hxxps://trk[.]mengotomars[.]com/ls/click?upn=u001[.]l3G3L-2BL-2FnMcKxFn6wpNcL-2F-2FAbAZAjkZ-2BbhTLtq9WFx6VCXfMn0PhmLF3Qr4olTVSI-2FUBl5-2BPXFpnEskVCz1WrF1RixFhnxRIgYwloLdF60BG-2BYQm89HNOR8ByL7HxRBXikVq8tcxXY-2FU78OjoPoFgKhFkD5oJkXhSZDh2XBhBREy04iyJYz79fSv0yU1eznXd8vlJSBo6BnkxszgmD-2F5xMJ3cNr1Xl0yHkt6tI4JxRK2fnrSJb11zPWgGcr3kvHWX4pL62zkZnMWPY64YxCabWsjiN15WnfTBEfjXiOiLhkCNRRRXvhst7WvFseojbRnidCfGWMulLfv31ALlvM-2BFw-3D-3DFJgh_XK-2B3ikvfraAT9pzcpVMILvvuY-2FbPeHqQA0Ezdm1o6raAGrIRVNB2NduIQbELy-2Fie-2F9cApGs51nb3-2BOKpDyZaMzMM-2FQ5CZo-2B9aaWm7jNb7DeNgdQZ5sSkSZvyfn-2BFijomH1gQoQDHpZxVf4yV2AvaQ-2F-2Bg1x-2F2ia7hqZLB756Xxfb6SOaRfl4kBNiurb524ki7niCSx-2FPXFOabcRmm2DOS74uhJTLfmuCZOGl59u0hkYC5bfTZ-2B15ItE-2FuRBziSelArJo8iY1sr075miRndaZJBXH1WZ0RFj9K9CkP12TJk8OH1wp4J14-2Fy6QofxRAP4Ml5djgMPHiv6pFLMp8c0eHOnVVunNWptD99b7xbsI-2B85gfPITwoMA4PggSkzFNMEgRuJUbIboBUf09wHz05kCCqZqKWhkzjCEfpB8s3AitjGP3CAF6N4binV0jnunKW-2FPAEtoY6v8ufE-2F02y7hoBR4aDES7cmYdFVLcLVmlMjXBP3kI5rufHQR0vQwsjAyB-2BVj8-2Ft-2BCdoQaIywIjO2IpLWZRWT8HM3ezRC0bt0UxtmkpgFrKN8-2FM5gUXogVBqR-2F2OOyB2zdKrFZ7CHBI6PDSbaBQ-3D-3D

Analysis

user interaction
yes
max time kernel
40s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://trk.mengotomars.com/ls/click?upn=u001.l3G3L-2BL-2FnMcKxFn6wpNcL-2F-2FAbAZAjkZ-2BbhTLtq9WFx6VCXfMn0PhmLF3Qr4olTVSI-2FUBl5-2BPXFpnEskVCz1WrF1RixFhnxRIgYwloLdF60BG-2BYQm89HNOR8ByL7HxRBXikVq8tcxXY-2FU78OjoPoFgKhFkD5oJkXhSZDh2XBhBREy04iyJYz79fSv0yU1eznXd8vlJSBo6BnkxszgmD-2F5xMJ3cNr1Xl0yHkt6tI4JxRK2fnrSJb11zPWgGcr3kvHWX4pL62zkZnMWPY64YxCabWsjiN15WnfTBEfjXiOiLhkCNRRRXvhst7WvFseojbRnidCfGWMulLfv31ALlvM-2BFw-3D-3DFJgh_XK-2B3ikvfraAT9pzcpVMILvvuY-2FbPeHqQA0Ezdm1o6raAGrIRVNB2NduIQbELy-2Fie-2F9cApGs51nb3-2BOKpDyZaMzMM-2FQ5CZo-2B9aaWm7jNb7DeNgdQZ5sSkSZvyfn-2BFijomH1gQoQDHpZxVf4yV2AvaQ-2F-2Bg1x-2F2ia7hqZLB756Xxfb6SOaRfl4kBNiurb524ki7niCSx-2FPXFOabcRmm2DOS74uhJTLfmuCZOGl59u0hkYC5bfTZ-2B15ItE-2FuRBziSelArJo8iY1sr075miRndaZJBXH1WZ0RFj9K9CkP12TJk8OH1wp4J14-2Fy6QofxRAP4Ml5djgMPHiv6pFLMp8c0eHOnVVunNWptD99b7xbsI-2B85gfPITwoMA4PggSkzFNMEgRuJUbIboBUf09wHz05kCCqZqKWhkzjCEfpB8s3AitjGP3CAF6N4binV0jnunKW-2FPAEtoY6v8ufE-2F02y7hoBR4aDES7cmYdFVLcLVmlMjXBP3kI5rufHQR0vQwsjAyB-2BVj8-2Ft-2BCdoQaIywIjO2IpLWZRWT8HM3ezRC0bt0UxtmkpgFrKN8-2FM5gUXogVBqR-2F2OOyB2zdKrFZ7CHBI6PDSbaBQ-3D-3D
Sample260811-xbpspayfra

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
161	api.ipify.org
162	api64.ipify.org
163	api64.ipify.org
165	api64.ipify.org
184	api.ipify.org
255	api.ipify.org
160	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2100	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309472710774558"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9D8772E3-2A2A-4E00-839C-26C7BFEF41E3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{FD14CECB-51D7-4112-BD42-0B209812092C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 544	2776	msedge.exe	84
PID 2776 wrote to memory of 2100	2776	msedge.exe	85
PID 2776 wrote to memory of 4784	2776	msedge.exe	86
PID 2776 wrote to memory of 4784	2776	msedge.exe	86
PID 2776 wrote to memory of 4784	2776	msedge.exe	86
PID 2776 wrote to memory of 1888	2776	msedge.exe	87
PID 2776 wrote to memory of 1888	2776	msedge.exe	87
PID 2776 wrote to memory of 932	2776	msedge.exe	88
PID 2776 wrote to memory of 932	2776	msedge.exe	88
PID 2776 wrote to memory of 932	2776	msedge.exe	88
PID 2776 wrote to memory of 2928	2776	msedge.exe	89
PID 2776 wrote to memory of 2928	2776	msedge.exe	89
PID 2776 wrote to memory of 2928	2776	msedge.exe	89
PID 2776 wrote to memory of 1164	2776	msedge.exe	91
PID 2776 wrote to memory of 3700	2776	msedge.exe	92
PID 2776 wrote to memory of 1164	2776	msedge.exe	91
PID 2776 wrote to memory of 1164	2776	msedge.exe	91
PID 2776 wrote to memory of 3700	2776	msedge.exe	92
PID 2776 wrote to memory of 3700	2776	msedge.exe	92
PID 2776 wrote to memory of 1044	2776	msedge.exe	96
PID 2776 wrote to memory of 1044	2776	msedge.exe	96
PID 2776 wrote to memory of 1044	2776	msedge.exe	96
PID 2776 wrote to memory of 2952	2776	msedge.exe	97
PID 2776 wrote to memory of 2952	2776	msedge.exe	97
PID 2776 wrote to memory of 2952	2776	msedge.exe	97
PID 2776 wrote to memory of 4756	2776	msedge.exe	98
PID 2776 wrote to memory of 2036	2776	msedge.exe	99
PID 2776 wrote to memory of 4756	2776	msedge.exe	98
PID 2776 wrote to memory of 2036	2776	msedge.exe	99
PID 2776 wrote to memory of 4736	2776	msedge.exe	101
PID 2776 wrote to memory of 1484	2776	msedge.exe	105
PID 2776 wrote to memory of 1884	2776	msedge.exe	104
PID 2776 wrote to memory of 1884	2776	msedge.exe	104
PID 2776 wrote to memory of 1076	2776	msedge.exe	106
PID 2776 wrote to memory of 1076	2776	msedge.exe	106
PID 2776 wrote to memory of 1076	2776	msedge.exe	106
PID 2776 wrote to memory of 4988	2776	msedge.exe	110
PID 2776 wrote to memory of 1452	2776	msedge.exe	111
PID 2776 wrote to memory of 1908	2776	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trk.mengotomars.com/ls/click?upn=u001.l3G3L-2BL-2FnMcKxFn6wpNcL-2F-2FAbAZAjkZ-2BbhTLtq9WFx6VCXfMn0PhmLF3Qr4olTVSI-2FUBl5-2BPXFpnEskVCz1WrF1RixFhnxRIgYwloLdF60BG-2BYQm89HNOR8ByL7HxRBXikVq8tcxXY-2FU78OjoPoFgKhFkD5oJkXhSZDh2XBhBREy04iyJYz79fSv0yU1eznXd8vlJSBo6BnkxszgmD-2F5xMJ3cNr1Xl0yHkt6tI4JxRK2fnrSJb11zPWgGcr3kvHWX4pL62zkZnMWPY64YxCabWsjiN15WnfTBEfjXiOiLhkCNRRRXvhst7WvFseojbRnidCfGWMulLfv31ALlvM-2BFw-3D-3DFJgh_XK-2B3ikvfraAT9pzcpVMILvvuY-2FbPeHqQA0Ezdm1o6raAGrIRVNB2NduIQbELy-2Fie-2F9cApGs51nb3-2BOKpDyZaMzMM-2FQ5CZo-2B9aaWm7jNb7DeNgdQZ5sSkSZvyfn-2BFijomH1gQoQDHpZxVf4yV2AvaQ-2F-2Bg1x-2F2ia7hqZLB756Xxfb6SOaRfl4kBNiurb524ki7niCSx-2FPXFOabcRmm2DOS74uhJTLfmuCZOGl59u0hkYC5bfTZ-2B15ItE-2FuRBziSelArJo8iY1sr075miRndaZJBXH1WZ0RFj9K9CkP12TJk8OH1wp4J14-2Fy6QofxRAP4Ml5djgMPHiv6pFLMp8c0eHOnVVunNWptD99b7xbsI-2B85gfPITwoMA4PggSkzFNMEgRuJUbIboBUf09wHz05kCCqZqKWhkzjCEfpB8s3AitjGP3CAF6N4binV0jnunKW-2FPAEtoY6v8ufE-2F02y7hoBR4aDES7cmYdFVLcLVmlMjXBP3kI5rufHQR0vQwsjAyB-2BVj8-2Ft-2BCdoQaIywIjO2IpLWZRWT8HM3ezRC0bt0UxtmkpgFrKN8-2FM5gUXogVBqR-2F2OOyB2zdKrFZ7CHBI6PDSbaBQ-3D-3D
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x264,0x7ff87066c188,0x7ff87066c194,0x7ff87066c1a0
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,12706820314303455550,18085535588890125945,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,9661597505394179900,8063432732461261109,262144 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,7027132179675034938,10194218062066969285,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4635046853981046921,10606175512731778157,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16326890093810048117,1245662949475893949,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,18252952439995142590,3746068132833583841,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14441774247405107834,896416233299748538,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4828,i,16111518743792491819,15408354173134856939,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5260,i,8635655402477401382,8374009029684664736,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,632281356835072033,9543958351948528339,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9112274024701528569,15114904045624182611,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16325666674691805594,17367292647687570400,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16325666674691805594,17367292647687570400,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,7227127171203190008,3095335152167623260,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,18436326385735782659,13736594086176874782,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7216,i,15742975719849351059,9505540194724850719,2097152 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,305611706336562924,15108170510008646692,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,12112123444437311908,18274069795380281791,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,3644494598716589275,10298098127660892066,524288 --field-trial-handle=276,i,15556401233167465884,3269880540657536362,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

6ee1a865-25b4-4219-a111-6a43b9b14eda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ee1a865-25b4-4219-a111-6a43b9b14eda.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mengotomars.com_0.indexeddb.leveldb\000003.log
Size 13KB
SHA256 f05b919e809764f63d5a373cbf4dde4af1dbbb7d41110ad1e8a849874866e28c
MD5 db8abcac9b75e44e5ddf318ae0928474
SHA1 f424b9a2e57028331c7151bcfe9e9dbeb232002b
SHA512 0bbe2154cb1617fc2cf877c462f0028dad75e66daa19cad902eabce3610d39a93f2ed123c7a1b40b728b8b1ab5843dc67914ba2f94f4f29c0708735ac2d82c53
SSDEEP 384:GzommUGAucu/bI9h59/nt65rK2DgNoDuRDNLDtVsDCk:/mmUGAucu/bI9h59/t65rK2DgNoDuRDo
TLSH
T12152D05B6AD48E27F96E55755AA20FD817777E8ABC82C14EE0C4F3BCC971A004D32262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mengotomars.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mengotomars.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 6961b909a78286f0a1ae1dafce89d346a6e2f1264c7b9f80afcdd28fabcc2b14
MD5 eb042d465ebf3eb7539401c452718e33
SHA1 d606f8d4e1d93c8ce1b2a5df13090cdc7f539f11
SHA512 b89de95006cb15cc6abee19aadf2096028de871266eaa8cbd26b57be64ff7e2713c459539d57924adb6409d99336236dfe7835cb7d691626695eefffce90b2a1
TLSH
T1FDE06868C0C9C22F591011E20C347B0BCAA7620EABC8BE4B5F61E8287082084F0AF250
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mengotomars.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d4c0d109ff1e98d8b5ad6295dbda9f59486b5476d65a141dd908c4233d208f95
MD5 6789012ed8fc1ce947d972d5c07d6917
SHA1 b96f2a18b255271da34c4608cffb9c4fe1a87c6a
SHA512 7b88a221e3cfe6ceb9b3893fe95ac6eefa6ceb0cb28e1ffc65fd34ccf39a60cd3ad9eb88050ec9c0198f64bb4142a1aa4b475b9339bdc87cb68cc11c3ba8562a
SSDEEP 192:sxZIRWyM/jK1Ml8Mkb/f4saUeyRV1IdparHW6+WNZws/Yv5fjpLIgrJ:sxZIMMb/f4saUeyyoHbd/kR9
TLSH
T1EA42F812AA346977CCDBD20DFA41BF53D6F5446292900E54AEFCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bae7ed8b5a19d15aa9f9cb8509d887217972a2d71fac89fa21419b6d9fbd480e
MD5 3ef643add4a5ed9ba44066e78c968c7d
SHA1 aeef6289106184c2c0ae3ead2fac82a708f596a4
SHA512 dfaf0bd0238075d7507ee182d0a7988ad00f1b1e93c8faaabc9d0cc61973cefe7bae016f87c9b872caf3376314d8af15cbe8d5b6b5d442d6a8de64532d066ed5
SSDEEP 192:sxZIRWyM/jK1Ml8Mkb/f4sA9eyBV1IdparHW6+WNZzIbZYviMdjpLIg5wJ:sxZIMMb/f4sA9eyioHbGZYRK
TLSH
T15052E711AA34AD77CCDBD20DFA41BF53D6F5446292940E44AAFCDA1C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 61e00289a8d1b5d1e1a8a8bfa572b4bb669b60d50378e6a675f4c0ddbe4f657b
MD5 5ba0d119bde1a1c95d8ae5fb06b4815b
SHA1 15429026e6856698d85b2590a218cbdee9fe9cfe
SHA512 e297fefd3ac877024a49730472be6ff0e89ba8216b9bfe5724de684d5aee1029deb78c4d4fbb619f593acaf06f98cb90d2fde46400ee6c7f6419a1a9f23191a7
SSDEEP 768:CYseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pplroTk:CYseJ3xWvhfynu1jaVcL88peg
TLSH
T157D20B2B280CCB7E4F844E6DEC2A6F966EE801CB57984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\8362bf92-8343-4926-aed0-f8f0c24d24e1\index-dir\the-real-index
Size 72B
SHA256 10802def9569998b7a0df9e4c4d7cd8532086cdc48037d39ce5d1f2b81f59e19
MD5 5d3e7090967c6bc16ede3fe2adac2d19
SHA1 021524d0b4144589eeaf88c05e5a161915b20e9f
SHA512 33b66fe6505b0ae8fdbda144b9de5c2826e98b489979c7f97a986029205f6cdc7897c97624082af23c3412bc1f1b46e0fb8d455235e792fd3dc51664dcf62948
TLSH
T12FA0022402C40C02D90646B25141026273A649641342C347C0E0488DDC967D05192051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\8362bf92-8343-4926-aed0-f8f0c24d24e1\index-dir\the-real-index~RFe586c32.TMP
Size 48B
SHA256 56700aa8dc9a3dfff1a5f0cd1313733d40d13776735a58158b68f62c134e6e50
MD5 c7c2732e6230fab943eddef01de7e634
SHA1 e78d3d76dd5cb5fb296a6a81ccf904e553884d41
SHA512 18f455d7455f9317df213f116f2e686f8dfdc5126cadc264056145deec1e5fbcca7e52caedd3ce344aa34c861c113aedfc23ff6db25ff5b497178f128c7dc00d
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\97b9e92c-5b95-4a0e-acf5-205cae5c43de\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\97b9e92c-5b95-4a0e-acf5-205cae5c43de\index-dir\the-real-index
Size 72B
SHA256 9d566a7b606059961d1924a584723164e9d86c4090d136492fc137133ac29719
MD5 e231041e13a3e7e032f1365d27571ab6
SHA1 a8a09394137acd8df8d3e9c4250a1a135094e133
SHA512 b744d16638a9df2df868e787282f1c9708d2b33ae3495e6e15bcf073fa9915417395cd84e253eb229d965411d40e8f7242ac03c962555a511b0331082b7da2c7
TLSH
T167A0022002C81C09EA130A7650517A50335449508501E353C994169D9C966D242C6445
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\97b9e92c-5b95-4a0e-acf5-205cae5c43de\index-dir\the-real-index~RFe586c80.TMP
Size 48B
SHA256 437f0ab60b4dd80cd2094ad8e600829968507b3e756eeb6b537075e0da8203e2
MD5 c49c47c70685c4e265c7729348993650
SHA1 c706dd8643f10465b37cea8cc9764125977e93e2
SHA512 c2839c60dce91971a47743238d28c270082c3db849bdb35ac3b7e967428ded8eea53fcc195f132d04f653e50bc6b27c9590259c0aefdf5922dce3de121cc2b65
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\ceb73768-31fa-49ab-b990-a9a0fa4ea330\index-dir\the-real-index
Size 72B
SHA256 c709d7e0d91e95ca961e6dbb8091e02eef26f306b8abd2fe6c75d3f5e694a16e
MD5 fd7b74aa66d012ab5ac584a2aae6589e
SHA1 749e7cb1b8df01fb564ada034b4fcfc59147c543
SHA512 aeab40c38a65bfb1056ca4dc92e7a97106a9120b7625f27a6258e798a5b8d89f2aa73aa692795d6e5bcc5ae653b095214ec2d60c82c560a1a3800fcfde15c3a2
TLSH
T10CA0026247400103C001977150EA01957375C9211B235305C4D0426C8DD0790A691256
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587172.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\ceb73768-31fa-49ab-b990-a9a0fa4ea330\index-dir\the-real-index~RFe587172.TMP
Size 48B
SHA256 426f9402fe7489ab872717238e7dad3d1cdec7a52bc24fc3f47a3a760f24e277
MD5 28385c3587d4737f7fe8eee2c0271774
SHA1 c4087ecd1d899e7dfaa28439a4fe319294818000
SHA512 e8806e0f3119c363b0c121cbe20ae8dd8421bfdd7dda6fc2de05358d30233530bfdbd48430c71d39b15518695d57985774343fb97d6245a16ae4570aa1d0b294
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 275B
SHA256 0ed0f509671150ce518e03db34070a697bee7958919a0af69b043c8dd92322a9
MD5 02081fde757bde1aa755573d409dd6bb
SHA1 c10ed23ec38dc5b7aafd00fb760ce1ff3b9554cf
SHA512 61855f6e1bc99d8268d3cf7f4b388ec2834ade39f4e0a13ee7cfcaa9c90ecf0922324b81eb731cde4679bce5a1a254fda735196f6745531354b88856052d2ff4
TLSH
T15DD02BCB819107E33A7D02849E70794EC9537EC25DE0EBCE292030695830462D312936
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 416B
SHA256 b434042797f8a5fb9681f58556ba1a3c2bd0a52b64c8febfd5cb322f8985cfcf
MD5 79649c59391077aef1335b16d7617e43
SHA1 9fc2c316d0eea11a510a1469dd932acea8869ddc
SHA512 f453b54dca8b6626f46a4fd508a5071ba317a8b83126e0e270bd213a95804612fc65af876e682ab8d356f13e34db6bed63be581801ce64f6b9d67deb091b8779
TLSH
T1A7E02B9791E05AE63BBD8B4469F0A98BC9477ED36DA4EFCD3520702C1C30556C212972
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 497B
SHA256 93bac19b65c50490c8c6c5bf8244db4c500ae9fdb17a362b3ee5b7dbac993821
MD5 478cc69093489bf4f55ed059ef4d66a0
SHA1 df5d7ff09010792b6b74affb8b57d6099e388e29
SHA512 1a7fbc522dff54fbc554ed7b0e75c29e6832c4d107347e9fba40590e5397b910d182ab1a0dea72b028c0259ffb5670b0932b230e68b16c80c842991027acb52f
TLSH
T1BFF09E9691D05AE67AFD4B44A9F07987E5427DC35D90EF8E256030290C70751D212AB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 620B
SHA256 6ccbcef38e67d0a3c44dd7e07ef63d5743e983171e07d025f7d9ee0b1af00b37
MD5 e3dc5144fbb4c81e19737b6154f54a05
SHA1 bf10e6257349141b845c89caa7ea86cfee8e7166
SHA512 c05c57a0d87b9e37f11c564abf40ccdd6cdbe8244852ac37bab77da355e0ac76a8c6c50077e4d5e918634deedf4b56a84b2eff4555f680d5a00d7814638598c9
TLSH
T177F0419691C14BF67EBD8B0094F07A8B8582BEC30DA0EE8D2660302C4C30791C122AF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 688B
SHA256 cf4107451bb4c29473dc320ab219b0c20940cebd6ef4d3b919d1df81ed2c1fb1
MD5 8f8d0421fb836028bc1223a44459bab3
SHA1 18782129852a8c57a501af5f535ca973de391099
SHA512 45bd33260f171aae78a5c7738e67b2ac255371a9e1fc9473f79e61f06e551209500f6e719bf3f9b3abdc917842983e0dda96da8d96173cf1efb60c32c137f2de
TLSH
T15101838190C10BF6797D8B04A5F03A8B96927EC30C60DE8E1120741C4C747A1C126BF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 784B
SHA256 ed5e95c9ea7cf3f86d44df558d0b8105d6a0658de3a8ab6eec9d8542f44ea7a7
MD5 f07778ebf77a42244b10e6e4df5cef49
SHA1 7f8e18212bb324702fd6c361416dcf5ee95f640e
SHA512 394af45f51b64289f46d44c99803392d6ff517162ed39578a68b4f5a2e3638d163def2d5c7e990a35cc2cbead270eedb92438ee14561b617ca96629156d9d961
TLSH
T1B4016581A2C20BE53EFE8B08A9F43E9796417EC30C62DE4E5120341C8C706E1C5229F2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt
Size 777B
SHA256 3a814d4b13b1af813eff0786340f2c3a6dbf6502ab8ad0fd5d1b201e5e7c61f4
MD5 f6c5aa6682f3bbc0a3d2e48953fa9384
SHA1 87cba0dae9605024a5f0dfd6b835db8a23b339c3
SHA512 b669603b67f3a63740ab76623cc7cbb540459c56382c2c37a5e57ddde635fdb5f2f9549c090af6ac1c27622b988059e99854e04efc96c4edfba19fda45dfff26
TLSH
T199016581A2C24BE53DFE8F08A9F43E9796417EC30C62DE4E5120202C4C70AF1C5239F2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe581d76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0c5f6e001cc8b80e2b88da3336ae034ab150f718\index.txt~RFe581d76.TMP
Size 195B
SHA256 67fc539aaf586184cf72e890aa973f8be8da9b3e60a48f65fd5ed284fed4fe59
MD5 024b7286fd01836fba92e3320f2234a5
SHA1 d4b1c834b89cefccb7694bad3b13a164acc66140
SHA512 0c89fbe6a60628c998f16c7dd28a5cf5998981a714b55d13c3f0d1265a9e348a5b6fc99106167e2cd8f714dac2f1131d7b9109bcdd922b016daaa9e5e53fe374
TLSH
T1E2D022D702D007D63F2802008CB02586C61BBEC2AEE09FCF1920304818308A3D216A38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 70c6229ebdc48bd0dded4396a1a9dc4df6ffebb855189b8be3bb17f4fc421da4
MD5 00e44edb44c388ec04f7fdc252240331
SHA1 eb2df8286d6641f0d1cd81220e35c0f3a1259bec
SHA512 221d20162f7e9a1943d05440f7cee8f370dc4b96a5dee1b6210afef9e99080815dc9010740e03aeeebb0f8a4650a5e3709470fbbd6917f38a7957f3091cbf1e9
TLSH
T1DAA0022212A905C1E8450371AA4501DA2611A814C1159671A4B41C988955154861A014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5872f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5872f9.TMP
Size 48B
SHA256 519227f0aa2254413230a9a900ae34780b63f7be5b7089da27a516a5d6781348
MD5 57a27773727d150258b2212da6e751c2
SHA1 2399fc7255a418f2948111c8fce4a46e4cc02e7c
SHA512 effc9d00dec8722ec9a95a7cb695c5c432e548a2423bd1fe3e486e57f5525e5280cf7a5c067581c266223a6224963c3a003cf5bd88dbfe12d4f6dcdbb9a4dac9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f4e6815848caf1c95f05e5ebbc5cfa7a518530c81243820a8f25cdfe4263f922
MD5 565ce27e4e34ba40599dda7f7627e632
SHA1 cdedd6e5110c565e775bca4d4f89b656ad911fae
SHA512 d056e6e381b13793dc65168b9e06bc3ebf12ebfd0cf5837a07190369880e6fb5de913c32129e64d6f0ceb2a0cce075f63fa3b9d9660f7f72d3909093907cc1bf
SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrn88F+i8u+ZXSv01qZKNw1MZpUM3O:49zT1J3
TLSH
T162A17212757E02023C7F244DA2AA96378E4131B730A9B56F7FB808564EA7E112DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e8714660f6850587e0b38cabbdb0b0441cb85f58b600bb7e24e41e9b5ee3685f
MD5 4282206c99771fc3ebe050662e66fc10
SHA1 fdbf9ad40789ec97260d4445f55e9a185461a944
SHA512 b8dd76601eac6508d268b42102ef9c642a02874a7863b74cd9e05f069aa00380610192db517557d4ed6e377ab42c9eaaa86339251256d291ac4fdedaef5ba715
SSDEEP 192:uTzm+xasuheOwQxMGsNBs9nqQ/k8vK8M7tYbQmiU1vcK4MTxQClqyNL8z1CqJlUN:nZcIhsNBs5ql++72NWVIlvoJle
TLSH
T1B8627B72AC749D7AAAA7E242F48A32135FF49067A2C45B50F6ED7F0C00DA568130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14077251d2006b1efc95752d600d934e1fdbf53c371b081d59e85a54acbbfcc6
MD5 ec20264ea4fab7c54a4e3a5305aa5947
SHA1 faba1d32c10fa7a23a188a80324cb5373180137f
SHA512 4e7910e144d4263d69b15dd04fb165bf4bbee937576c2b63eb54ce89856216e77e342f7be09efc3a80ea021deab6f35f465e7cad9da1cc09ff1e2423290d8f93
SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop5T4ODTqBjPYvlCr5pgz6qNGemL57:lONP6vMtPQmiUyleThTxQClT847nLU/u
TLSH
T17F02F735AC686CBBEAA7AD45F58A23172FF0616BA5D05B50EAE83F1C00D765C1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 37d4791e01931bb2324ca2e02768b9c1d6a1b7aed03a797ecd734bf7a444a085
MD5 5384a6a2021475a2a65fb43c8bba6801
SHA1 c636c7aad4d1692c237be695e9254e836a0c2d53
SHA512 9fc0117b4c2e0a2321780210cfba55c99ea89f4a7170c98006533073d7facc8e4e88ab443f803519555694c05d5345440f85ddbb752ca873762f6c3ed78a7433
SSDEEP 192:uvzm+xasuheOwQxMGsNBh9nqQ/k8vK8M7tYbQmiU1vcK4MTxQClqyNL8z1CqJlUN:nZcIhsNBh5ql++72NWVIlvoJle
TLSH
T142626B72AC749D7AAAA7F242F48A32135FF49027A2C45F50F6ED7F0D00DA568130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 41fb8d7687cdee9882bbbb731eb0c4406ab3840b2351db3fbcaf26abf26305d3
MD5 82525dabcb633c1dbc7d6821796c2fa0
SHA1 afc85286f74cf77df2ddc4c1f0b95f275b238dd4
SHA512 f61347e972524eb09c9e3dea6f9bf7ed6f6039ea2f5780b53fc7dc82b9e4763892805572ad3df81cbcd7ff0b67a733a0e1ede967ea6f02b22f72ddef4576f934
SSDEEP 192:uJONc6vMSPQmiUyQenhTxQClqyN+80ICqJU/u:EONc6USRMnblvXJU/u
TLSH
T1CE121A72ACA89C6BAE93B581F48A32175EB0926BE6C45F50FADC3F1C01DB55C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bf2352fad6bae1751138c387f63da062658a425f00d01ef24140869b1a3905a4
MD5 7ff98f3c39b36e73d2aa30137246304d
SHA1 296cac909c73d9accb0dbad609f6f3d1941656e9
SHA512 7e7d4b20fb6bd3e5bdc94d445587240a2db0740ad7c0f213899d73ee5ee28d97be0195ca401c32ff6784c4e157d82214d7142d7991cba93ee0ab2b5fc91f4cc2
TLSH
T15841285CB7E9015CB3B76E5A9BF7A86D487BBD372E0AD09E00110D4F0A62B40C962733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads