hxxps://rizzdeals[.]org/

Analysis

user interaction
yes
max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rizzdeals.org/
Sample260816-eepb8acn7t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313258939838546"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{88380F08-41AB-4E5B-9CD7-7F08650496D3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4392	5012	msedge.exe	85
PID 5012 wrote to memory of 4952	5012	msedge.exe	86
PID 5012 wrote to memory of 1112	5012	msedge.exe	87
PID 5012 wrote to memory of 1112	5012	msedge.exe	87
PID 5012 wrote to memory of 1112	5012	msedge.exe	87
PID 5012 wrote to memory of 3188	5012	msedge.exe	88
PID 5012 wrote to memory of 3188	5012	msedge.exe	88
PID 5012 wrote to memory of 2608	5012	msedge.exe	90
PID 5012 wrote to memory of 2608	5012	msedge.exe	90
PID 5012 wrote to memory of 2608	5012	msedge.exe	90
PID 5012 wrote to memory of 3708	5012	msedge.exe	91
PID 5012 wrote to memory of 3708	5012	msedge.exe	91
PID 5012 wrote to memory of 3708	5012	msedge.exe	91
PID 5012 wrote to memory of 5020	5012	msedge.exe	92
PID 5012 wrote to memory of 2736	5012	msedge.exe	93
PID 5012 wrote to memory of 5020	5012	msedge.exe	92
PID 5012 wrote to memory of 5020	5012	msedge.exe	92
PID 5012 wrote to memory of 2736	5012	msedge.exe	93
PID 5012 wrote to memory of 2736	5012	msedge.exe	93
PID 5012 wrote to memory of 812	5012	msedge.exe	98
PID 5012 wrote to memory of 888	5012	msedge.exe	99
PID 5012 wrote to memory of 812	5012	msedge.exe	98
PID 5012 wrote to memory of 888	5012	msedge.exe	99
PID 5012 wrote to memory of 1268	5012	msedge.exe	101
PID 5012 wrote to memory of 3872	5012	msedge.exe	109
PID 5012 wrote to memory of 3872	5012	msedge.exe	109
PID 5012 wrote to memory of 3872	5012	msedge.exe	109
PID 5012 wrote to memory of 2576	5012	msedge.exe	113
PID 5012 wrote to memory of 2576	5012	msedge.exe	113
PID 5012 wrote to memory of 2576	5012	msedge.exe	113
PID 5012 wrote to memory of 4712	5012	msedge.exe	116
PID 5012 wrote to memory of 5088	5012	msedge.exe	117
PID 5012 wrote to memory of 4744	5012	msedge.exe	118
PID 5012 wrote to memory of 2616	5012	msedge.exe	119
PID 5012 wrote to memory of 2616	5012	msedge.exe	119
PID 5012 wrote to memory of 2616	5012	msedge.exe	119
PID 5012 wrote to memory of 4532	5012	msedge.exe	121
PID 5012 wrote to memory of 4532	5012	msedge.exe	121
PID 5012 wrote to memory of 4532	5012	msedge.exe	121
PID 5012 wrote to memory of 560	5012	msedge.exe	122
PID 5012 wrote to memory of 560	5012	msedge.exe	122
PID 5012 wrote to memory of 560	5012	msedge.exe	122
PID 5012 wrote to memory of 3664	5012	msedge.exe	123
PID 5012 wrote to memory of 3664	5012	msedge.exe	123
PID 5012 wrote to memory of 3664	5012	msedge.exe	123
PID 5012 wrote to memory of 2576	5012	msedge.exe	124
PID 5012 wrote to memory of 2576	5012	msedge.exe	124
PID 5012 wrote to memory of 2576	5012	msedge.exe	124
PID 5012 wrote to memory of 2608	5012	msedge.exe	125
PID 5012 wrote to memory of 2608	5012	msedge.exe	125
PID 5012 wrote to memory of 2608	5012	msedge.exe	125
PID 5012 wrote to memory of 560	5012	msedge.exe	126
PID 5012 wrote to memory of 560	5012	msedge.exe	126
PID 5012 wrote to memory of 3612	5012	msedge.exe	127
PID 5012 wrote to memory of 3612	5012	msedge.exe	127
PID 5012 wrote to memory of 3612	5012	msedge.exe	127
PID 5012 wrote to memory of 5052	5012	msedge.exe	128
PID 5012 wrote to memory of 5052	5012	msedge.exe	128
PID 5012 wrote to memory of 5052	5012	msedge.exe	128
PID 5012 wrote to memory of 2576	5012	msedge.exe	129
PID 5012 wrote to memory of 2576	5012	msedge.exe	129
PID 5012 wrote to memory of 2576	5012	msedge.exe	129
PID 5012 wrote to memory of 2324	5012	msedge.exe	130
PID 5012 wrote to memory of 2324	5012	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rizzdeals.org/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9652dc188,0x7ff9652dc194,0x7ff9652dc1a0
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,10910452751444383173,18175220864219677204,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,1532700507058097463,13560735629810512506,262144 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,12506655203721177338,1771151365333461871,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16734432893366786429,2984756169947071888,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,10129163930625422979,1389195338474724427,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,7117243322221829176,10375181894365516494,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,7006584953639839993,10938913902822400731,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,7350415625862408473,7388033475522025416,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,11997093911717326302,16466847742528479959,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2270470731686863488,9601929464143148934,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2270470731686863488,9601929464143148934,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3632,i,12479526494049382805,18050280698549667746,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6212,i,16873221117588705510,14279217396342354976,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,12963263149425049601,14505074866760776001,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,15613011295081172674,3886655323029803512,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,13127173556856715702,676900257819170345,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2744,i,15944321124585656714,9039755069476114411,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3976,i,5280809282386108997,4505428659597689487,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5104,i,8865023095684920525,5442078384347858303,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6596,i,2972226581604956005,4915322783854495242,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6600,i,683490241170417461,15535348521286462113,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6536,i,217234836949716479,4117548610003924478,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2804,i,14831881107712416543,7487279037687970190,524288 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6624,i,9135267930373260807,378717766372263542,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6736,i,8878912325492523726,10880480761896186556,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6676,i,13983455388888115995,15557347275327144485,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6584,i,4413019543483911304,15935678137756568847,2097152 --field-trial-handle=2316,i,1011927101170876355,7853992741029910967,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 41ab18795513040b15e5ded7cc72e10c54f436b0d38204edb20cce163c102d99
MD5 b5c49780eeb521ec625b3481532af6e5
SHA1 92af1475898fb39d597812200fbe8824cb7cd908
SHA512 a5217604295fc1241df3d4ee9d69aea91941f864977e90b45d4548728eb2b8717a3fa52d8c14e24898525364a2d9844409fca6f1d7e3b9907708fc88b6ec4a78
TLSH
T19341FB7415E3150DEBA02A7A60F02E2239F64D453DEB7E1D4E0989B1364FB61874F268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 37429f307aa5aa04f8e057d6af704b30769f4251901e6a261f3d9786791de850
MD5 fe270557e65f8601ab5a63eb4b829c9a
SHA1 29ef80fa2de8df9e68c7739e31769b69f1b72080
SHA512 ec1d68a70e0ab2d574d4901f793f40ccf7856fb1da33554e9c3a82993b460500fd7f506e76913dbcbe726726c0191405b5e22422a61b68be9e469928f06bae34
TLSH
T190512CB414D3244DDBE1663A60B02E2279FB0D997DDBBE2D8E094CB1360FF51425B278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f9ab86454dce4376a3a981f0860f0f11fba3aa7feb8835904e427ad9f2947f3c
MD5 1512dd17d557826e43eec3267db2c99d
SHA1 7aaf84636139c58eec63bd9c3a27eb5a0e45ab34
SHA512 2b3829b0cfd157bbe806c771e50b94ac326b830e89a81c22c28ae6401f978ea2a513ac5339db0ab6ed2ec1329797a1f80e4687aaea96fcddc999f122c8873367
TLSH
T1AD410A7811E3140DEBA01B3A60F02E2639F94D957DE77E1D5D0889B4760FB91834F274
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dd2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dd2c.TMP
Size 1KB
SHA256 54fe4311b7ca10b6d33530a8c9fec4c628d8e74556c25889f953633f10d52815
MD5 6a0dd2b3006c047243621db41bcc2d9f
SHA1 abb41c32801401dbf5ffb6f684e2487f76d61600
SHA512 39e1656cefe86b8906792fcc2bbe638abafa068a23ce05a423217f850d35093d20dde7e574d5d3882f567f89cf4f11c661ba90dfcfb0ded7c1798f183916cfb9
TLSH
T12541C77826E3454DE3201B7BA4F02E1639F98D953EE36E1D5D4889753A4FB22831F278
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ce1c83a5a50bed12de4321926241e184506d4a1130b15fedafd377055597b396
MD5 1f0e3afd5ff1e5e247de419e91a2cdb4
SHA1 c25bbaa1af802ad89b23318147c24c345219b218
SHA512 2aa6408daba3e419798b4aa01df7d29280769b684e15278d0c29ebdf09dc852265d14601422f808248e02db501e659e977d4ec2cf165cab5522be03a6bc3844c
SSDEEP 192:D40uknFp04Xk61o+vlPwMy3DQNX/lGj2B2LDGBpGabjQnPCuARRrb7E3m:D40uknFm4Xk61o+vlPwf3DQNX/lGju2A
TLSH
T1D612CEF3C3E4862DD90256F4AB15AE2BCE1D1528432C3D26C9E9EF5B93E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e0e93b0ab0dbdc197a767c7e8b2d1e0a461cef11881397ba16efcd0c5e78be2c
MD5 e3f1ed5fe2426f20380883279c8f54f5
SHA1 dc4b206a891c86153ad8157976408459747c213f
SHA512 3d3022f9d3f33eb47ec30d5019ffbf0aaa449e531b5dac5ca21d641d0c4def099c336bb9051c75c92f49c55d7d2e4da16c017755f33f0b12853f19810f60f7fd
SSDEEP 192:sxZeRhyM/jK1Ml8Mkn/fHs9hWIkFIdpnRHW6+WNsec/Y9IaG1GIgrJ:sxZe7Mn/fHsfWI7RHbe/k9
TLSH
T1E052E6116A34A977CCDBE209FA55BF53D6F9547292900E44AAFCCA1C00E7EED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 42e4e377f01d2e58a92e366a31e19019b24234c98b04c7d1377c98b09812b349
MD5 f1d28fed64b9aa1702ac9b312a0cb011
SHA1 3e90f366ffb311eeadf87ddf4ef5ad65ebaa304a
SHA512 6f0f43bf0af5a6fda9cc5949689f12e1f9c3040adc16bbeb9ac4cad1994e4940fd0a7b18d8f3ebe7130cdc3837cd4e4052b71685c292891e310f1947a471b5b6
SSDEEP 192:sxZeRhyMojK1Ml8Mkn/fHsihWIkFIdpnRHW6+WNsn1LPXY9IacG1GIg5iEJ:sxZeOMn/fHsCWI7RHbyXdoI
TLSH
T15B52E7126A346977CCDBE209FA45BF53D6F9547292900E44AAFCC91C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4758bd7e79f285506674d47868f9a71d47ce165f6ee0371e6ef8b89d7385f1f3
MD5 233de07d498197160ca43d13d7ec1f31
SHA1 637c30e8e62a0104c77b5d7b7dfef7a4b53241ff
SHA512 6c7c152966193c605cb3f74204beec2b368a37700928252c5db93ad40af41f0dbdfba8b161ed2320b5304ed84613e96661897a88ed9077501aebeb85982db4ac
SSDEEP 768:6Xcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNproBg6+:6Xcv21wWvu+Z+u1jaeFLeRNCBO
TLSH
T1D8D20A2B280CCB7E4F841E9CED2A6F866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29680a72dc4d1cfd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\29680a72dc4d1cfd_0
Size 191KB
SHA256 9d57be05a1e15cc26a29f8213117faa191667a0c281d92cf6c085b8ab6db2bfc
MD5 70e1778b30f90c25f0b8541c1283fc2b
SHA1 9e35e264968f508e8457116783f646546cdc9117
SHA512 5011d97f2d87c7461c2b782f3f160e5fffd7e48a668b5658d51413b2b9af88eab7f1b70acda2673c01031cea12a5c36d67030b4eaff2248b0f126354bea2ea59
SSDEEP 1536:ko/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:ZSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T1D9146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 60ade6b12dc0d961de55eb25052b3acef6e06bc7010ea49d67e3878f010014f4
MD5 c8ecc0b2d5b1c2a2eb39883ae278656b
SHA1 65a445bc36541dfd33ca9a9d4902e6bfd1c7a272
SHA512 9dc35c867a10682b253107538bea1ed95c30cbbeb1d2136dbfd72f92cd8ccb7881de96470ddf6dbad5aa58372f0fb199e6a4274be4241dc94a825700f01a08c2
TLSH
T12CA00221BBD21D8AFC4043F725D207423715C9201321D713929A444A88729464D11054
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 eb655faafbd7d4940028910be915ab8733492874fcbf3668f63f0d3bc63234ab
MD5 3bfe9d6afd64907a59f63cbf618b0f70
SHA1 ddbf2af21c52e1b58f79f9a77fc729a2c42a833d
SHA512 0edb88dbc60ad19fa6d2a3c06089589645f170453456e057b6cfa9b7c0f6b635bbce73ef8af0f79e64fea46cbac51d1e71e1e3a368619c45209c091516e7e727
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDujeKEoeEmsKbSOeDmKoc+:mTtNlThr
TLSH
T1F1C11157B23707022D7D691CA3658A368F4635633818E5EF7BB900950E6AF221EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c94.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 eef47f32cf5bf038444b977ef7d347482319f48f3e675ee171f23db4533a15b9
MD5 3dffdf33e6bdf6099bacbb5297198db6
SHA1 570bd8db4800968cd0a4ae66ac1d9f03c87abc30
SHA512 f0fd2e40c716d9fea4cc691ce21db0df12262492692ebaa199cf6f8e0dab912fba7ac25d66e0b8fbc7d9713840cf08242d4b6c2c930a3f3b3e652b78cacb2ec5
SSDEEP 384:4ZcIhsNkf9YwzipYb4e+CnOhiJr432OOPrXLpe8C/nBj:Gh3pzbLvOhih4GOi9PMj
TLSH
T1CC929E7169785CA66DE6F681F48736079FF8A073F2C42B8095DCAB1C05DBA58131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d2c15816c4de153986182437d330016b1beb7d35e9f2cb0a0dc9597a332ba8a3
MD5 bc53e2b21a39ad495706999113ad8453
SHA1 1bb6387b44071ad3015e0a337fe8bf955b765a58
SHA512 245e4258da329e7f0d3803bcbfd2f6112cdf9c80d6d5ada136891c09267e8d931652a9a99834dcd52b4706d825fcc193bbd1221f6cdd6f7e45e91ef95ef73022
SSDEEP 384:ZiFiZcI2sNs8TUNTUlIlf9Ywzip1bJ2e+CnOhiJr/32OOPrXLpe8C/nBj:wFQ2hwgVpybJBvOhih/GOi9PMj
TLSH
T154A28E7259A89D7BBDF6AF81F5863603DFF85073D5816A90E6CC9E1C01DB598130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 aebfcdf3b6b7cca3340d5af5225bf6766c8d360f1172d12f51390b4919349c05
MD5 c2230d3c8bf264842a4c7731c1a5c510
SHA1 8bf4d3d2bf03ae850b30d50c441c975641f77eee
SHA512 f28725e6dc131cb77cc5c15e4ac58e60f433d5cd718753459de64aa0d57d1b5da154bb0fe64604230378c595b9f481d26916f6b3eb21c8b57a3fb88e7e0db8bf
SSDEEP 384:UZcIhsNkf9YwzipjbJ2e+CnOhiJr432OOPrXLpe8C/nBj:Sh3pobJBvOhih4GOi9PMj
TLSH
T1EF929D7169786CA66DE6F681F48736079FF8A073F2C42F8095DCAB1C05DBA58131B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a44343169843b31ba6d971c96765d5638a329ee8eef000d24be919dc1dbd3792
MD5 e75230c49f9432f3683f839e57a0e6a5
SHA1 2b2c0df1dfdd6ffec9d1f7905e1c7147bba3acf7
SHA512 54ba19960639516a8df9b82cc1b494bdca95b75a9c87b96e00b00c9b554494050dbfca95c30d768bc07531482881094274bd08982471b84ab109e36244ab24ed
SSDEEP 192:sONl6v+YLpQmiUyQVkh+CGKO1maXSJrYCH3rq5U6:sONl6vzblkh+CnOhiJr532U6
TLSH
T197122A3579785CBB5EA2A584F48736139EA86127EA463FC0C5DC3E1C02DFA9C230A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1aac033d4943863d7f8a2a7ef15482ea4c1e4f930e695a42054b34cac8347fd
MD5 dc233fa3cab3792a57f7ac557e8aa1bd
SHA1 89bc511b5ea55c88481cb1384405d4adf86debe9
SHA512 727815aff9e52d66cf7a4467603be1b332935746d3613669cde739c6c59bcba932eaacfb933ce343c4a93d535e428a15cc5fd9d43f7e43b4e42d4fb6431d7768
SSDEEP 192:JONo6v+YLNQmiUygVZh+CGKO1m1us3Kb2U6:JONo6vz/rZh+CnO83Y2U6
TLSH
T1EC02E9357D682CAB9FB2AE49F58737179FA8217BE6512F80D9D42F1C01D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 52b89e4886e2d8ee21a21122b27ea24507465af3327b4953208abb64f06a67e0
MD5 d9e80a063d53422dfe5d9a8519e877e0
SHA1 746010fc48f55042432acbbcd68a1e464e4ec121
SHA512 1423759bd73f2b119e522793c0f0b98128368f42b528b419644d5df1d26d82ee7c68ad232c787662ec6fc88ba5edd8a244d7de3b00ce3b0aebd168419c5903f6
TLSH
T1F1E00209D7158057C018033544E31B1479B2C1555353854557B4517C3C253406950645
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c6342c44b572efdbafb74e9335689e6bb7bd66d597ed919ba09ebc43fc936a41
MD5 98d3d8b05b8822d18d3169a95121c7dd
SHA1 a6121c0e0954be7fac2c94eb67cb36a21f4cc865
SHA512 175bea29ee5099c8a808a03eec99f5bd5e7ec10a0aa578439e194f0a541f2fd2c633f17f46fca60adfa4ba7db2267e2c166ca07846b2d971558e78d967a1a946
TLSH
T10FE00205D3154062C00803350093160429A2C0111293854556B051783C213402820A05
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 09d31f2cbdaf9ec4429661fa49f0bd57f47701f69d4a850fa2b02349a6358837
MD5 ef0039be47c43f8648039d130d35b862
SHA1 93b0b455fa1e69e0710b722f719542711a85506b
SHA512 7647ee62f2722b2d1575ff9d1c17242c1dccb6e3378b3ac871ac5f795378f0fbb5be428e5745e20bd5e162c6acb9f568f83864a61eb77a389ca06e36ffddfce2
TLSH
T118E00208D7158027C01C033584F717187BB1D1455393874753B451793C653406DA0A45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6fbaedd1e20ec415a38f929e815b0de5d7302f25e74b894125bd5aa38a6655fb
MD5 a829a272de897ad1826f0591420b7d1a
SHA1 1e7b99ec4c2fc34657912ef1f5e48b94ce72695d
SHA512 687fd66c7a8f7f3632989f2d398ef0ca236b05a453096f0c9992f6a3d044bd372ed1ddfa2d32d5124b47220bf56ed161c521eb501ae121b29476cad7f9bfe66c
TLSH
T151E00209E7168037D01C033584F71B287BB1E56563D3875757B451793C653406EB0E85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e73e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e73e.TMP
Size 392B
SHA256 bfe7135e0afbe2c1b3ea42058baf75f02a3582e9a9734069b9b069900ce8ba43
MD5 4b9811a76e48c15be005721821010cd3
SHA1 d4847d6485dc987d96a05c93c6b1daef2b198531
SHA512 4a2f2598da7261f10d1b7ca7a03dfe398f3b1a05ff274ebabfe921433e530e2feb92cd6dd2841706a757dbe048430dab427d5190f4413a80f8686afa6358e5fb
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 19b8e3430d8258685eaee1a7ab3f678c4a64d31cb10269a12a02f62b34d2cb3a
MD5 4078e6279a674229f983b2e346682b44
SHA1 d986edf04933bb0188f2a577afe72926506ec92c
SHA512 127aaacf32c05b36fd8685d8483f095e7b689f3b4b291bcb14115f014d45fac340392444e98dc7d27eb78e61f8f2b19648f19160fe00eaebe03a8ada80b7f6a6
TLSH
T116412999A6E91158B3B37F56AFF6A46D847FBC372E07D55E00120D8E0A22B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 3306150f50ef3f0844c362bf06c24461f1683250657ec7939d22ecca1a31ff02
MD5 dc10a710f93a93bf741dd62bfa4110e4
SHA1 885f2a0591d8a041c3ebdb43da73b022bb428154
SHA512 cfc00f044f95397633a98d3f512066ee259328b54269e134e1ff9f87167e4c6b6ea6e7e681b05563a99fb65132e7a3d7bb4892e3b1ea3f4158e373db602d9b71
SSDEEP 96:wUJ7qeu0wNeuFzJJDChuL8JJruDD5JJnIu0:HtljMJFChLJ5CJBIV
TLSH
T12102FF146BE61716F2FAE972E9B23B11BF37B91689049A0D4180420A1C63F05D97EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 11KB
SHA256 1033de393e196c433e36088fd73b7a5920177c99fac187e20ac9e08f21c7b103
MD5 972c02c02768ce2faa79e89950d0971e
SHA1 466d0afe074563f7b598cd87b18aa449ef1326c5
SHA512 d9dd305cb95c8b30d7db22835c14a37a8d84755141fd576a837ba1770c740aa6426282c88abe07141103a6bd7995bb802566d27a37f638cb5d6f15ba1d3537b0
SSDEEP 96:NKJJp7HKbaR6w4kqKJJ7qeu0wNeudzJJDChuz8JJruDr5JJnIu0:UJfHK+3Jtlj8JFChbJ5iJBIV
TLSH
T1E83210146BEA1612F2FBDD72EAB22711BF3BB81659049A0D4580820A0C73F45D97EF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 11KB
SHA256 04474cf0b8df92410275026ae0d608f52660d6105a7ef0ed5284463bfa4fb810
MD5 bde8929477aaf81ebb60172adb9be93d
SHA1 db26e9818bdbc7662f5e0d850bb4b717775308df
SHA512 c26468493a2683bd9e1fc551017c4f89a230ba9662ecbfee4cdd525c44444042cdb516a22a2b4701283675d9e7e650b1e763d3e24eaadbec619b4c5fc9edc5e2
SSDEEP 96:nKJJ7qeu0wNeu3KJJp7HKbaR6w4kQKJJ7qeu0wNeuc8JJruD15JJnIu0:KJtlj3JfHK+BJtljKJ5AJBIV
TLSH
T10C320F546BFA2612F2FBED72EAB13711AF37B81659049A0D4580820A0C73F05D97AF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads