hxxps://redboxcloud[.]ca/now[.]html

Resubmissions

10/08/2026, 20:52

260810-znrh6ahl4x3

10/08/2026, 20:12

260810-yzbfmsxdld3

Analysis

user interaction
yes
max time kernel
68s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://redboxcloud.ca/now.html
Sample260810-yzbfmsxdld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308663973449491"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{347CF7BF-E715-475C-9FFE-4066E88B397B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2076	412	msedge.exe	86
PID 412 wrote to memory of 2464	412	msedge.exe	87
PID 412 wrote to memory of 1756	412	msedge.exe	88
PID 412 wrote to memory of 1756	412	msedge.exe	88
PID 412 wrote to memory of 1756	412	msedge.exe	88
PID 412 wrote to memory of 2504	412	msedge.exe	89
PID 412 wrote to memory of 2504	412	msedge.exe	89
PID 412 wrote to memory of 892	412	msedge.exe	91
PID 412 wrote to memory of 3220	412	msedge.exe	90
PID 412 wrote to memory of 892	412	msedge.exe	91
PID 412 wrote to memory of 892	412	msedge.exe	91
PID 412 wrote to memory of 3220	412	msedge.exe	90
PID 412 wrote to memory of 3220	412	msedge.exe	90
PID 412 wrote to memory of 1880	412	msedge.exe	93
PID 412 wrote to memory of 1880	412	msedge.exe	93
PID 412 wrote to memory of 1880	412	msedge.exe	93
PID 412 wrote to memory of 4244	412	msedge.exe	94
PID 412 wrote to memory of 4244	412	msedge.exe	94
PID 412 wrote to memory of 4244	412	msedge.exe	94
PID 412 wrote to memory of 2648	412	msedge.exe	99
PID 412 wrote to memory of 2392	412	msedge.exe	100
PID 412 wrote to memory of 2648	412	msedge.exe	99
PID 412 wrote to memory of 2392	412	msedge.exe	100
PID 412 wrote to memory of 1740	412	msedge.exe	102
PID 412 wrote to memory of 3172	412	msedge.exe	103
PID 412 wrote to memory of 3172	412	msedge.exe	103
PID 412 wrote to memory of 3172	412	msedge.exe	103
PID 412 wrote to memory of 2712	412	msedge.exe	104
PID 412 wrote to memory of 2712	412	msedge.exe	104
PID 412 wrote to memory of 2712	412	msedge.exe	104
PID 412 wrote to memory of 3832	412	msedge.exe	108
PID 412 wrote to memory of 2344	412	msedge.exe	109
PID 412 wrote to memory of 4440	412	msedge.exe	110
PID 412 wrote to memory of 4580	412	msedge.exe	115
PID 412 wrote to memory of 4580	412	msedge.exe	115
PID 412 wrote to memory of 4580	412	msedge.exe	115
PID 412 wrote to memory of 5080	412	msedge.exe	116
PID 412 wrote to memory of 5080	412	msedge.exe	116
PID 412 wrote to memory of 5080	412	msedge.exe	116
PID 412 wrote to memory of 4408	412	msedge.exe	120
PID 412 wrote to memory of 4408	412	msedge.exe	120
PID 412 wrote to memory of 4408	412	msedge.exe	120
PID 412 wrote to memory of 3080	412	msedge.exe	121
PID 412 wrote to memory of 3080	412	msedge.exe	121
PID 412 wrote to memory of 3080	412	msedge.exe	121
PID 412 wrote to memory of 648	412	msedge.exe	122
PID 412 wrote to memory of 648	412	msedge.exe	122
PID 412 wrote to memory of 648	412	msedge.exe	122
PID 412 wrote to memory of 4084	412	msedge.exe	123
PID 412 wrote to memory of 4084	412	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://redboxcloud.ca/now.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,5347144287080340373,9470748050528818366,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,13686843039927613534,16295772084209114366,262144 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,3963836054334626012,3988958069337405459,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4068739453617417014,5283046982613714871,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7647783295717826135,1626986724055818923,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,13508122426831649421,1968693430020363086,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,8233076261503790736,842195149882035228,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,1466644841653825660,15594422698724505638,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,205027628691503783,15009753792140808743,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17512018356122511453,18029823301834702588,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17512018356122511453,18029823301834702588,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6164,i,15295579637719250047,703738610290946165,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6416,i,16044771013343462339,4509064615771562462,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,9721613866588580948,3600269502291391518,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,12429325605296359364,14256371793057524858,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,10215484104977527615,7690391919424163520,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6008,i,13313603469920326602,7984417748978735012,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5152,i,2866539356817541596,5584497277786394423,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6208,i,1598216017982004746,1145235559261480542,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3500,i,15762443053003297354,5907760098810777672,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6544,i,15963099208721382944,13805415034335602057,2097152 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17886798709421031408,7503544418312567635,524288 --field-trial-handle=2388,i,14595576965649963053,1541448131908767080,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 760e87d367abfa51ec930bc94cadeedaec5ffb482be3355a9d911b3728abb6d3
MD5 0d98888974299912da844b369f36f8fe
SHA1 c3b007b5b602a20d2f4fd99f7bcec499a63e1527
SHA512 dbb9321e5f8f39ea1c1a322252ac7782523c2c0e8bab7da6c1a1256e2f23c399e8900b6ffe0ea1d7668a1df2138c3aa368b750bff6aad79ef78a39e7fd52a9e4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e179886ac9d29d2376e22dabcf3e78b195b84dc39b6419856902af391fe6aa32
MD5 eabceb9fc984b2970d5dbe25cb03564f
SHA1 4ec6e9b715eb342c02c091420e85b8a52fd8e0ac
SHA512 a9054ad6c5c2243c66238682dd05c5792095e76ef6123a4781ef3ffd6de7072a0b9e0fb2409a864420078e6fb7a2ec5810b5697a22babe983c451f20a1b74f77
TLSH
T1967193360A53466DE7670332EBC2C41A727186EAFA3F9DED64D0587C4D0B3F1816A963
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 961cbbc2f6f54c5cac8326ed57aa8d3f30b80196f4063f3cf56a7acf041b0382
MD5 3b04cfc796d8425deaed657ba6d7417a
SHA1 1057664aa644ce6907943f4980ba0db245ef1ac9
SHA512 19dfe3a1b100781ad2c73185adb1b163a6dc2d84115a725f8583fb9da16d24210e70cb890cf6787379233ae1a21a6641f96ed0735d823782959d4e0bc8d5a694
TLSH
T16581A3750953412DEB530332EBC2C42A767186E6FA3F5DEE20D458BD4D1B3F1816552B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc37.TMP
Size 3KB
SHA256 33500c9066c0d100610a57c279f52010a5ec1661bc1e7652504dd5e8c0e97c3f
MD5 aa1947d9cefc54e6525c49eea456c550
SHA1 65def898ec615c99e1f1a9644d911ab4d3bc5546
SHA512 ff58d67db454b22d36fda0fd59e12d1124961b2122a44965333fbe743967129b9dd931318947d9e1261453289bcc6c117f4381c877c66abbf48702a1c62881ab
TLSH
T1337193350A534268E7570332EBD2C51A727186EAFA3F9DED24D0587C4D0B3F1815A563
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b07c88e7ba5523f2dc1280c8caa910353d03cbe4fd9744d53ec8d1552c40667
MD5 2974a7c0307b7921822ac280d8f7b2bd
SHA1 d494117cf9bf77a11ed064772e0bd1dad872b687
SHA512 2d8660b48acef87b1be880c72451ced6424dfa07bec704488a7d6dedac37ae514e477f69bd0d0a11fbd6231e368dd1573f3aed349c5096e02185637bb210db51
TLSH
T1EC51A8F383A1856ECE1166F4AA18EF2ADE2D0611431C7819C6D8BE27D3F3075E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 442eba3b93e0f617fb87ef854a78a39d0644a991931e2bd4560704c3dd3f37db
MD5 1eaef7b85d8f5e63a09ef1239492e8d9
SHA1 420afd36203f84d22dc5687631f4c2333e09dadd
SHA512 9417a1185c7c038a3043ec9f3782c6443b1a8add8b33db5a9ebc3e6144937002904a6337bfb02180a52af180632744290548364ef4d38662aaa4514ef88f30c5
SSDEEP 192:sxZYRLEyM/jK1Ml8MkM/fksKVM1Idpn2aHW6+WNnVuV/Yzet4lIgrJ:sxZY+MM/fksKVthHbm/c9
TLSH
T15142E911AA349977CCCBD209BA457B53D6F9047392900E54AAFCDA1C00E6BED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 39512e56c0f8731dda4399382b72d60242b58ab7f05d9f468e23c782f1b981f9
MD5 f19fa89333af63b5806b996ebb8e295c
SHA1 3c011edc23f1e675bce44fba7c06e53c41473d7d
SHA512 bcc8773422ea74911fd165d9cebb031d330801632374a7f9885d489f90e7d6f104fd7daee6577de9d8a0d33a5a3cc7e70cd78c65de4120b35518487ed68770b0
SSDEEP 192:sxZYRLEyM/jK1Ml8OiM/fksiWpVvio1Idp7AKc2aHW6+WNUzP/teUkVuV/YTqH+r:sxZY+KM/fksiWvviBmHbmn/U/
TLSH
T1AE62D752A6349DBBCCDAD609FA45BB53D6F81473D2901E54AAFC991C00E6BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 18084b4dfac3f2f682908197495b5680e0b99ab8bb869516a282dc94d4f79c76
MD5 fb8e3038ab103cd15416c572a1895148
SHA1 027e479e735cf35d82563b237dadcbd0f28482ab
SHA512 4a86f99c09b83fddd4cb4c4851a87a372a7ff9e91d119fd9b9e0852ee59f40bba520b7412e8e991ff3aa8aaab6d3166cb7ee8c08a608f0c9f81a365c2327f6e2
SSDEEP 192:sxZYRLEyM/jK1Ml8M2M/fksHiQG1Idp7AKc2aHW6+WNsP/teUkVuV/Yz4W4lIg5D:sxZY++M/fksHiQXmHb0n/pp
TLSH
T12D62E852AA349DB7CCDAD608BA45BB53D6F91473D2901E54AAFC991C00E6BED2303C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5de3bb8e2644a311642af2cd421d804565212a31d55d73d933b0803cf26de906
MD5 9e0d631e9cd872f648c7143771167a1a
SHA1 ce595b524f89363bdb56108a229c85a0c77f7197
SHA512 2f2a8eb7344305fd1a2a1348c7a5e444472972b02a0192d0be3ecd10ec2689a27255f60f6e17b2504d06bf128137f1ebe7bbdf0180a12a489c1bcbe0944c6995
SSDEEP 192:sxZYRLEyM/jK1Ml8MkM/fksHih1IdpsrKd2aHW6+WNn/tVJkVuV/Yz394lIg5ZJ:sxZY+8M/fksHiolHbRn/pp
TLSH
T1E852E952AA349DB7CCDAD608BA05BB53D6F90473D1900E54AAFC9A0C00E6BED2303C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b5e81b26bfde07adba95a1783acca37e0d56bf6fcdbd676d7f410c1f57237528
MD5 143af3db707c1e2ae67a5735f3de9df3
SHA1 5637c67367a1bc3591ffbd043c39d96add707049
SHA512 3e5dc3640bcdf470454d0264da6781987ceeaa2252c6d8470325a3fd442cb97d65676997aef11e73838f0808584a8fb4d8b587a851ee40b21a2470bdd75e137b
SSDEEP 768:f6W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjEroIqiHYG:f6W7kf0Wvqidau1jaa5LA3jPRG
TLSH
T1F9D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bf03c28b43fcd30d80eb35565ab40beebdc2bd4a22c344920a9072525b15e72
MD5 aad5b1306542f4c0904367f024c53824
SHA1 bb0c6be16cd46925de2105512997ed715982ddab
SHA512 b2b47050adf30a2c833c8cead0fddd76ee6d7a5cfa49384933cc8e0883b0ccaf52adba57a58325860b3184bf76444d57e61eb3aa12cb3b7d997a72e26f1a9b45
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbEIfKFmc3yZ8ILK9Kc1XIxKQ4:KIbCKcbEQKFmeK8gK9KmXOKQ4
TLSH
T1CF917846753B16013CBE2C88A395D6364E423193386C686F7FB900721EA6F124EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5958d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5958d4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 25abb00ccb50cd631fec96ca1c345b0b9030a0dcfc9baf59ad7a024e7bfbc391
MD5 e65933300451d32ef7a8f5b51cad34e9
SHA1 08febe83acd066a6780753eff26c573a941a9f1b
SHA512 7256ee60f589f63abe5af3526ed188d4a167c509536935e7e07c069549f2a024a62f2496b0986d41ff2eebf9c60f161ece8a64763934bbddbee2bd8f4fb51ad4
SSDEEP 384:dZcIhsNbA/sb419PdlhCEJrD4m6HlytEDq1KCUR:Fh7syZ7hD4moy6DqUR
TLSH
T168929E3058B46D776AA7B145F48A39135EF88037B7C86ED4B2EDEF2D01EA2A81307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6b2fa6d13bbfb6596536392d34ad70bba143fd4bcfb173f255911d30b4fa1d18
MD5 d365e217c31afef143918ea8509b3746
SHA1 3e51408581e218f7088f7feab49fd7a30efa8e99
SHA512 51cdaccd8fba32666fa929154f46a4c1bb9813472f584e58b8edd0565517cc1760361ce775fd65119d1ebad3e9900465110809ee6557b291053caf6b1cb08b3a
SSDEEP 384:OiFLZcIkcsNX8TUNTUlIlv/sbhwrPdlhCEJrlkmKStsa/sFZ9THsE6HlytEDq1KZ:lFTr+wgps2b7hlaSIFZ9Dfoy6DqUR
TLSH
T167F27DF084E74DB6D5AD9BC7A77DAD0219BCC137B4845858B3E4AA2DEC5A0BFC312811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bf52e4eedd9e9efdb2799f1a833afad74c112ac01b4166108dd44ce69f7970e7
MD5 1d0e7e8b90f97076923a107401d6b919
SHA1 44abea45042b89d5f8374f91681d54592cc3933a
SHA512 d95e27d27ec33a6dad9bd823a960f992a8339a10b9ff6ab7bf399bf22cdc7b53e3c910fa12e9d82e4f724c6454977f79432c2dd648840bfdca62b25cdf89800f
SSDEEP 192:MONB64BAQmiUyX1qW5GBPKDv+FdGEIaD4+rU6:MONB6eAQkWAdlx4wU6
TLSH
T1A702E938AC697C7B9EA2AE45F58637175FE8113BE6D52F44E6E85B1C009764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1e2fc5aec53d0a0850589e6a18352053e01c000a58983d198b2dc0b78011dfac
MD5 04723c0b5dafe91e1463f54df1ac2b7f
SHA1 e855cb7f58eeb91e8227e3aaa752bc583fdf6d02
SHA512 faee98b4d1c0d89355b7f3638f48aad955866715b01bab72d220fbe956ce913a4303bd38399ae795e4a57a77755abd7d4c3543774d18c949fec7ddefc39f5ab3
SSDEEP 384:wZcIesNbH/sbRarPdlhCEJrD4m6HlytEDq1KCUR:Oewssb7hD4moy6DqUR
TLSH
T131928E3058B46D776AABB145F88A39135EF84037A7C46FD4B2EDEF2D01EA2A81307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 091549ba06871c3279e05d6943158e6dad28ff20338eb22474c70c362e4e7eb3
MD5 66a7cac56d287703c307d596f1102880
SHA1 b2425172a0c286aa4dac739acb48bb358d85398e
SHA512 ef99ea211f5f3b272d6141f8821ad59299287473ecec4b77ce3d159b46856b544ec16777ef62b0a4162b6a1b1198fb391ef813a27107c2bd2b7d358f0e66be41
SSDEEP 384:wZcIhsNbN/sb419PdlhCEJrD4m6HlytEDq1KCUR:OhysyZ7hD4moy6DqUR
TLSH
T110929E3058B45D776AA7B145F48A39139EF88037B7C86ED4B2EDEF2D01EA2A81307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 90dc7763169d7393c7f8c6a60dd26ead60f2c2a369f306c2b146d3f8a491a83f
MD5 8e2e969350e94c701c15ab38c95cdf9a
SHA1 bb3f3a25b1e87f6831869fd3d825e4157221455a
SHA512 2053364d5e40173e3f4974e9da26a0b06a8bf62e94b608ae9501db7729def58170119a542e07fad5267c74fa7f11a35ec63ff9cb2b418c734a5c9950e6c49bbb
SSDEEP 384:OiFiZcIkpsNl8TUNTUlIlv/sbh7rPdlhCEJrH4m6HlytEDq1KCUR:lFQuIwgpsVb7hH4moy6DqUR
TLSH
T1D4D23AF148E7993AE9AE6743E77D3D028DBCC023B5846994B3D89A1CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1345c5518f6f796064cb31251309887e016f14e0e2bd854ee0d168070377426
MD5 b4ea7374db92fb8433b1ab71b6367460
SHA1 6c59cad45616b53687fffb1a6d6de09095d752ac
SHA512 c1c3d0b25cbf9e7bf7cadf8f9c7a496fce6cae48a025b6a8f844f65be6cc08c6c999476f634e4f335d63b59332101edc8cccd5cd703a45f447abf9dcb8dce74a
SSDEEP 192:nJONe64BVQmiUybqf5GBPKDv+FdGE1VFC1SJr9Ww4Eq8U6:JONe6ezVfAdlhCEJrh4mU6
TLSH
T1C1122A35ACA4AC6B6E92B541F48736135EA8413BEAC57F90F6EC6F1C01EB79C1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c7432b5005d41b3a5985756ab614c9e38e0e37a259f61f88351217849cfc7e7e
MD5 5fd6abdf1033eb6a6e24131936386f9e
SHA1 e4dca6aaae5be56023b82cd1fb37b75c7ec7a027
SHA512 6974e320d9454f091c01724851923dc2fc956b1220d29eccad120b47424173182de4bd57242b3d2f69307c0ed37a2c43592afbe8fe695a542597b02854f64884
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe595162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595162.TMP
Size 392B
SHA256 d46afe3db14b198ff28a068f2e27032b2c1ef336cad9e11ee7bfc7d29299f222
MD5 c27d5eded7de96069340f2eb1ab3b1b4
SHA1 3c89bfc13a3898f6d345f2279267dee04c980fca
SHA512 c22498c97e9fe9b596528727505b2eaff1dcd567e7ef6cb585ee1f894b902d77c75e008a56143f2159d2171ab78a53276d32f2e5c55ef6df7c284c91d68bafc0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2d44a7decc9d5f3c36bc47eaafc095c2915da5a8e866f978137ea5d4a5f188cf
MD5 725586434aa5f74c62cdf7068804ca38
SHA1 f1509459ee28de7ed86468b13c39c6f808ae98c7
SHA512 26be3b955b5ccd8d1279b0afa37b33ef45eedd4d5fe60c8aa715e05a9d73c709fa4b7a02e6b08933f7278af3da07def2df9d50e5eb248d35d35ecd73a297ee0d
SSDEEP 3:MsEllllkEthXllkl2zE/l1ylllll:/M/xT02zVl/l
TLSH
T154440444FFD10407D50011304051C3F013F0F4704713574334510D735CC57510C0404D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d325b75ba9a13df579c3431fa513e08850c63ed7c053793a3c786c65dd1190c6
MD5 b0c32db7ed80b2c3e8e44087a01fcc7b
SHA1 835e374f81c96ac01c5e8960dd8655f97c6d0c9c
SHA512 b8792b4c8899f6a91db653b0c81ca6b8039fe1573235a479da6b270d02706a3a4138703eba7a49054268e6e681e0bd185a0d0b9b872c3ca3c8f36e2877f9adec
TLSH
T15441D898B6FA1148B3B76F56ABF6A86E447E7D772E06D45E00010D4F0622B01C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads