hxxps://supplyitnow[.]com/SV/ViewHome[.]do

Analysis

user interaction
yes
max time kernel
62s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://supplyitnow.com/SV/ViewHome.do
Sample260804-msbbhsxhrb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5096	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303138014395657"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{DC6ECF7A-4A0C-485B-A956-DB4A0DBBD434}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5772	svchost.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
332	OpenWith.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1888	4524	msedge.exe	84
PID 4524 wrote to memory of 5096	4524	msedge.exe	85
PID 4524 wrote to memory of 1516	4524	msedge.exe	86
PID 4524 wrote to memory of 1516	4524	msedge.exe	86
PID 4524 wrote to memory of 1516	4524	msedge.exe	86
PID 4524 wrote to memory of 468	4524	msedge.exe	87
PID 4524 wrote to memory of 468	4524	msedge.exe	87
PID 4524 wrote to memory of 4260	4524	msedge.exe	89
PID 4524 wrote to memory of 4260	4524	msedge.exe	89
PID 4524 wrote to memory of 4260	4524	msedge.exe	89
PID 4524 wrote to memory of 4996	4524	msedge.exe	90
PID 4524 wrote to memory of 4996	4524	msedge.exe	90
PID 4524 wrote to memory of 4996	4524	msedge.exe	90
PID 4524 wrote to memory of 4820	4524	msedge.exe	91
PID 4524 wrote to memory of 4820	4524	msedge.exe	91
PID 4524 wrote to memory of 4820	4524	msedge.exe	91
PID 4524 wrote to memory of 2340	4524	msedge.exe	92
PID 4524 wrote to memory of 2340	4524	msedge.exe	92
PID 4524 wrote to memory of 2340	4524	msedge.exe	92
PID 4524 wrote to memory of 4212	4524	msedge.exe	98
PID 4524 wrote to memory of 4212	4524	msedge.exe	98
PID 4524 wrote to memory of 1936	4524	msedge.exe	97
PID 4524 wrote to memory of 1936	4524	msedge.exe	97
PID 4524 wrote to memory of 2332	4524	msedge.exe	100
PID 4524 wrote to memory of 2808	4524	msedge.exe	104
PID 4524 wrote to memory of 4852	4524	msedge.exe	105
PID 4524 wrote to memory of 2808	4524	msedge.exe	104
PID 4524 wrote to memory of 4852	4524	msedge.exe	105
PID 4524 wrote to memory of 4852	4524	msedge.exe	105
PID 4524 wrote to memory of 3188	4524	msedge.exe	106
PID 4524 wrote to memory of 2736	4524	msedge.exe	110
PID 4524 wrote to memory of 4224	4524	msedge.exe	111
PID 4524 wrote to memory of 2416	4524	msedge.exe	112
PID 4524 wrote to memory of 3444	4524	msedge.exe	114
PID 4524 wrote to memory of 3444	4524	msedge.exe	114
PID 4524 wrote to memory of 3444	4524	msedge.exe	114
PID 4524 wrote to memory of 5368	4524	msedge.exe	116
PID 4524 wrote to memory of 5368	4524	msedge.exe	116
PID 4524 wrote to memory of 4916	4524	msedge.exe	137
PID 4524 wrote to memory of 5876	4524	msedge.exe	139
PID 4524 wrote to memory of 5876	4524	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://supplyitnow.com/SV/ViewHome.do
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaf62ec188,0x7ffaf62ec194,0x7ffaf62ec1a0
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,5228671992090263305,14963527544219166258,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,10136414978031300927,6921398420667500344,262144 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,16137156920471253801,9563881815227539232,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8683013557634747098,17679166835123105051,2097152 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,9608513457023897293,10716624028092912738,2097152 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1832579500266307343,17496266854931289143,2097152 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,16507290704322470636,15422151762904443947,2097152 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3752569521650237502,15042793991458098148,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17762751864130280924,13863571386936217525,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,7138403500318839813,4392112889223260531,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,7138403500318839813,4392112889223260531,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,18298492168602457742,9301945083137568799,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4436,i,12780755976314033688,14553029709851320571,2097152 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,1397659412118573042,2257269154293478866,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,11185314166962659376,9536386732294064366,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,14590854450924004577,4208160810284048606,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,17155485722763750472,6170708904983034297,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6208,i,17497808383875435567,14509111197250146708,2097152 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,13786826963583031218,11465397669649863255,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,13556231384790380110,3126767570064182954,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,13556231384790380110,3126767570064182954,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,17900306730354924433,8213649668966944830,524288 --field-trial-handle=2316,i,9031335352752124391,7718909812189112644,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5408" "3084" "3140" "3056" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 16KB
SHA256 5dd1c64a38698ff8aeff573794977443121235af418dd9d2c79a5314189da2aa
MD5 0831783dce7c9f7ae3d19fd7ccad5d46
SHA1 c7f7075a6292462d90154ac8caf8478be15c0f97
SHA512 59f84adfb930ab067495343b59be6767569ffc0279f05465c0a622f6e59212175ca1195e64b7c29a88d1a40bd0c56fd735c7ceec28ed9c897fdeaa11250a8820
SSDEEP 384:velXJoyRu2nLAIAboKufdRAq1+91p2ky36j3NYmG:mKyRf8xbbu1RzMzFy36hYj
TLSH
T14172D0D6272DAA9772F5F44D20AF2A9B12805733DB98843350771A366BC64FCC9607E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 60KB
SHA256 fd394cc3c5cbc059b945afc60e24a873c79e4e9f9ba018e12f0133b74a344cac
MD5 a2b0e8c0eccd89e78e88b3a5f26be72b
SHA1 2e8f79a77fd3b93f4a57adde378cb799535a2e0d
SHA512 97187f5b12ae4639f569d8931a14c913016478e3e3e559f6a1ecd201d8e9f5b8d7a836925d6aafbf28dda5a81777b91bfd6bcab7ff921a4f834c5f4368d79308
SSDEEP 1536:pGs0//BOPTNfTOT3m2axThH+N1XohWskES2cDj0AX73Fpk:DE/BCTN7Ota3sohWxjDj3rFu
TLSH
T15D530299F60C307956EC6B4B1E0DBA87CA2F3A0C3B44CF287676334966CE6B55A4540B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 72KB
SHA256 f85f421527528f92927ea93b9979c306ec54682fc95c5e76eee0ea5110f0667d
MD5 2ec5d3df896759ae7d3c27233b722826
SHA1 65b989c57886bc7a6cf7f551a66905a23eaf05dc
SHA512 dfc89a839b52791a8ed8fd4a5933add4605e3eda9ba65574c4242526fd7ed85a760c5754765626cf8969cd4007524ac32c53374d5ce1970b1d8285740a16e73d
SSDEEP 1536:aqqNyol5hICcSYsHPrtqkUB2bqjqs5p9QdwulnOwxd2cBNXVQBLarEKp6qzv9:arvIClYCrtqvgZs5kdwynOwx0Orzrzl
TLSH
T1E573122F4FBA86F8C732856287820A2ED851C85FE9C09AD453ED5CEC87706640C3B5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 58db2d23ee988edefb339c8a485cf37af9562c95bbf405ad21186062d516f431
MD5 8b52519b06e5d293ea4afdaba1ea1978
SHA1 1421f9296b6b096309581e8f1239bdaddd60820c
SHA512 93f66ed66f7457517f5a6bc421cc4d6b1175c5c4d944315d6f9cccc3fa8c9b5282cd33d4128cba5f736786c1f33a95e68aedc2907f7dea92dd43f037090d26b5
TLSH
T122715B6D224F3D6EE39AEAF3FBD2270731718196092F5EC3108068BDA02936DC971C19
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9cad1720e85323cd5bddcbd5655452d0f0bcc61a5eda9e24de9915cfa9ee2581
MD5 af7d77d1f550e7e630dc52e7808212de
SHA1 105c251c9bc7636edff04eaee2c10962b8d6ac47
SHA512 c21d3555fdaad0ef7f5690983e4dca2695bd13002045de3de9fbb6ffe9e880297931385d586e1f71167a4a226a3d5284210de329f6af13be2bfcdc5b23afe8dd
SSDEEP 192:sxZQRIke/f5spdSBIdpSiHW6+WNBkmQZ/Y4qAH2qIgrJ:sxZQ9e/f5sp0qBHb6/h9
TLSH
T19322E9526E38A97B4CCBE20DBA15BF53D6F91072A5D01E58AAFC951C08E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 163870dbaae302e10deb23acd5232053ee49332051efbe1759ba2c5ee98c0c6e
MD5 619312f6b2ea0b5661d00b561c6d9abb
SHA1 95d99388ec503f02442f1722e69df1fdb1a063d9
SHA512 331be8894656b08c88781f18a34d9aacf364e9d56a6297dc9547cc6dd6691728fcd58ff0fc78d5c3bd7bdedc9f0009cfcb4bc8d00d4e47764ff6915b57ae2e84
SSDEEP 192:sxZQRIWPe/f5s5d4BndpmNiHW6+WNBCnGQHXY4fz2qIg5sJ:sxZQvPe/f5s5ClXHbqVXHS
TLSH
T14132D8526E38697B4CCBE309FA15BF53E6F51072A5901E58ABFC9A1C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 784f19a09ee9ee845e0a4e5e0722836a3f68827374d43d974ccd2e0eb5bc4362
MD5 bacf17686659c693ed138a50203ea52e
SHA1 67cc230d9a4beb6229f2d112e3904fa317849fcc
SHA512 6c18bde6aab1525c9a581ea2f429e6239ddeff2f6f846d0209306cf2c047954c648170da5a27b11e695e11cfe96e886a6795399b59b141b81f37746764657829
SSDEEP 192:sxZZQUndRIWPe/f5s5d4L+bludpmMiHW6+WNBCnGQHXY4fz2qIg5sfAh:sxZRndvPe/f5s5CLyeYHbqVXHum
TLSH
T18D62F9526914987B8CC7D619ED357F22E6F910639D914E5CBBFCC51C08EA6EE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 82ceb88105fc852ad4edebb5d0fadb07c4c33fdb5558d5f75976b84be8f030fb
MD5 2cde124dac79be1ce945a5b1d98ba45d
SHA1 ead7b058800908370722c20468d0fb5ff673b29b
SHA512 b3efb45deb92207416707e49f86fcaa8aa6b17115ec0ee3c642ba5498f2d663cc233dfd5ac2c5ccbabc6e6a740b4572f80366302e698ae69f9178a0bd1f01e0a
SSDEEP 192:sxZQRI9e/f5s5dSBIdpSiHW6+WNBQHXY48H2qIg5GJ:sxZQwe/f5s50qBHbiXOo
TLSH
T1AD32C8526E38A97B4CCBE30DBA15BF53E6F91072A5D01E58AAFC961C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 67a2a3faa6e10df7887bb29145fea7bb4be82e957644c057c3777cb8eeb07697
MD5 1f32c053b74fce3cd71c40b81679f967
SHA1 2d86a3ba9dc99c566baff59af473d1d53f0e4723
SHA512 2b0ee96538f2b63fb22e4376ccbf05a3c59ee2258f4f56ac595e3fed6618ccde3d3b4b2da1f8ab0e6dafe4bd922bc751bb555959d07c3960d344209217218a7f
SSDEEP 768:KdqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opTNro707UnL:KdqirTNWvx7jru1ja5ALocTmYUL
TLSH
T121C2EA3B640CCB7E4FC01A9DDC5A6F963EA802CB5B548D5087FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 dcef5b10504f2c8f6011b7dc5721f9663448a9fb184dd78e0efe16805a5bd572
MD5 665fdef3b932345216c027ddf36b8dbf
SHA1 2ae7ff6c8c00853f4cd3037ee8e2aced9e8f6653
SHA512 b10a060c3da8a5264db903fed4848656eb1dda1a9a5b0fef5f479f7e05d2a01686c08138329eb69965cccc42d88e66c140f35c3192d3c7c71a6d46911a4513e6
TLSH
T1DBA0021013C4001AC91255B327D212426300DA551204A70740A200A8EC964C8CD4160D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 24cc6c71bc4c137855f6f0b8fae4cefb79b46503fe2a920ce78a43d9a226653d
MD5 76c818acef58f3ace5c184ddf1a6c48b
SHA1 906b08c00b66e38ba11c2f2ebe92a3f619349eaa
SHA512 a1ca2029741404f1212dc923e2ec7baa5069c3a7c51dfbeaf86acb590719df6bea7681fdd6c1c93832360dca1b547e0b76343f1389d149139e63d7122da733fc
TLSH
T103A0021702D19605E01316F03696C141B6A64E200A35230D61D15988C850DE59A4104D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 720B
SHA256 1a7c64b9eb72400528136b28c920f08c41328f2001e60d646011559c8b72a2d3
MD5 e29d0e81e2879207c8f71ab24902810b
SHA1 5c780d1c885d7ee113de8669f138fe3b00d7dbdc
SHA512 9f0cc22d50e4ede5338477922ae55f6d57d8ab3143f275f32963a5bcca9b92ce687ef6dbc1a95c7522ae99b3018bd8944ed0d8f17f8376fe1cf69681c4e8468b
TLSH
T1030120121EE14F6BE8610B322AB640E4F3328AEC9321D137642C21322D2E30C6106ADC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e308.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe58e308.TMP
Size 720B
SHA256 3991b300b4d4bcb38c88889783558c8fe6a999da0d4411b65c6b4f662fcd4406
MD5 04622ab71844d33666e23e5bb3845c85
SHA1 9ece4f7fad066c0836a99300d0278b8c7710d1b4
SHA512 762c48d33efd4ec0d6092ad495133d9964e3343417d22183b91aecf4a7ce396103b8611c8240e505cbddf093e6913f5809aa4a19809bdc03c7477f659491342b
TLSH
T176010E679BE14E1BE444033B2DF6A4B8F23248008322F273602D652E6C3ABCD090A0DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 02e1bc4b4cf19fe69b88fd1bdaf598b9fc3c88f6b6b8766e2f2d2ba42a5db348
MD5 73463ca47f236323059be9889afbec23
SHA1 080bbe3b673090e10771b7beec0da7b2ab7135ab
SHA512 fc376e2a31a86b58775018bf09687b90270d07d322993bf6dc7ac23966aafd5977fdd4198e5630f66eb2b549dd4655b0bfb9070f0b0d65dc45bab6f0a0d56144
TLSH
T1E2A00230AA8E90A9C51B4B702065914377505CAB61555301489F92E8ADE51D4ADCD515
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5937ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5937ee.TMP
Size 48B
SHA256 69b2740da4c5311c66712fcf2750cc05130448081875cbd610c2b5162eb4e9f7
MD5 bb0b5724068849f67076df7b9fed1a83
SHA1 237db8f2f5dc440bb7f34fbb8e5fb97ca5f145ea
SHA512 14eea05b043cbc23da98d9f0d66b9d729a108b28b6b8c6c3a8f349d280e222b3aec1d110677c649ebd1966b027909d9b91801d7513cbc04734d959caf10e5608
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 82490b4e0ba292827d355bb313dc23675cb3ddb72646b6be6a2ce51de73fbbfa
MD5 d8fdb9c5762f58cd3e129a965de96c53
SHA1 5bee60323f4e480ca26dc6ee960200a7192e798e
SHA512 cfb6b89cc34370529f5d4125918df7e67596a06dea5cc3ba9abc48917e4a4d7341f264ede63b32fc4873c75a0818ef4342772d86ac9cc7e577ce982fd133a920
SSDEEP 96:KkMYKRWCKOkK3qxqZW6ocgMYs/XOiMKmZOgMKK6/YqRPIzcIOWWOz:qbXON+
TLSH
T10291370272FB52423D3E246C95A0E7B71B47B1A33415B82B77A894791E6BE240CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594a7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594a7c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 10f4a834dd3be51aad8cc40326d20defa4acce8d62adea48a426fd0a0ef4c7be
MD5 3ba20e93ad3845f587e15dbd6038b3ef
SHA1 0ec4a6586e49ded2d8207c848a3d65e80edb6e0d
SHA512 fbb96ab1a45c26a29feec4a26fcebe047b86b9524daa5ce68cc83afb8e9c4a76642d784e791a1ce48a8a0a4e7e0e9a6ebf78c3627c135a78a9aa3249087bb468
SSDEEP 384:VZcIhsNXPKwObhDDkkMrSO2BeRs9JKgqijU1Y:thPdhdO2TjKgqmU1Y
TLSH
T189928D305878687AAAF7B945F487361B4FF88027E7C46F90E4EDAB1C409A198130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e56d11ba086f4fa13cebd8a546334b2a4817aadcc7239bf220d30657617995ce
MD5 2d7eeca0fb624cf3d4ccd63f75c0c62b
SHA1 584be8f371f86b60386474b612410aadb120f456
SHA512 06e7343e68a46b927a43dd67800e214bf4b88540f077f52034f5064d56c025443ac4a7a71e2324405a8fad1522f04f87949ca4270b43dcbcf6161cd8d7a199fc
SSDEEP 384:8ZcI1sNXiKwObhSDkkMrSP2BeRs9JKgqijU1Y:q1wdgdP2TjKgqmU1Y
TLSH
T17D929D305878797AA9F7E945F487361B4FF88067E3C46FD1E4EDAB1C408A198130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6ddfc64cfe548fdeb45d20614bfd9199ed2cb23d546f3b8f679fa5102db6bc52
MD5 6ca5d094e8202940aed982755de3b81e
SHA1 612295107737ee71cd47082c3d00954c3a763862
SHA512 79f7f3c8ac86cc65848fe3389cb5c7b5bb1b23b85a43a4d1549e98e77229f0a2867d1ab227b0f43ed3675cf4fcce8e1ed6dff90bb8c9f354b612aa0f1add7fbb
SSDEEP 384:9ZcI6sNXXT6wObhtuV2kMrSP2BeRs9JKgqijU1Y:l6bdGVPP2TjKgqmU1Y
TLSH
T1DC929D305878787AA9F7F545F486361B4FF88067E3C46FE0A0EDAB1C40CA198230B527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fe42d1709f2f69f9581d2eec7ba7aa1dee02706102bbc9dbe736748f5705c2ee
MD5 0cedcecb41d0966518695919a455ae53
SHA1 763da0d1c853547670b695e8d3ccb0941bf2918d
SHA512 fa2c27ab5ea0c2a8b1e9a94c797a083c2799c90ecf2ded1145188e1e7c5709e7038e5ebd586b9db6759a12093c40a9a6d3251b43558777bf687d822b63287094
SSDEEP 384:MZcIVsNXXT6wObhteV2kMrSP2BeRs9JKgqijU1Y:aVbdWVPP2TjKgqmU1Y
TLSH
T1ED928D305878797AA9F7F945F486361B4FF89067E3C46FE0A0EDAB1C40CA198230B527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f449ccc319239bb1fc3fd96e0429fb43de68db2113ab45e23ca8ef4ef44c1d1
MD5 aab41c4734dae0bb677a633d586a81a4
SHA1 c04c31405f702044f67aa03dcf32b041c1c03176
SHA512 fda634a9387850cdd18c301dd2b69c2eaecfe9aca2c014b19e55e87bfad0021493881862a3710a66914cac9a721bee23162077480c3b6b09142137e0d93049ca
SSDEEP 96:VqONkiQsjpfmUTtK5ih/cIPURHl8h4otop5tvDNBiPwivh50xy0SFYKcAxMbsa5b:sONC6kEQmiUy9Tk903Br9EccRAqMU6
TLSH
T15412293168BC6C6B9EA3A945B487321B4FA59227EBC97FD0D4DC261C40DB29C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0df3bb691fc822145098e4eedcc4e0ce0ce7481919e18e4d0af87e6e3292ac01
MD5 b2e2515c596b39e97dc6289691100cc9
SHA1 0f9f57de13121c63b51ec9c98b078c302d5cffc3
SHA512 d9203da170ead4649b958c0c1d6d1c9bb3ddd6cbbf43dccaf3a211fd4ceb2be2510c8b8075a1b056f24cca06f122a44489a2175eb92c206bdeab4b9b56246691
SSDEEP 96:ZqONkoQsjpfmUTmDK5ih/cIPURHl8h4otop5t5DNBhPwivh50xy0SFYKcAxMbsaK:gONo6kDfQmiUyPTZ903B4QiqW2+U6
TLSH
T1DF02E73568782CBB8EB3AE49F58737275FA5113BE6852F80D9E81A1C40D725C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

884f4a24-0ff8-4cd7-a54c-9c41318f6ae3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\884f4a24-0ff8-4cd7-a54c-9c41318f6ae3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 975b25853d7c8b60699fa6826a4364ca8c9a6dda5b653e616814ce0942e77f15
MD5 2c8696abfc2bbb1e898c8ac8595194d2
SHA1 12ecd276cb168c365f28d6f4bf503e16ea5de195
SHA512 c472b9d414c4381af5908b3be0e483da307ea57207cc2506c80197bf07ccd09ff200ea012da6cddad142ebf1a106218d1326a481fbb0e39a053c184df6302bdb
TLSH
T174414C58A6FA1148B3B76F469BF2ACAE447EB8372F0AD55D10010D4E0A22A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

ViewAllAuctions.do

Path C:\Users\Admin\Downloads\ViewAllAuctions.do
Size 134KB
SHA256 25312e20e907c54f23b7acc01af6f3785032082c75cbe24a559c64fc6ae6c546
MD5 fa6dc11448e4967d535d42349a9ecac8
SHA1 00093eb4c6dbe9d7b07a9068676c5c752975598b
SHA512 794819af6beb9e8612ab424954fa72f442a85db5e19c278700c63030e9d08f7531fe1146619fb7e2cd131138a77026bbb9b4f5311ded6b9647e0995b23244386
SSDEEP 384:eJCjqSs0a4Dg7mUSyE9mze4Ag1x9ZRTXQM08pl2/skwAeJRQKtJkW1tF+:eJCjqSs0a4/X4X1x9ZRT/Px1n+
TLSH
T1F6D3C83768C1FA1691730771E3626E46EFE6016383030C48B84FABD75FB8C499E57A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5772-1132-0x000001DD15240000-0x000001DD15250000-memory.dmp

Download

memory/5772-1148-0x000001DD15340000-0x000001DD15350000-memory.dmp

Download

memory/5772-1166-0x000001DD25670000-0x000001DD25671000-memory.dmp

Download

memory/5772-1167-0x000001DD25670000-0x000001DD25671000-memory.dmp

Download

memory/5772-1168-0x000001DD25780000-0x000001DD25781000-memory.dmp

Download

memory/5772-1164-0x000001DD25640000-0x000001DD25641000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads