hxxp://www[.]imega[.]cl/

Resubmissions

20/08/2026, 12:58

260820-p7sv8acp9v3

20/08/2026, 10:14

20/08/2026, 09:59

20/08/2026, 09:12

20/08/2026, 08:40

Analysis

user interaction
yes
max time kernel
88s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.imega.cl/
Sample260820-k6ak2acd69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5688	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316907595579858"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{B1430D4C-45C4-4092-B24B-C31967B93D75}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5444	2484	msedge.exe	80
PID 2484 wrote to memory of 5688	2484	msedge.exe	83
PID 2484 wrote to memory of 1872	2484	msedge.exe	84
PID 2484 wrote to memory of 1872	2484	msedge.exe	84
PID 2484 wrote to memory of 1872	2484	msedge.exe	84
PID 2484 wrote to memory of 4724	2484	msedge.exe	85
PID 2484 wrote to memory of 4724	2484	msedge.exe	85
PID 2484 wrote to memory of 4868	2484	msedge.exe	86
PID 2484 wrote to memory of 4868	2484	msedge.exe	86
PID 2484 wrote to memory of 4868	2484	msedge.exe	86
PID 2484 wrote to memory of 5604	2484	msedge.exe	87
PID 2484 wrote to memory of 5604	2484	msedge.exe	87
PID 2484 wrote to memory of 5604	2484	msedge.exe	87
PID 2484 wrote to memory of 2248	2484	msedge.exe	88
PID 2484 wrote to memory of 5752	2484	msedge.exe	89
PID 2484 wrote to memory of 2248	2484	msedge.exe	88
PID 2484 wrote to memory of 5752	2484	msedge.exe	89
PID 2484 wrote to memory of 2464	2484	msedge.exe	90
PID 2484 wrote to memory of 1828	2484	msedge.exe	92
PID 2464 wrote to memory of 1596	2464	msedge.exe	93
PID 2484 wrote to memory of 1932	2484	msedge.exe	96
PID 2484 wrote to memory of 1932	2484	msedge.exe	96
PID 2484 wrote to memory of 1932	2484	msedge.exe	96
PID 2484 wrote to memory of 3328	2484	msedge.exe	97
PID 2484 wrote to memory of 3328	2484	msedge.exe	97
PID 2484 wrote to memory of 3328	2484	msedge.exe	97
PID 2484 wrote to memory of 2676	2484	msedge.exe	98
PID 2484 wrote to memory of 2676	2484	msedge.exe	98
PID 2484 wrote to memory of 2676	2484	msedge.exe	98
PID 2484 wrote to memory of 4028	2484	msedge.exe	99
PID 2484 wrote to memory of 436	2484	msedge.exe	100
PID 2484 wrote to memory of 5292	2484	msedge.exe	101
PID 2484 wrote to memory of 5684	2484	msedge.exe	102
PID 2484 wrote to memory of 5684	2484	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.imega.cl/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbc177c188,0x7ffbc177c194,0x7ffbc177c1a0
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,5208194163906441056,1954917518960629619,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,15744110660570641881,8833425988588138416,262144 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,16824975917093373399,2526442147671107756,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:13
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3160,i,7194940313611722375,11773733283365322217,2097152 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3168,i,11308785968795640329,3279104908260285880,2097152 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,9812667005084010767,17737483026935814110,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,2392840076517753609,3391288262479212038,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,17435923503162267755,14274868597383997964,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,10676618253557018822,14783880362200811280,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,10676618253557018822,14783880362200811280,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5912,i,9077560402406104737,4134742837592765559,2097152 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4148,i,13073054282955995954,7010906667099032127,2097152 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6468,i,337973757095254946,8819934093646683980,2097152 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,7326050928135237590,11683586680973739039,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,13430319059043393435,1011708395441615195,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,14822080377265343050,15547582484299490837,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1419919915008929489,17828441358118951373,524288 --field-trial-handle=3764,i,14788320882084476800,16701504553057836227,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
  2⤵
  PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85a8ec91739c1734b80fc0529a4dd192488c5c9f1055c947282538aaaba95321
MD5 38c9b62b244e718c3dbf5857b8227e9e
SHA1 1ba763300d4544f6a994ce506415289b6b3b5c74
SHA512 85c19ece89e985af4834ca7aee11fb97010db11f789afdc17e9dfdaefa9ab3a92ac36f0d5c6ccfb13341a065877110bd7906551027e4f18035aedbc0d01e2307
TLSH
T1DAE02BAEC820AC2714FD0B59A1550B46EB9013572680885F3A3D890C8FF072A028981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3aa495e59602755064d94453be3698c278af66bf0ec37927c0fb5c8d51503770
MD5 f8c05a74267cc778118cc637be4b7291
SHA1 d4c66132235941231debfe008c0d69cd2374dcfd
SHA512 44b5df1f95385775905e2e0697bb7c3ad873975af8c787db0e705cb25dd34d72ac1071744c06a7d8b3635dccd625f4e2da7cb509a5dfecb78c3824143e0e14c1
SSDEEP 96:fdBSOH2DLBFkmwaqDfbAUsNKPJnKJWEEXCm:lBjC9mmvUsEPJnIESm
TLSH
T1CC91C41A04B7ABD7DF108CFBD6E12A1DB3B0C48545475F7228FB7DB9AA1E351C822084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59384c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59384c.TMP
Size 3KB
SHA256 f1133838706fc43cc669887ec5b089a9712fbfe1b3471e239f582dcb7cd9c76c
MD5 63c8444e4cf8940eb5942a1cb7508534
SHA1 3b5acfc0c7da28e8c30af457b4bbd17a312ce525
SHA512 c652b2c62f5955e34257c278637ab8a4cb2ea1365024d50dc88bc62d8d2081f56a5681865ba05a60c246bdc048c6476e4eef9bedf63c62374661daaefdc8f938
TLSH
T18C716E2A09B71BE7EF200DF3E6D0051E7374889999476FA20CF7B9F9A91D722C122004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 42413ba9fef9244f5e119bfa7e5e9b4c47d1b291d8b9b41b775f8e00fca04ef1
MD5 22d3fa2bffce3d1ff01f03affad9d40c
SHA1 687a6ba569d9e7afb3d3d70e4af03c4c58f8320b
SHA512 cca089fee889a8aa0fbe0ceb24344e38c27f25226d1da08c5f0f9f26286d2ee5384b499cb1c28b8b0d127ab930104b95fe58f03f3df51f48728c9bfe6e75a715
SSDEEP 96:D1rOeoeQehenWaaij6ozOGeme9Nele9GeYeae3eVw6eRxe3Q:D1S9leLaaij6oSGJmNWmGpxkMbol
TLSH
T1948180F783F4856DC90252F4AA147F2BCE290912536C3D5A85E4AF1F93F2461E141A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8f5571544652fe8c8cd4fde02e5d73bf4d3597bf0b82ea87048f32039050e6eb
MD5 651e062fe76d2bb8129fa7e53891adf8
SHA1 18cc0a322bf998fa48061464e3282480e11ca06b
SHA512 035d7a56da6e4f6c797dae0a1a69727d153eb0c681ead713e77dcfc08eb097296c04de0e4b4a3382e7750950f27f04ebf71796748aad1abd8e99e53d2264236d
SSDEEP 192:sxZRRKyMqZjK1Ml8MFM/f2saA3E0CXUXzodptDK/xM6+WNCQ+/Y0dmrizUIg5fuJ:sxZRrdM/f2s3U0L8M/Pw/5fUM3Z
TLSH
T1EB62F9156A38A97B8CCBD209F685BF93D7F91463A1905E4499FC8E1C04E7BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b1d1b61e355440b53208504ed817c18fba8a1a80e693a60e2feb0ee296a30306
MD5 000c6464a8bcf330b1d0f41479193e0f
SHA1 77e5c989fc1530c3163870efea7dfcf1f50a1ac0
SHA512 6ec64c8587345001e1ed5bcd7c9a0b7ca65672b80630d41a51607767cbb34c442c9faed7b6305a6c9b9ed3851362647a1cf3b3d7fb510ae555d12c4d6fccb910
SSDEEP 192:sxZBRKyMqZjK1Ml8MFM/f2s8+gxE0CXUZzodpW/xU6+WNGY0d3rizUIgj3J:sxZBJdM/f2s8+g60LSW/nG5cUjZ
TLSH
T15462E8166A389977CCCBD209FA457F93D7F91523A2805E4499FC8E1C04E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 67ac0023aca779efce1d4c566669f671a901bb659a11996818230d3459b25071
MD5 26c1a3b321828e0791e11e70d688ebcd
SHA1 b507be1b14454873b1ff80c3233d31ee943cbef9
SHA512 e49c702f22888a2002d8be1bffd98ff892cdeca40efb489a81d8faf5a0b9cf457313bc064c0cdc62ed76125ac165560b559530659bed2c675e76e93f426cf407
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7edY:AFBHhTofhno2mB21q3Llbfe3sLDdeEpx
TLSH
T16DB28D56717B12023C3E290CE6919B770E8272A3355CA56F7BB800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aad6edf315a457bc6162e000cd1380a22ee26de50db8297f9071ae5a0b2cd547
MD5 cc3ad0fba52cd4d33a8a60a86ff0f82e
SHA1 59324f823549b03d29c4d9255d162966279fc929
SHA512 6113fc85e962aeeab652583f44cd08f3a0bd905aaa93c8eb447a48d5069c9e5453e2755c6b834245102fb14437b9f345235157e1655aa6fbb07fb59e0d599513
SSDEEP 384:nyiFiZcIE8NH8TUNTUlIRryCI7jkpfb7oBUG1lWeI189iv6iHy/7Igsos:5FQE4wgssJoCG1lN9iSQP
TLSH
T1B3C25B32EC68C9B7ACEA8AD9B74A7A07EFE4405396CC9AC4D9C85D5D00DB5DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6f1e7be5d95a49d79b4cd1e3788ac112c8195521cb74a5a8964d9326fac67630
MD5 ca72dd216eebd9195daec1b053750528
SHA1 5124b4880eba7e487a27b567134f0828794bad1d
SHA512 2b080fadbca0c54d80ff3a4b497737442a144948461ff3b89a9368ff533bcf7d38153fa37bb3bdd2f280a021ab0396c292aaf418bbfd46cbd59b28aefe030e3e
SSDEEP 384:n5ViFiZcI838NH8TUNTUlIRry+I7jkpfb7oBUG1lWeI1/9iv6iHy/7Igsos:6FQ834wgQsJoCG1lE9iSQP
TLSH
T16CC25B32EC64C9B7ACEA8ED9B74A7A07EFE0405396CC9AD4D9C85D5D009B5DE0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 02817e1e44ce2c97675642b6cf0b1d6987f384aeccd6de56b926f73caf23ee22
MD5 8077f9d17943111eb0ba5c7bd3eb0937
SHA1 adbdf08f240e43893f5ab82c74c0b6c5fb498d8b
SHA512 5711f67f756e0bbb8596c5067043ef860c54b4ff7a1b608d21344a1c9db6cc3a7a3e3b5f1515263c497eb084aebb41d0a009c091c5c2f69f090a3b74b0591323
SSDEEP 384:neiFiZcIA8NH8TUNTUlIRryCI7jkpfb7oBUG1lWeI1/9iv6iHy/7Igsos:1FQA4wgssJoCG1lE9iSQP
TLSH
T1DCC25B32EC64C9B7ACEA8AD9B74A7A07EFE0405396CC9AD4D9CC5D5D009B5DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a5b85052199e9c33e95a55bf2d332b9d22dc2f7623710a04955769ceaf170449
MD5 f735cbead3902a73504570b67e8f013f
SHA1 6f357712e3c243d1978df33edc251b73867455fe
SHA512 679431d83ebe56570b31e626a1e2076c26c26dc843a1f85f666afb0c9c003195fabb85d66094245a35829d866181fcd550d3c3d8f9084ccabe85b3b5189ed9b7
SSDEEP 384:n58iF9CcmyWCs38Nz8TUNTUlIxBydxi4jkpfb7oBUG1lWeI119hkP+lFYS/F+Hyj:NFccps3IwgfFJoCG1lo9hkoFYS/j
TLSH
T16AC24B32EC58C9B7ECD68ED9E74A7A02EEE04163C68C9AD4D9C81D5D00DB1DD5707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 10986658be53f884768f36a36995f48e1dd7d7bac0e0ebb49c92a4efeea0619c
MD5 18d5e3e39d2b5cc220f9bb72d20e4efc
SHA1 562976327e5884b3cb4aed88543f35434d74453f
SHA512 405a6b7998d956bf2745f04fb6809816a514fa1d12b8a0fed37e5183841b7a7a5d30fc5dc626b60025af0633183cc0cfc63433e71e89c6ec1e29d1713388e56a
SSDEEP 384:n5FiF9CcmyWCs38NI8TUNTUlIxBydvfo2ajkpfb7oBUG1lWeAfhkP+lFYS/F+Hyj:OFccps3bwgqt7JoCG1lafhkoFYS/j
TLSH
T19FC25B32EC98C9B7ECEA4FD9F74A7A02EEE0016385885AD4DAC81D5D00DB1DD5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21aab9bff94c9890e257d7972f883b8eb6b83da76b76a500e4b0a5fbe24edc5f
MD5 6cdddbd2373a201aea3c619ab952f896
SHA1 0d27dc913736f4a788a439c186a2f9e310e1ce52
SHA512 c6de991c8676899a62845fbe864d42e7ce98a531741013b6383138d638b9eb41656f14ce0cd9a92aae8b7d4d1bc91dd38c3f1a4c38e4060f0b7656d348b70071
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5996c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5996c8.TMP
Size 392B
SHA256 6dbb751ac071617d4361a7effe737fd87a832b1e40616408c5e695714f8942b8
MD5 78b04bf3b4948e85eb263811e9bdd9d3
SHA1 af18e7a3a5b7bd6f3197e23db8084fb6bc9334e5
SHA512 4cabfc000661f0c69dd118ee1825724585e43edaa33f0f5afd84d3fa5197ccab7784d23a3b29cb430baa0c1031cb36d4df5b36342dd38bfbf7272e0bc0ad5e00
MD5 SHA1 SHA512

Submit Download

memory/1828-194-0x00000171201C0000-0x00000171211C0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads