hxxps://calendly[.]com/scrollnext/30min

Analysis

user interaction
yes
max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://calendly.com/scrollnext/30min
Sample260819-xq8jca1dpd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316398929322635"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{C0AC31C1-C5E0-4E4D-B755-0037CB98ED47}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2376	3424	msedge.exe	86
PID 3424 wrote to memory of 5044	3424	msedge.exe	87
PID 3424 wrote to memory of 3088	3424	msedge.exe	88
PID 3424 wrote to memory of 3088	3424	msedge.exe	88
PID 3424 wrote to memory of 3088	3424	msedge.exe	88
PID 3424 wrote to memory of 1272	3424	msedge.exe	89
PID 3424 wrote to memory of 1272	3424	msedge.exe	89
PID 3424 wrote to memory of 2968	3424	msedge.exe	90
PID 3424 wrote to memory of 976	3424	msedge.exe	91
PID 3424 wrote to memory of 2968	3424	msedge.exe	90
PID 3424 wrote to memory of 2968	3424	msedge.exe	90
PID 3424 wrote to memory of 976	3424	msedge.exe	91
PID 3424 wrote to memory of 976	3424	msedge.exe	91
PID 3424 wrote to memory of 4012	3424	msedge.exe	93
PID 3424 wrote to memory of 4200	3424	msedge.exe	94
PID 3424 wrote to memory of 4012	3424	msedge.exe	93
PID 3424 wrote to memory of 4012	3424	msedge.exe	93
PID 3424 wrote to memory of 4200	3424	msedge.exe	94
PID 3424 wrote to memory of 4200	3424	msedge.exe	94
PID 3424 wrote to memory of 3972	3424	msedge.exe	98
PID 3424 wrote to memory of 1868	3424	msedge.exe	99
PID 3424 wrote to memory of 3972	3424	msedge.exe	98
PID 3424 wrote to memory of 1868	3424	msedge.exe	99
PID 3424 wrote to memory of 3324	3424	msedge.exe	101
PID 3424 wrote to memory of 3248	3424	msedge.exe	102
PID 3424 wrote to memory of 3248	3424	msedge.exe	102
PID 3424 wrote to memory of 3248	3424	msedge.exe	102
PID 3424 wrote to memory of 3508	3424	msedge.exe	104
PID 3424 wrote to memory of 3508	3424	msedge.exe	104
PID 3424 wrote to memory of 3508	3424	msedge.exe	104
PID 3424 wrote to memory of 4996	3424	msedge.exe	105
PID 3424 wrote to memory of 4996	3424	msedge.exe	105
PID 3424 wrote to memory of 4996	3424	msedge.exe	105
PID 3424 wrote to memory of 3336	3424	msedge.exe	114
PID 3424 wrote to memory of 2184	3424	msedge.exe	115
PID 3424 wrote to memory of 3804	3424	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://calendly.com/scrollnext/30min
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff0f64c188,0x7fff0f64c194,0x7fff0f64c1a0
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,4261696340182815573,17012692203770370142,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,3016182107886238090,5771304597418342911,262144 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,14461079554520518242,10735403417074313245,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,12708445822924547863,6296126967457229554,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,2181644743656414166,2048258169816043641,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,10540118453981993252,14685826834937522267,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,11763913235633327382,13695076621925088067,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12143231358283998989,6096017558118478288,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,702165435739216592,5002247023852776965,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,821380839681970754,3034272912536122411,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,821380839681970754,3034272912536122411,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5816,i,341233701321344540,12490820283874995519,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6584,i,18227119638225218556,10527234213748257718,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6476,i,14577372329343076909,7493288157166546521,2097152 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,5200091223650017720,10116440331961179627,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,4043211722744460806,10313802178208307263,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,10742028201090423149,9823130339631786753,524288 --field-trial-handle=2552,i,12478988605500909461,1500834901180777806,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44ad41f86fc5dfdef9271828918ef29a810e56b8958f687546cd2d840b9240aa
MD5 a5cac29eea53b9fcab74bee9fa34b5ae
SHA1 f8ce725ee9f0504c0c06499e9e661e57b450faea
SHA512 b9b4caa28d7e2513df4fe005dbaadbee5271cc930e71893250588b597acfb3d61d0eac54efc7443d690048513be0217cff1f84fceb1bc7dbb7a69e098a92df54
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1B0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 348842740f0074106de205936670bccfe88e2b39507875d33bf2ac5de99f0c79
MD5 658f96fe8b2ff6ddbbb902658bdc2804
SHA1 ad667c63273752ce91283c54b2deedc23585fab9
SHA512 81af82499e29aad4317a95cd01d806aa137494e7cedb69341484be954092cc68adca99a297b0d610fdb35cc7463d2ace1f19879d8ee5cf1dff4bebc27eaaaa58
SSDEEP 96:7lHgeExNK96nMC3Cgoj/1hqP/wB9mwGJJhHmBm/BMIZZ9/0nTH6otcHksf3HFd1c:7lHgeExNK96MC3Cgoj/1hqP/wB9zGJJa
TLSH
T1C791637026B6C7B1D7A90AB15DC72FDC3AB14CFAF50B2E933CC098BA9665B110A45147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58916d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58916d.TMP
Size 3KB
SHA256 eab7f3e8a591a3459e3337cfd2c5768b3d156967843d520aa13e36914d60d184
MD5 0e495a5cc6b04b6fda481a76c5eaa38a
SHA1 8f9540a63006df383c9df94e296f65f0d996b925
SHA512 9c1db1f5ed13249c5f6f14eb2fc896e44f605dda6fab52dc2962ed53dd7668ccad1f6f772288c10c37c67eccae01bc543258af8956846233bb4625f491898032
TLSH
T1437128340572C3B0E7AA02B19DD72FCD34724CF9F51F6E933890C8B6A6A8F144645147
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_calendly.com_0.indexeddb.leveldb\LOG.old
Size 347B
SHA256 acadad78aea211e170594725768bb5858e48869b14aa79b41910a7180709e030
MD5 4c616d99aa24e8a507794fae36e5896e
SHA1 3b1e61763366bdb8af709f15527e9203e9004019
SHA512 0c88d97a8ad8a378f852e4fcb1ea6a7dd23c356b8acb8746f7cd7ea993728ff4d5a1d46db59f3600b03fac89f9bf926f9eead148a060aadadf6402795e290979
TLSH
T1A4E0D87C84C9C2BF965450A725347B4FD6B36F0ED68DBD471F44DD447486044E4BE161
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 999167a12f5b969acb62374f0951324633e84bcdf73dfd5e3827e8d21041b211
MD5 0d45f7e79e9b1550fa6836be5be7fea4
SHA1 201329b78eab0b48945163499e566360cc564a02
SHA512 509e2a08966d14ac1d3e9e9805964105e98a8e38dcf21226302f03fd82326b987900a8ade3f77758110be0c329a7711297e1024e709dce0abe51e715caa696bd
SSDEEP 192:sxZ1R4yM/jK1Ml8Mk2/fosPCLIdpOTHW6+WNd+1/YCKNQ/fIgrJ:sxZ1eM2/fosPCUgHbm/pX9
TLSH
T18B52D7116A34A9B7CCDBD209B9517F93D6F9097392901D84A9FCCA1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 072cda732eaae461d8d920117fd40c08f13003ea07c3838ed177ef10d657235a
MD5 9ea31b028efb074a7cea3a772379d5c6
SHA1 1c4830cf20ff0a563a6813a64ae22f56ae60f776
SHA512 b65a6303eb343f515df4446b619e6ba18452280154e0fef64f2c44710dda17cddc450477a1e9c64694f30e8d0e0d838af669465611cb6db4b7200b5ea97f2859
SSDEEP 192:sxZ1R4yM/jK1Ml8Mk2/fosR4LIdpOTHW6+WNdncZYCtNQ/fIg5+J:sxZ1mM2/fosR4UgHb6Z4X8
TLSH
T16452E8156A3469B7CCDBE209BA417F93D6F5147392941E84A9FCCA1C00E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 566ba9f59df3db6707616197818503e41403b036c97a8595c5d6a8b9b188f766
MD5 0f8a45c224ea2e189d4e8641dd930823
SHA1 fd410796dd999a03883382dff91188a0f66167cb
SHA512 70d497fdbb520b246edc2ef0c56910261cb2d202314410639e61f0fb239086735595f5ba9cf3dfde328ae5576404075af57c4bdbe4938d1d7d924f7a9bd9f131
SSDEEP 768:u78bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVpro9:u78bqn+WvSC36u1jaCZLbWVC9
TLSH
T1E9E20B3B280CCB7E4F845E5DDC26AF962ED801CB67988D4447FA894C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 640469d6fdfc31dc4374fcae027e770251a415123261c76fcba75c3281158237
MD5 28ffe5256b2e83472be4cf9f4879bce3
SHA1 53b4f284f0c5498ab247f80e5461a85306aec7a7
SHA512 c997431a17af4c8f99754f0322b20fb07548f57d993a43c8c201f0a6c586f3c15e160faa7ebbea676a43f3ba85f6a6d8c8fc8e9b543bfc8c929ce5c6030aff3b
SSDEEP 24:Kdof/sdaCdK6W4KG+dIjAWKi1haeW1EoGSmcMl8gHyXYgfH0laKdyyO4i++VIjo2:KwZIFKCwwPyNlIpKuEsquIXK/qQ/ys
TLSH
T152918411353E02423CBE390CA1B9C927CD4275B73419E97F776852925BABE112DBD9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a9210780cb70ff09e3667162658370c55c5f51280f8a58789e42272c3a6f8bf6
MD5 52d29edaa90b34b41bdae984b16d9dc6
SHA1 0c56e1559fe68532f3510331497bd767127b953f
SHA512 8739abbf4a3f678ab99e9a249fa0526b099c907a0f1aa55ff6584d864e3c9e2d1b54abc47303c90499bfa3f9673068f2b906fa2748db40d6340f9774d192c9ad
SSDEEP 192:u2LsNfgQv8hYbiHTQmiU1+ZM4Ea+jcOmiR67+2MamTqwPH:TsNfgVhVlcDEa+wOS7+2s/P
TLSH
T1C342093568789C775DA66584F44B3613AFF840678A8A7F90DADD5F0C01DF2AC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c13ec024014ba980bcd397c6a7d4180d9bda52557fed04fbc56e8238c1ecb92
MD5 9deec74c64126ab6db76dfa873700144
SHA1 206545813d8cf53c5d9344f8f0b53c6b46fecf8e
SHA512 622c28f81e4f474f593ff0a0946443d36c82dd8b8771714458d6cba59892415c45eef8e7b486aea762f432166412f297a9c9c3db887d14c8152e7a9cf059c3db
SSDEEP 384:4ZcIhsNfuVhVlcDEa+wOS7+2s/ivw+aLoi:Ghte4a1OS7ls/i4lLV
TLSH
T1EC827C355C789C735DB6A184F88B36076FF8502786CE7A90D5DDAF1C00EA69C131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94c2a533b7d770060c8fe30ad598e7af3e58b9efb86a676ac537fd90844f11d0
MD5 33694779339750e8316dd945f83ad47d
SHA1 cfb80e11c2cc54b2622dab6db260f3696923646f
SHA512 47f28c0574371c5d7f4493388f4effc9e1f9aec1ea6e356f1425a27c46dbcbcbec1c6af8a25b3c44d41bf723d5f33f7a2ac29979f66be82967450d5435f766eb
SSDEEP 96:EqONkEQsjpf1bxX5ih/cIPURHl8h4otop5onDVBfPgvE5BzatIRdy+jCOmhsR1RJ:vONw6Db6QmiUyUrHBa+jcOmiRqRg1bU6
TLSH
T1F402D73568786CBB9EA26E48F88B37275FD4103BDA966F84D6D85F0C00D765C234783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3b69553362a4caa637fec05b6d5d48ae767d0bea19ae400099a234bf239be7b3
MD5 b3707bf5b5c88c8988366af169d26704
SHA1 b229d8342beda98aece93455fd6c5eb32ca98753
SHA512 ff3ef42246fc9403e11a50b88ea448b3ce96dac17c4332e1f55476097d4f5e5086a594a1bf01c599e7c0339e5441c4804dec49653941c6a2a4dd85892ffe7cf8
SSDEEP 384:MZcIhsNfzVhVlcDEa+wOS7+2s/ivw+aLoi:ahme4a1OS7ls/i4lLV
TLSH
T164827C355C789C736DB6A184F88B26076FF8502786CE7A90D5DDAF1C00EE698131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07129d378ab798b0c4526ccbfc38babf5fb517f9aff5344fef4d8dcfbdd9008c
MD5 61e7538f62d2ca2d0783bb3048e518dc
SHA1 35f0fdd0128ffb50ca97fc3da7c7ce3f40163673
SHA512 d6eec739c6dad46b95ede2656dc6015a34b184bff7df51214a7cc9fd124c7bc89946b61df60d6bb9d753ff11c0cacad4b9aaeb7731131a651b4efd2c5f8c685a
SSDEEP 192:tONS6DbOQmiUyRrRBa+jcOmiR67+2WNzTqwU6:tONS6iqRBa+wOS7+2a/U6
TLSH
T1F2120A3668689C775EE26544F48736139FE8502BDA8A7B91D6DC2F0C00EF65C134FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f3c1ba349050c053021e2c0caac5b4f5f26343bc523c261842015b6599edbf41
MD5 41bcb47a9bc3c0fcc9f3b7020cdc7c10
SHA1 e7948c8bb4f7f9f85a344cdb1575aeffbbd2e8ca
SHA512 b5f86f9cb6df1534874c67aeca3c2aa9a389d6ece4c1290a96008cdecd1bf5cb9738c26421c9403bec73f15f841dc65ede9d26f62772941ca121241716f56fc0
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe586397.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586397.TMP
Size 392B
SHA256 1c31e6b18275b45d8259f85f75c9c6ebdfc57d938897095d79c55814b442f5fa
MD5 ac6c9e97575154137db97393fada6ce1
SHA1 ccbe54d88122c5070565819ce6d2a59e157edd37
SHA512 9b338f844353c195a59da6155addfc0cb1860e45cd96af52d6151d4ed81592d9f8d7649c0bb0d76490027e97ad30c5c1f045d31888d4c676fdda6559bc5d43fe
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca93c90aab657aaa6df0b155dd27f1b145e4db6a0da69d944bac8417dd579cf8
MD5 17c23522f1bed1485a0df92911d2d70e
SHA1 0c608255ff93128fbec785d5542046ea427b13f4
SHA512 e97c1fe31ba15136f5deef3a8554ba5397a6c8dd2857e0f65a8bd653427ef2085e91ae5c4ac34e3e78dd6514c08432a065d69ff3845094ca82cc987fb4ab5230
TLSH
T10D41F869B6F91108B3B37E1A9BF6A96D487F7C372E06D55D00110D4F0A62B40D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads