hxxp://WIZINK-2MF[.]PAGES[.]DEV

Analysis

user interaction
yes
max time kernel
98s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://WIZINK-2MF.PAGES.DEV
Sample260818-gldv6seq41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315060072440622"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{160FEDE5-3D76-46BE-95DF-EA9AE7D92B26}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1232	4720	msedge.exe	80
PID 4720 wrote to memory of 3968	4720	msedge.exe	81
PID 4720 wrote to memory of 3456	4720	msedge.exe	82
PID 4720 wrote to memory of 3968	4720	msedge.exe	81
PID 4720 wrote to memory of 3968	4720	msedge.exe	81
PID 4720 wrote to memory of 3920	4720	msedge.exe	83
PID 4720 wrote to memory of 3920	4720	msedge.exe	83
PID 4720 wrote to memory of 864	4720	msedge.exe	85
PID 4720 wrote to memory of 864	4720	msedge.exe	85
PID 4720 wrote to memory of 864	4720	msedge.exe	85
PID 4720 wrote to memory of 4844	4720	msedge.exe	86
PID 4720 wrote to memory of 4844	4720	msedge.exe	86
PID 4720 wrote to memory of 4844	4720	msedge.exe	86
PID 4720 wrote to memory of 4576	4720	msedge.exe	88
PID 4720 wrote to memory of 392	4720	msedge.exe	89
PID 4720 wrote to memory of 392	4720	msedge.exe	89
PID 4720 wrote to memory of 392	4720	msedge.exe	89
PID 4720 wrote to memory of 4112	4720	msedge.exe	91
PID 4720 wrote to memory of 4408	4720	msedge.exe	90
PID 4720 wrote to memory of 4576	4720	msedge.exe	88
PID 4720 wrote to memory of 4576	4720	msedge.exe	88
PID 4720 wrote to memory of 4112	4720	msedge.exe	91
PID 4720 wrote to memory of 4112	4720	msedge.exe	91
PID 4720 wrote to memory of 4408	4720	msedge.exe	90
PID 4720 wrote to memory of 4408	4720	msedge.exe	90
PID 4720 wrote to memory of 1092	4720	msedge.exe	93
PID 4720 wrote to memory of 1092	4720	msedge.exe	93
PID 4720 wrote to memory of 1092	4720	msedge.exe	93
PID 4720 wrote to memory of 1880	4720	msedge.exe	94
PID 4720 wrote to memory of 1880	4720	msedge.exe	94
PID 4720 wrote to memory of 3112	4720	msedge.exe	95
PID 4720 wrote to memory of 3112	4720	msedge.exe	95
PID 4720 wrote to memory of 4904	4720	msedge.exe	96
PID 4720 wrote to memory of 4536	4720	msedge.exe	98
PID 4904 wrote to memory of 2424	4904	msedge.exe	99
PID 4720 wrote to memory of 2864	4720	msedge.exe	100
PID 4720 wrote to memory of 4660	4720	msedge.exe	101
PID 4720 wrote to memory of 380	4720	msedge.exe	102
PID 4720 wrote to memory of 488	4720	msedge.exe	103
PID 4720 wrote to memory of 488	4720	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://WIZINK-2MF.PAGES.DEV
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x260,0x7ff993bfc188,0x7ff993bfc194,0x7ff993bfc1a0
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,15442232772541746590,15415637169827418487,262144 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12811791359389083094,15571016111303780700,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,17141764971652152815,3143398672123654077,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11075835177462671264,13328418576877089800,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13909260299143329029,17596968733314890753,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,12472712669265705264,1500696772873678964,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,8379014300484976935,2150416695963140681,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4180,i,17195394456388066289,8427152141730670027,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,3743592399984519445,14221774570257902530,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4932,i,3406259007701623141,17070319945600479237,2097152 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,3055530510698215624,17677558353119521608,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,16435620246291303356,4997553537385836832,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,3032787028851303156,7491688714575191403,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1605126184563549485,4464298435445244190,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1605126184563549485,4464298435445244190,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,10207127838984265490,785108555857331609,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,5466259685826669389,7431804057036767083,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,14282848204639729076,16577387408025483206,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1420004834588105417,17907085470040950349,524288 --field-trial-handle=2412,i,8822909611745735453,9257917313258506707,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 92bf00d7927ec3e20319c8815e8447c7cb3e967b4c9b83e0f6dca1c02b60b73d
MD5 32b7eb0f54fed37e99082748f1950962
SHA1 cc954c123296adbbc503f9d790291545eca24472
SHA512 02af2f0a107b756e7d4d9cdb9621e86e2f2ab0dbf3c6920ac7d7fade63d107e39f900e3a820f648d932f3808970158cc3547f4c79ae8350ba6762757771cdd3a
TLSH
T16871A2E549032B22F362013FE4E9CE38B175399919379D1B07384A31A2C6FD179C570A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 47a489ebf90b0b04830a68206292717a35186650cfe2cc095109f6f05e695739
MD5 2a30234b1919654b2b91c3bacfa5af4d
SHA1 1ed3b052b30c165fff499f2e1208843599ac6216
SHA512 e96a8c682331388843106f6bfbb6be27c97d1ae0a867c89ab736786d1d9c81cc0668fc3a0d9b6b8f04dd68976cd7d82d3a91450a9561978ac4262d637393d9a9
TLSH
T10371C4E50A432B62F3A6013FD4EDCE38B1B639A519378D1B07384671A2C6FD179C970A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c52996b73b4f02262cd8434554c49ccfa91a4bcbc4b3e49668e93abf2fabf3d0
MD5 c31d2b26df1e2a0c7a398ce7400833b5
SHA1 155b74820c5819d09222b3bfdba0a6d4460f5e8e
SHA512 dd5b62d6ac6c689a64564da399000e0e88778906150b3347e8510ecefa57fb26b67e641ab51b8ecb7b7d9407b61380d7867a6b0f6decf9caef25d99ae0c02073
TLSH
T19E51CBEBC2D4817DD92966F09A642D16CE790C5483583C19C5E8FF0FA7F2871E71158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b55a162a667c320841a7583c8d44907a6d1fb0aad61b03e66c18b24bd6c8611
MD5 f3807e27564db8911623add93613a4c0
SHA1 01e8e521c9c6702d70ccdbc9dbd27b95763fe463
SHA512 92b345194de64657614b45dbb7a4e900ea4dcc90148caff7e21b0822db744f964b7fe876af67188ce15c9c6414c2d6730ba9c99fdf83cb6938c8800bb7455d79
SSDEEP 192:sxZL/ywFvKOMl8MFc/fvsDGhzQIupFgAm/W6+WNBw0/Y0se03JIgrJ:sxZLqdc/fvsyz4yD/b9/509
TLSH
T17242D951AE34697B8CCBE309FA55BB53D7F5546292900E44AEFCCA1C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 4d68d43ac3c96c8fe0313b0a054b585a97fc5e21df22511b21d2679a20ff4f9c
MD5 cdb5925e6162ef82bf6df4b41a9e0cde
SHA1 cd96782cecb35324f39308452accffb090c5aefa
SHA512 f540f0a273a620e6d041875e8ee5ca1f246c21402d0d0c3729ad81139afef118d5499ac867c3d7364f00ca76a728f8212044ef28c6eb8e749614ca2da4252d44
SSDEEP 768:yD/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k6019VroNP:yD/Xh8dF27kWRmwcQDwu1jaKmjLpkD1U
TLSH
T119E21A3F280CCB7E4F844E5DEC26AF966EE801CBA6584D5447FA494C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ff07ce6e4ed85712d459426b25aa6263fe33d08efc81b2a4ffd2ce99e30c4db7
MD5 90210052f373269fdd0d6f18c0f9c484
SHA1 0f3218c7d084aacacec86a165246557620fcc70f
SHA512 956e17a75f2ed10ce3545c544fecea5643376047d7d744cdea05d35c02734a38d16b2c4e70c48240e9055d3012f846487448c958ca016d89a014becce248eaff
SSDEEP 48:KUL2LhLcLwL+LULULtDLILnLAICLYLtKtLMVL+LtBLmL9ILPLoL0LWyzju3DFNN5:KA1mKm4aSYgKtGGwwKZS2a
TLSH
T18E91311279B712023CBE6E0C8798976B4A4275637009A53B7FE851728D6BF501CFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b15e539-2c88-4cf7-9af4-9c40702ba069.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7b15e539-2c88-4cf7-9af4-9c40702ba069.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 93d863434f614b117fcf060e5900d775f3fceb987512a19ad5315a37dd01c503
MD5 3e4894d30cd138ebefa9012cd3fe3f5e
SHA1 3b5ad22ed656bf5111aee751517106d5c2d9aa72
SHA512 0c4c68b4b3fea28d7010955101addb444ca8db563f1c9d2ad97ababd74c165ecddbdd09e01700f3c8b3e5e7d90cb3cbf446a9b03e4df27ccdaabef90efe19fce
SSDEEP 384:d6ZcIh8NMM0bvXiHehr/E5J+YXNeySllYJTfY81FCa7Bup:d4h/jJ/ErLdeZuTH44Bup
TLSH
T176928D712C745CBBADABE655B44A36078FB8906BC3DD5F84D4FC2B1E01EA5E81317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a84861a9f74b279a567c1b0d0d9211898969fe4d4ce4ac0fb8cdc92f71087d2c
MD5 7971527630df917e9e0ca9b21bb4acdb
SHA1 50b59a68524503eee546bd17aac5950713b69aca
SHA512 9506a45489020e6ae75e1b98f1157355c6accbf4b029a3ff7f814cd42bee57a63273fe79240bb5d5794d6460f1462281484255fdb158bec528d8406f653ea7cd
SSDEEP 384:esg67FiZcIi8NE8TUNTUlIlX0bvXiHJhr/E5J+YX2eySllYJTfY81FCa7Bup:esVFQixwgm0J/ErLGeZuTH44Bup
TLSH
T16DD229F208D7887AD9AE9743A73D3D038EBCC067B2955A44B7D81A1DCD9A4BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2672d5e6750f920267bcb314f4f451edda2f35ba06e614a15f7670dd01bae36
MD5 09770ab481409c64a789f115d24aff0f
SHA1 f66d535f8cbf67813e0f31bb6b836fe550cce685
SHA512 b9248410320f92dba60a5615a343f60fae64b5bd433c8bbf0c84b9f0a70033fcc931e0d39b0ab4cd6c6886988fcdf8b24480abdc364e4907aa06be0c4ac00b64
SSDEEP 192:1GN46t6H3BQmiUykHBHC2Qq/rUH5mY+Ym6D9MNSU6:1GN46MXf3g2Qq/E5J+Y6wU6
TLSH
T17F02FA347CA8ACBB8DA3AE45F54777239F94216FE6D55F88D9E81B1C01DB68C1342823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 68d71d62aa2862cb8d4574d1e67ecf176e5808a88a431382a65fad6e350b76f2
MD5 3aec77a43d58d0c71b7a398ffeb6e824
SHA1 21ee386496dadea25a83105310f51c599bb064ff
SHA512 75801b699fa4c04cc394db937bf79ebd069d055be456df92f45754dba0329b086e7b504059cc2af6083f6e62f1eb024bfb70e70bbf5e1e185fd164e1e52ebf99
SSDEEP 192:yGNd6t6H3sQmiUyW0C2Tq/rUH5mY+YmMLYX1/9nRqzU6:yGNd6MX8j2Tq/E5J+YXEeU6
TLSH
T17312093568B8AC7B5D939A51F04736138F65116BEBC95F94E4EC2B1C05EF69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5becbac0ef6c04a813a3ae76def2b1e9c928b7d06fcdb0b06477d43efd82975a
MD5 43db97151882a0c7800136cc360d94a1
SHA1 8b68425b56a8aef0e729b85e42dd73dd027d5fd9
SHA512 6f603a4b8ae3f4b8cde3b3b2fd290b7da66a5464a54c275426a5865fc428b20dd7c2180db8b75080d811b3ee147ece684ff01708945ef467bb85b1ead48bcc02
SSDEEP 384:G6ZcIh8NMX0bvXiHehr/E5J+YXNeySllYJTfY81FCa7Bup:G4h8jJ/ErLdeZuTH44Bup
TLSH
T131928D711C745CBBADABE655B44A36038FB8906BC3DD5F84D4FC5B1E01EA5E81317822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7298132-9246-47f4-b49f-4f3615162f13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e7298132-9246-47f4-b49f-4f3615162f13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads