hxxps://filerift[.]com/file/BEN2BKv00w

Analysis

user interaction
yes
max time kernel
61s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://filerift.com/file/BEN2BKv00w
Sample260807-hapnzasthw

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	227	https://bstlar.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a2743f2a0effe839	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2880	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305579487926682"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{AA7CC2C9-5B65-4640-8E43-3949E031D2FE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of SendNotifyMessage 49 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 3084	312	msedge.exe	85
PID 312 wrote to memory of 2880	312	msedge.exe	87
PID 312 wrote to memory of 4944	312	msedge.exe	88
PID 312 wrote to memory of 4944	312	msedge.exe	88
PID 312 wrote to memory of 4944	312	msedge.exe	88
PID 312 wrote to memory of 2352	312	msedge.exe	89
PID 312 wrote to memory of 2352	312	msedge.exe	89
PID 312 wrote to memory of 1104	312	msedge.exe	90
PID 312 wrote to memory of 3736	312	msedge.exe	91
PID 312 wrote to memory of 1104	312	msedge.exe	90
PID 312 wrote to memory of 1104	312	msedge.exe	90
PID 312 wrote to memory of 3736	312	msedge.exe	91
PID 312 wrote to memory of 3736	312	msedge.exe	91
PID 312 wrote to memory of 4604	312	msedge.exe	92
PID 312 wrote to memory of 2556	312	msedge.exe	93
PID 312 wrote to memory of 4604	312	msedge.exe	92
PID 312 wrote to memory of 4604	312	msedge.exe	92
PID 312 wrote to memory of 2556	312	msedge.exe	93
PID 312 wrote to memory of 2556	312	msedge.exe	93
PID 312 wrote to memory of 2236	312	msedge.exe	99
PID 312 wrote to memory of 2236	312	msedge.exe	99
PID 312 wrote to memory of 4476	312	msedge.exe	100
PID 312 wrote to memory of 4476	312	msedge.exe	100
PID 312 wrote to memory of 1092	312	msedge.exe	103
PID 312 wrote to memory of 1092	312	msedge.exe	103
PID 312 wrote to memory of 1092	312	msedge.exe	103
PID 312 wrote to memory of 4384	312	msedge.exe	104
PID 312 wrote to memory of 4384	312	msedge.exe	104
PID 312 wrote to memory of 4384	312	msedge.exe	104
PID 4776 wrote to memory of 2012	4776	msedge.exe	108
PID 312 wrote to memory of 1892	312	msedge.exe	110
PID 312 wrote to memory of 5896	312	msedge.exe	112
PID 312 wrote to memory of 5896	312	msedge.exe	112
PID 312 wrote to memory of 5896	312	msedge.exe	112
PID 312 wrote to memory of 3032	312	msedge.exe	113
PID 312 wrote to memory of 3032	312	msedge.exe	113
PID 312 wrote to memory of 3032	312	msedge.exe	113
PID 312 wrote to memory of 4564	312	msedge.exe	114
PID 312 wrote to memory of 4564	312	msedge.exe	114
PID 312 wrote to memory of 4564	312	msedge.exe	114
PID 312 wrote to memory of 5692	312	msedge.exe	117
PID 312 wrote to memory of 5704	312	msedge.exe	118
PID 312 wrote to memory of 5712	312	msedge.exe	119
PID 312 wrote to memory of 5180	312	msedge.exe	120
PID 312 wrote to memory of 5180	312	msedge.exe	120
PID 312 wrote to memory of 5180	312	msedge.exe	120
PID 312 wrote to memory of 5520	312	msedge.exe	121
PID 312 wrote to memory of 5520	312	msedge.exe	121
PID 312 wrote to memory of 5520	312	msedge.exe	121
PID 312 wrote to memory of 992	312	msedge.exe	122
PID 312 wrote to memory of 992	312	msedge.exe	122
PID 312 wrote to memory of 992	312	msedge.exe	122
PID 312 wrote to memory of 4724	312	msedge.exe	123
PID 312 wrote to memory of 4724	312	msedge.exe	123
PID 312 wrote to memory of 4724	312	msedge.exe	123
PID 312 wrote to memory of 5244	312	msedge.exe	127
PID 312 wrote to memory of 5244	312	msedge.exe	127
PID 312 wrote to memory of 5244	312	msedge.exe	127
PID 312 wrote to memory of 6004	312	msedge.exe	132
PID 312 wrote to memory of 6004	312	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filerift.com/file/BEN2BKv00w
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffe8c1c188,0x7fffe8c1c194,0x7fffe8c1c1a0
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,9508407133416229554,2216098120343271564,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,12441639273704442445,14031623551636426574,262144 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,5812054983041907627,3967465996962330548,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9693076602357892333,10679840724264087102,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,1120643134485398972,11809552752812438305,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,15369080911808919796,5926437801339666032,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4040,i,3703225229633421744,3044498611039460557,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,4323704477327504783,8858292181719116398,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,10493772927864920583,2026289800499097987,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5628,i,16199596324869338295,5356744850089537954,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5748,i,8845088890607491732,4967190270464435231,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12332815415696548114,6463456934335885894,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12332815415696548114,6463456934335885894,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4168,i,2439034688785629516,14671731343654190430,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6644,i,18298503991713697010,5619403250184903187,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6044,i,9044795267453982576,10892486808755229974,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,18301478645963053289,16679363504094627963,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7759419283611992613,13710607590009893936,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,2285204891348839756,2004664647395014480,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5844,i,4416185681624814322,12204499519488164137,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7068,i,10781208601940631185,4461519043352653303,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6884,i,2733887250188512505,13064722853023211693,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7180,i,16248442351149456417,1136785225880437629,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3292,i,11036781317153042789,12672534836887407876,2097152 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,4963227099162124091,12524913665179400304,524288 --field-trial-handle=2612,i,478629181256871241,11289173512860961704,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7c728593h5847h4489ha0c0hfcb6e85b6c09
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7c728593h5847h4489ha0c0hfcb6e85b6c09 --edge-skip-compat-layer-relaunch
  2⤵
  PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 27KB
SHA256 768e7c63f15ef812fe3bcf570012035b492c7e77b137cc88c4f33a42161f78e9
MD5 19ae99dee19f9aa8a6b1827a106fa907
SHA1 cace8e5f0c8d8c8e47137c09e744e03eec0ee0e1
SHA512 df7e39667174dc3aee14f6ecc73065da08f84f1fc97a9a7afd334657662c8fca530a4b3e05769338696b5db3a3ec038180604e96f1de4d8a1a66a1e611f19cf0
SSDEEP 768:JuCyNAPCyaQao4Ae24acFFdkM1MszixdK5h:EAo2NcTeK5h
TLSH
T146C2656675F85209F2BB9F7AE8B217A54C7ABE462C04DC1D58A0224D4C71F40DDB3B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 accdc9c49a7bb07872c358d8ecc4d5c8c82e7ceb61b8d7c1753e4ff7bb4396dc
MD5 b2838d75544d54783b0e5956d1141021
SHA1 e5fb2769a4511bed191a26d94727dc577246a0ed
SHA512 72cbcc42247a89e83e4463a989364bc53a5511b45fca418c05bcbf0d327ab8d079462ad09892647ae4743ab1843e7a05b370392d390b9b576ded4659fcf43291
TLSH
T138E0D87884C9C11B551450D75934BF09D5E3670BDB88FD454F1CC8047446155FDAD6A5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 67d348f470618e874ba09e104765e862b0108141e66af1b79af05b6af5e06d0d
MD5 c76480bd36cfc7628ecad4fc74757ed2
SHA1 09e41da0a396a5b163845670142f18601b9d06f8
SHA512 68fc9ad39f496086c2abd70b1c5bd06ca273f548062e4b7e615fa9188ff8924573867008092b5d25c57831fe57818920ef67fcf06c3a8a737bcf29724b538ad3
SSDEEP 192:sxZaRZyM/jK1Ml8MkE/fHsyJSmbIdp5+HW6+WNO+g/YLnMO55IgrJ:sxZaDME/fHsywZwHbY/+9
TLSH
T16452F8216A34A977CCCBD209F955BF53D6F94473A2900E44AAFCD91C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 50fc21e006ed3d9d2d1544c88a0343db279f3a004f8e296f966eee25f8ae7d0b
MD5 ed3ef66ae002f7ffab7092a48fb647bf
SHA1 28c7460310ee2578b1ff748232834cfb026722c0
SHA512 6414594ac14a3b922db4457bcdf0ae91a71d02e1008f039d0a2bdde9c4f2dd1ba76b3c4b1defdd89a3eaf77296d7bfd866e7cb02188e55478f913e1a0b0576c1
SSDEEP 192:sxZQQUnLPRZyM/jK1Ml8M8E/fHs0hSmRqwb25GdpNIhcEHW6+WNkz2+gtLIqOM/j:sxZWnzDkE/fHs0Y9zowHbFqM/zX
TLSH
T18D72F7126A341D77DCDBC219F901BB63E7F94562D6904E54AAFCA90C00E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f48112105fa5705b6d7bbafdd6aa439d831e077dbc5ac7e02678a88c7157b59
MD5 b8b37e2243aab5b1411919567dff68c9
SHA1 34837c3b52fc4dd36e2e4247c9fb9650cefd95b6
SHA512 bab18074cd5ad565875444693da18912f01121a51da7718a166d63967b08cdcbeeddd5df30ebe035153c5d02a611d38920da4bc5815f24185c52441c6e6ca291
SSDEEP 192:sxZaRZyM/jK1Ml8M8E/fHs0JSmbIdp5+HW6+WNO+g/YLnMO55Ig5pJ:sxZaDkE/fHs0wZwHbY/+x
TLSH
T13552F9216A34A977CCCBD209F945BF53D6F9447392500E549AFC991C00E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 374ca34b009f69084449483e399f07f3e9ddd94c8109638931d4a37f5c5cf4fe
MD5 8ba0937b6ba26573bdc237b6d002389f
SHA1 8a0ffedaf75090a1836f93de30beae632e8da4b1
SHA512 5cead5a1ccd54baed2d169548324413342c227a92e2750a2e376baaf6a3a7007b05dff1b7956759790bb5496b97533f35850236c346fb3bb31f5a2eee0321ced
SSDEEP 768:82s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN3ro8k:82s6pD1WvxzWju1jahILIsNk8k
TLSH
T171D2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f04b7b-6d4c-4320-9e81-e0ed14cd9542\index-dir\the-real-index
Size 72B
SHA256 5649b4819a4d8a9c9280dc2d504e8e50f2cb9b67787c0f608e707fc4237d39b4
MD5 15629b424b0b98f45325c2fea06a150b
SHA1 17988fcf262bd94448503b4416a1e033dcae8f8d
SHA512 458ae29af6e7f96cdef2d41218b7095005aee048cd4ee45c8026320994ee50f7ca7061c1c59142f9233a6e0e16a5de1bdf14ffb9feb57ff1ec5ddc2bc85c0506
TLSH
T13BA002B003A22561C54547B0398B4656B3218C2013920A9573E8F5E5C8906419B36520
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fcd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f04b7b-6d4c-4320-9e81-e0ed14cd9542\index-dir\the-real-index~RFe58fcd9.TMP
Size 48B
SHA256 27c71525ecf4c5bd05490640d2a9f2a35dd72e037c99813be51cd8bf8f65b950
MD5 8abf756e1a302756efa56ba5fd8eefd6
SHA1 b7e143256fef814cead48e7e28c152f16b8caa1b
SHA512 6456959fa3b1799db25c812e1386ea31f79053b0a93e1d8d9030a5a02d440b24ee029878ac50ff859022ca4d11550552305d64c50677e98eaefe691192d1e5e0
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\70599668-79a8-4baa-bc5b-42404e70b9c9\4f2277ea2139c475_0
Size 62KB
SHA256 b85ff7c21849cc138a1b1ba53d5f0002fdf8f56e3445c4583664624e8059b393
MD5 fbaf6e9c0c21bbef869d60412a942bb1
SHA1 981f55c76dc975f744bdc66321c29b0c6d006e8c
SHA512 2f2d30467bbf7264c890f0c7e702b1eaa7981a650eae2c749c99cfee8f866f06f427e8046a407aee2595863793c7f9d34b961e8ae0638e7c5703b90367a0b552
SSDEEP 1536:cp82f14JfCS+ksYyiApR+M0DpbarcjwafkoLDa5HPwqpzGG/1:caK48bC6Rx0DNDqH/1
TLSH
T1565329A7B26261358BAD11D5A49A7F00F12B17461444C9ECF0BC7A913B18E8B57B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\70599668-79a8-4baa-bc5b-42404e70b9c9\index-dir\the-real-index
Size 72B
SHA256 b8ee86f409dcdc90429fea81df594d92af6a131de07fc7e679042e91f4136860
MD5 7ca873ef9edc18befefba15959f77455
SHA1 8fa8e444bd02ed25629bc3f2e319ed08fc262ec3
SHA512 003c8f836c77b163dbf3db494ce78f4654efb5c4150c6c680c2142eb7719a5e82d2eec4d7d5164cf943dc19657bafbc1ad07f970435fb1505c25621fb4b33ee3
TLSH
T16AA002B421D50461C80616BC668742602325DD2905095715AD980D958CD91585625064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 6e50d5421aba5edf593824a366eaf263154a052ec8f56859dc0f0a67c529071f
MD5 d8e253337a6745df990ad699f8e8e720
SHA1 14d9901f0e7402cc0f6717442fa0343ebf380aea
SHA512 5ba83d8392ef06b11fe4b093c61d1c23ec5a5db71e13468c3eb90574660d0a0f1a129c3b4f7074bcddb78a84705c43e580be0a2323904c903a189658b9c73c27
TLSH
T1E551C90E8D82491AD89C11B318FA04407775A4CE62C5DF0B71DCA039FCC3B762D56166
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590c6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe590c6a.TMP
Size 2KB
SHA256 ed25a882e9cf803220deffcab287d318201a0753016083c6d66ecbff0dd321e1
MD5 f821a59e9268f5b0ef471f7da589a7ac
SHA1 3c15a8373df0a5ba0a774e55376f80990a84c810
SHA512 2adbad7f27a4118153a4916ebfd1f9f9646c8c90d877a87041d17efeab4a067fd1838443ecbdaa442678ba6f63bc9330962106de2cc058aa711ac1f888d6225c
TLSH
T1C151665E4D424639E8D4417709E3A8A437391900C719BF5374FC9636AC9379E3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 b1ffdceac46dc55ca4b457d46082088e64bc258ef037edad9a9d946fda62613e
MD5 b29f98aa28ade3cca06d7d495861d63e
SHA1 c857cacf86a83fb0bacbdcc51c81009d509869db
SHA512 6a650c9ee8334b0690e0165c2a93aa967d7a88ca751ebfff449813ae40297d7a25b9cbe1e7abca6633bf8d810cf5f326222a9b55b5e35f8ae03d46d5c2403a62
TLSH
T1D6A0025057C40403E06353B025E7A5E172518814E705670551D50248DCE0576915791C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ea2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index~RFe58ea2c.TMP
Size 72B
SHA256 1c7a4d1587f6d8f90fc5c4b64777ec70e912bc646a9e4c971fecf6cfc8449352
MD5 5440707092e1ce986042c9459f2eb5b5
SHA1 636e1e0d75ad9a367706ca376fdf72b9238afbda
SHA512 def1c1927ad8ff73adca4d3645b24699b5435578a2b8f3565a2f420953536e33ad559e7cc17c64cec17dfd421facc5830d16e559adff04615bb5325a50eb1297
TLSH
T134A0021403C85109D86262F11563025D5301CA151200D30750A51158CC538C05DD900E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 3b9c971776884bc2f5d5f8641cac36a780f5e8b8dfaea1aebc93d35b635e585b
MD5 17f970195b7be67514ddd5073cf810a2
SHA1 80013c8f7fda1a85d935d5f44d4395f0bd224682
SHA512 2aeda0057845cf5032165a9edf01cf8f6a846775c60be0d92c9f3bfdf806a469d266f00b2fed2bfe1cb635aca5958b6e279fbf34f5d0d60e8b37541d8cedbf5e
TLSH
T1EFF027B76FF72D20FDABE3E76471546106413C188841BC4F146AB58390B0325794DC65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 cc5079a3651a32be1736db07daec88179e34178ac2fe1419ee1658758e59179e
MD5 6493bfc58fec52a21e0f7d6de34b974f
SHA1 8d748048a3dfca259526f4e57be6290ea75c44b9
SHA512 be08313e7b2dd74471e92dc1e607bb7e06ecb46ad748fc72b1ffc9814a8e8d24cc42d56d0073fa55b28523a55114ec572f79f1f395e26e4c075d4fb4a413b6ca
TLSH
T102F05CF72FF72824FDABE3E36470947106013C1C8850FC5F586AE58340B0224784AC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a989bdd1d5ea985b71006d0d56404dc555c75c44a87b968ae515b3d8cf0e114e
MD5 d24712991a1417152bc8e287dd95016f
SHA1 67d1be7523833d4934a7479b58e8940b7cf01601
SHA512 d1f2b6187d8cf96f0e7933aa805d02ffb5e5e67713413bdd93035490f6fb9321767da6ceea21d363fc144c2ebfc5f5f73f41d735809ca09fb60fe149a2046827
TLSH
T1DEA002B5896EA5CDC10582B0A9E581942212C8ED26052F2140BF03688C9024055FF004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59047b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59047b.TMP
Size 72B
SHA256 fd1dc4905bf109a8b568a73793310627d8e91c2779f5f4612788a7acd2c0627d
MD5 d217d13a5e8f69ca9136f0b2df561e7e
SHA1 f1e1f220191216e8b7642575ba356c849be55ac2
SHA512 7d1feb5130c995a4624715bcecc788a03c0261c8b25ecee20faf28a9dfb029c94e856c83c49777687d4fa9f2ac3a8566826331b172c8773d07373d5a3a7bd53d
TLSH
T198A00276C24A5C09C4501FB1501722A053409D5907011242589890ADEC950D15661509
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 59de309830fa106dd83458685a88811148a323b1a574948dae33dbf3a481fb8a
MD5 5627e4a6474062aca1c25d3ca8f88260
SHA1 432d1230af41c02231a9743ade43b0fc35d0630f
SHA512 3466af70a49a9aded55ab98342e1f937116032ee89ae7553a3e42bf2fbee4432ddde7c00397d9b775ac2a233ea8ccfa74fa6b3ed4b572e8bf13104117393b805
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIypOIPKTC8pKIPK3qkfyp0IbK9KcV:KUAAKteP6OYKTCEK4K3qmq0gK9KG
TLSH
T140C1F05271BF06022DBE2A1DA264D727A7427163301DA42B37E950B11EABE340DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d242fb4a-4ce8-4b33-9bd0-3efac4e148f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d242fb4a-4ce8-4b33-9bd0-3efac4e148f9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5b08e21893a6c9894c7c85fef997dd026b776df3cd76b1b625fa5b02bca09082
MD5 403b64174eb18d8f501ccde351a492eb
SHA1 2836a7f7098e0096d2306cf47195b8ad6bd21ded
SHA512 e317b2e648e0f1bac2889463f7ec978d1394eebf743d381747ac9b150ebd2132f5482dc4ec6a3d066dbabff9434c8cb9bb1bdaa948ca882e7830ed8b6d39d9f5
SSDEEP 384:RZcIhsNHOPL6eri1a95OVnuzJra0Vf5UrzcKDny:5hfLViYjOJ2ha0VScZ
TLSH
T1BF928C716C386C336AE2E445F98732178FF98177D6C52A8895EC7F2D01AB5AC2307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ada21905d2a971c62cc248e67a0fc773c136e5d03e2099e801211f58f52410f4
MD5 f6d5c09dcec083b00d8f4b6ba57968de
SHA1 8b4cbda92a1291a60606f3e74c3ec170696f209d
SHA512 2b1f608e61ae0b740d10a9f53ee7d41bff260c293e90bee750b4136e932998ac747ad62fc878b5e1f9605ea5c53de31f93982e9fa5f16ddad0449bfd1dfe256d
SSDEEP 192:qONi6O7+3hQmiUyfBGttb0gO2KDgGmqdU6:qONi616Gt95OVHPdU6
TLSH
T16E02E7357C282CA79EF2AD49FA8727279FA5113BE9912F40D9E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 30d5fd1af55f7e9354d67f99b0d9921626ea7fd3a6d3d003933c9c24d7dd5215
MD5 07431f1a84f4be7f9325bb58f208eb63
SHA1 c670062413e1f26bafb52239b8623bed413f082a
SHA512 6a3fb2f1099bc336aba1ab9cd68903c1c58f6836d261b652902073bdabfe8f61b83ac4d38ece2799d79e021d72d051d80b8b5fa57e7bcaf53520b8bc9b5c8890
SSDEEP 384:qZcIhsNH1T4L6erLe2a95OVnuzJra0Vf5UrzcKDny:IhbLVLe3jOJ2ha0VScZ
TLSH
T1DC928D706C386C336AE2E145FA4736178FF98077D6C52A9495EC7F2D00AB5AC2307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5d736540f50c99d28a2ac8efeaba81ab73f41f75fe998348b66e7a4d452c1d4
MD5 6b4f6802bc61f75bf48eece89f53d606
SHA1 c2d704885f6a02ffa3c132de5f9042877d0bb003
SHA512 148267b9ae62dc1acce7fcf8dbebf97a1b2b5bd1d1208c9a1415e4821d5092aa5cd79d78c654bcb6e82154db42482d30998dfdc2b4efc680cc07b200a1ae939d
SSDEEP 192:NONcd6O7+3dQmiUybVBHttb0gO2KnyF0SJrFcNjq9FVU6:NONq6xkvHt95OVnuzJry0VU6
TLSH
T18D121A3578686C775EE2A545F98736178FB5412BD9862F80D5DC2E0C01EFAAC234BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ea21616ca64613fab771c09e4a6ff5253f8b08413a10570b39ad321d32105930
MD5 32adf97929cc2c9de8fea88ce30e3c07
SHA1 d458e949e4dd535747026964d0d8d76c2da610dc
SHA512 f73e95240fc36d3467735b891bc16bf58a048fa6a87265e091ebede72016735128fee35a16ac5f554ea9cf5766d10bd1533cae5280871942a048c81469361b4b
TLSH
T1A9E00202D30014FEC11D0730404B1B302BD2812401B103168A7115583C273003D30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58ce57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ce57.TMP
Size 392B
SHA256 f4398c94e26eafa94e6f06eb360eedce5c484f299d76803bbbbd75411e47fae8
MD5 fc2398f567c694bc6fefc4abbd5cc418
SHA1 c668f8605446549230011d81429b7809b08575ca
SHA512 932b09dd9c457c2c80e755835913880bedf4c3e94ccb8707d1429319a01bce74c86b8e2ae4dc3eba28cfb9fdef188200e68abc3ac894980a64cfa20931153439
MD5 SHA1 SHA512

Submit Download

bbc691f7-00a2-4433-b8ae-d56d1f690417.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bbc691f7-00a2-4433-b8ae-d56d1f690417.tmp
Size 12KB
SHA256 a4da1a7c71446860f79256c244f6c697e4630aa7770cdfef8fffd7828406f13f
MD5 e44183a1b1bf745465dc7d4a11f2390f
SHA1 55ee5c8a082792bf321e3316ce909b5b72c1c826
SHA512 1f2cff0958d8426cc23c46c718243e004e63c83b507b17cfff9726e11c58dfe3390be1b342ef06132e4e1f02d0df336a211a1eeedc49fbddb47906bb5616b148
SSDEEP 192:mLsNAALQSxjLR7+3vc3QmiU1dytqZatb0gO2KnyF0SJrrcMjq9FVa:MsNHLPL6erkoa95OVnuzJrt0Va
TLSH
T1614228757828AC335DF2E145FA4B36138FB9806BD9852E8095EC6F0D01EF6AC1306D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d3fd81a-585c-49a9-86d2-0c25b8b17d88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d3fd81a-585c-49a9-86d2-0c25b8b17d88.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9ac8e5caed6678300b8b82072690d3dbdfeb77c5faf8f70a7504bf2d2a9ad356
MD5 e2a52086574bca524d5e1223e74b44a2
SHA1 d3eac77742c04ef59b4c1e427ec379fae0d05652
SHA512 e5b0abee5b613e4c454321cefafb8df7ddeb92d2994aba8b3cb64661b30aa0656c1880929070a2d08a64ca7a29d94d20e660a0f110f08a3316ac133e2136d154
TLSH
T1E4413858BAF9114DF3B76F5A9BF3A86D487BB8772E06C46D10110D4F0A26B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads