff2b6685
MD5 04c069957aca4e68f7a8f8468e203470
SHA1 8df8274107de2553959656156883e75ad8c3fb01
SHA512 a4d002803e85ad3f44cd584e7c8f809c6f590e8a19bac075b1ea364097f863a01ddb8132d2d6783d8c6a99e3bd97b0479d929763953196425ad94803becffb40
SSDEEP 48:BFx4nV4mRnTYjowoKfOd1Z6C78+nx8/kyOh4jsK5ZsW1/uGec+y0847oWjDj8rmS:BknhRTF+OveKKsOhNMIPuBJLNxjOnyWX
TLSH
T1D5B1923C01849232FBD03BFEE8C04A4530F291853BAF2EABC0E4417AE50BF9D515209B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fe02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fe02.TMP
Size 3KB
SHA256 721da167e59a1e34773b25c11aeaae4ce13c2a03a6fc96dfd16eb9a7e0ffc70f
MD5 8b799d1c2190c863a464ed77dbcb156c
SHA1 c4a7263fefe5ca6497e1de0026d3a05203c5253c
SHA512 69f1320e6a0d5344dd92daec8388a6a0decd2592af2bfa61dca04acc17feb3ed7ba974e6bda1c7fda1b4c6b11bd3d8fb65885365bfa7964d754ac6279f8a4097
TLSH
T13C71904D41954332FBE033FEF9C052557470A08A2B4F2E27C4F89A7EE819F2D605146C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f55f6d0bb85b9a970eff00f48a135f16ff85a0cac8018bc9395f86372f7d97cc
MD5 202783d11f2958bd63f98a78d83e6d8b
SHA1 22c50cf9acdfe6fad8d22abc6407f83082379de8
SHA512 03296f3c31cba14f1ab6f60799969f7aabe5bd2e1dde94eb3d645556d3e7a4e110876dce9ac0a16bf7df75baf3469b399112b1899aae30c16804e10f36b50b95
SSDEEP 192:sxZyRsQywFXNKOMl8MFX/fss8qFxE0CXU9zodpfJKa/W6+WN+Pn9/Y0dkLpDQIgb:sxZyqzdX/fss8qF60LWX/bE/5eQjv
TLSH
T1CD62F906A6349D7B9DDBD219FA44BF53D3F9053392404E58AAFC8A1C04E76ED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 03d647072d874bdead82a367da63c2d687c1bd02ad517a00d46813c4fc101764
MD5 3c4a0f5d67e7caa22b744be6b862c6db
SHA1 e868e03029befa4fde88dfae02720b05cfe78fa6
SHA512 3337bda7a57b0e9a19d0be34c544d32893c25b1f40457aaa5a8371763133cf1c829f8ecac424c07174afc51dd1107b71f3e4c332269cb8aa976829f7d1420a61
SSDEEP 192:jiLwMS8Y3wZskquB+96CBAI+NBx9hXDoRth32FYxV3LHWDqxNJ1Nf+dNa/EEfm9u:AFBHhTofhno2mBu9XGUqs
TLSH
T149C25612717A12023C7E390C97A69B374E8272A33458A56F7BBC40B64E67E615DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 800400e6c726b13c2a69ed8ec93cec23854ddfe244710c5eefe27dcc7dc8dda0
MD5 ba662cae8c5b6b42cc0985b825937bcd
SHA1 f0673183ea2aa3dd6922e0e6efe87324a7567098
SHA512 1b38ce804297494ac112f155bfb546fba3c5a25de63906ff99fc6839bccadfb1ad229fdcf0625ff38327a2fb4512a51935581b8186c3aa274ba70fd9c52fb175
SSDEEP 384:n5niFiZcIY38NLN8TUNTUlIRzyUmmjkpfb/oIALkQFOt4uXK9Li6Uq58bhP+FaHY:EFQY3QNwgg/do/kf4uwLwZBu/
TLSH
T19CD26B75E854D9B7ADFA8ED9E60A7A07DEF04153C68CAAD4E9C81D0D009B1AD430FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 854ed94eddcb5092083383fbae14a24a2ab73311063303f4db4b55d0e984d2dd
MD5 262070d422d1ebd4fef6df28b46d31be
SHA1 d0ae5728b5560633ff35677e59dbcaaa6a946326
SHA512 5699757530615c26553bbf27059d206ef2255bae7545041a5e693840178ca6b068f1d3ea653148e2da228990b013c6382715706bb56e93b3df4c4429abf87c86
SSDEEP 384:ndiFiZcIY38NtN8TUNTUlIRzyUmmjkpfb/oIALkQFOt4uXK9Li6Uq58bhP+FaHy1:UFQY3eNwgg/do/kf4uwLwZBu/
TLSH
T1EFD26B75E854D9B7ADFA8ED9E60A7A07DEF04153C68CAAD4E9CC1D0D009B1AD430FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 621cabe3d18504e09eb2c5b59da3a53d8d636052f378015d44f6c212fbe0785a
MD5 d5a2c37ff15a67543529e2856e0a18d7
SHA1 4ac27ee181f10074d9301237880e202fb5fc4ff7
SHA512 dfb22a0505e9ef578ac67a8c3b5482f879304d97cc6a2873483de2383d88b083cc985596325d27242cf7f2da67667b24239ae73a0b80822c8090ba73ea2a4ae5
SSDEEP 384:n5niF9CcmyWCW38NLN8TUNTUlIRPy/mmjkpfb/oIALkQFOtguoQOMHy/7Igsz:EFccpW3QNwgd/do/kfguMi
TLSH
T1FEC23936ECA4DDBBEDE64ED9E64E7A03DDE04153C68C9AE4D9C81D1C008B19D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 967ea96e08beae6a5cf37e54e716b4c17edde980c27e268364cd78f20235e294
MD5 f878e43231c4f2f4e065401efece4fb8
SHA1 f16b98c10034505bea26633e137352aada76a32c
SHA512 f0664510027023126cfc3c6ad7b1685d07078a958e7accd40e3652a9fa853ce712ee7ec8691664e4fcaee9653b2a7d7f957d215c9c6247dd409da15db8ab26e0
SSDEEP 384:n5CiF9CcmyWCs38NnN8TUNTUlIxBydGOHjkpfb/oIALkQFOtTuhkP+lFYS/WdHyb:3Fccps3ANwgWgdo/kfTuhkoFYS/f
TLSH
T10AC25C36EC94C9BBECE64ED9E64E7A03DDE04253C68C9AD4D9C81D5D00CB1AD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 60fcedf9ea8623ffd4177f6f2007baf71f6abbbd5df2914506f428e39f773904
MD5 9e1a82f6e3c8edcd251a843066fb824d
SHA1 3aa4090375c2708da96393a92fc5abef93797d0a
SHA512 94181209782c4c8b3cdd7d5597ebfe07afba08ee2358fb6f6ec85008152160cf142f18c607c90b386250ca0548c5a7f9386e3895813b463517b1955fe795c4af
SSDEEP 384:n5ciF9CcmyWCs38Nn38TUNTUlIxBydv6o7ajkpfb/oIALkQFwWhkP+lFYS/WdHyb:lFccps3A3wgjQ7do/kJWhkoFYS/f
TLSH
T1ACC26B35EC99C9B7EDEA4F99E74E7A07DEE00263C5889AD4DAC81D5D00CB19D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5503624199b51c4cc2141c5ab9d733748bdac588664600bcdc95dbd8fe97c80e
MD5 4534f5f019f88be381c2ff7b3010ce93
SHA1 cd782251a1a27bac5954b463d255deb61a797ef6
SHA512 f5aebbeeff694498b67a06e715e943bec3de4b8d34f33f0ffea22c4faa282d3b69296dd9e4c7fe289bee77cd739d4769fab39db919a80d00280148d4f198d343
TLSH
T13BE00242938541A7C40807354093164136E6502006B241164950026558133001C32B04
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589c99.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589c99.TMP
Size 392B
SHA256 5b1e60569b95444e9587789a3664aa0e80a2e66a69ad5e88362bee1f96ddac6b
MD5 8e29c15a078cb22e05b0c0a04fe52abe
SHA1 2a5f18076f7bc2a658f3be195175e98f09adde0e
SHA512 849c1267d19d1ba2e5d6989a7f0eedcbacb7a901e06dd178664be9b33e6156ae9799b7e62743ccd087cf150c46946e9e7d8107e473b87ef68812c88ce9ebc0f5
MD5 SHA1 SHA512

Submit Download

memory/5296-227-0x00000255640E0000-0x00000255650E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads