hxxps://2mox[.]fun/id816864

Analysis

user interaction
yes
max time kernel
37s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/08/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://2mox.fun/id816864
Sample260823-mpybwaaa52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{46A4CD18-10BA-4C73-992F-9E475DDCA04E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5444	2484	msedge.exe	80
PID 2484 wrote to memory of 3416	2484	msedge.exe	82
PID 2484 wrote to memory of 1484	2484	msedge.exe	81
PID 2484 wrote to memory of 3416	2484	msedge.exe	82
PID 2484 wrote to memory of 3416	2484	msedge.exe	82
PID 2484 wrote to memory of 3252	2484	msedge.exe	83
PID 2484 wrote to memory of 3252	2484	msedge.exe	83
PID 2484 wrote to memory of 5244	2484	msedge.exe	84
PID 2484 wrote to memory of 6136	2484	msedge.exe	85
PID 2484 wrote to memory of 5244	2484	msedge.exe	84
PID 2484 wrote to memory of 5244	2484	msedge.exe	84
PID 2484 wrote to memory of 6136	2484	msedge.exe	85
PID 2484 wrote to memory of 6136	2484	msedge.exe	85
PID 2484 wrote to memory of 2524	2484	msedge.exe	88
PID 2484 wrote to memory of 2524	2484	msedge.exe	88
PID 2484 wrote to memory of 2524	2484	msedge.exe	88
PID 2484 wrote to memory of 5856	2484	msedge.exe	89
PID 2484 wrote to memory of 5856	2484	msedge.exe	89
PID 2484 wrote to memory of 5856	2484	msedge.exe	89
PID 2484 wrote to memory of 3792	2484	msedge.exe	90
PID 2484 wrote to memory of 3792	2484	msedge.exe	90
PID 2484 wrote to memory of 808	2484	msedge.exe	91
PID 2484 wrote to memory of 4776	2484	msedge.exe	92
PID 2484 wrote to memory of 4776	2484	msedge.exe	92
PID 2484 wrote to memory of 4776	2484	msedge.exe	92
PID 2484 wrote to memory of 1732	2484	msedge.exe	95
PID 2484 wrote to memory of 1796	2484	msedge.exe	96
PID 2484 wrote to memory of 1812	2484	msedge.exe	97
PID 2484 wrote to memory of 2504	2484	msedge.exe	98
PID 2484 wrote to memory of 3456	2484	msedge.exe	99
PID 2484 wrote to memory of 2504	2484	msedge.exe	98
PID 2484 wrote to memory of 3456	2484	msedge.exe	99
PID 2484 wrote to memory of 5220	2484	msedge.exe	100
PID 2484 wrote to memory of 2096	2484	msedge.exe	102
PID 5220 wrote to memory of 2384	5220	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://2mox.fun/id816864
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x290,0x7ffbc177c188,0x7ffbc177c194,0x7ffbc177c1a0
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,4841697437189847746,2236953929282666600,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,11372890272892068909,13658878447330825759,262144 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,17609510766559552508,17849285089276245115,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,10827128004815997023,16992295095739151080,2097152 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,14787838436039035524,15271820589868184224,2097152 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5012,i,17453516790176941719,795431005049506465,2097152 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3832,i,4707067591071063540,13483078908269234422,2097152 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,5382020149006522261,16785251288043794305,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:12
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,8663705948977840041,14330813578313170409,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  - Modifies registry class
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5644,i,14334471851458223385,13177873684131595773,2097152 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,10425210498836482615,7288068509961607620,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11562428269654564515,2056439513959053580,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13342306499595079572,12065587096962867670,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,16813938832858798252,2586129064811499939,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,15275966675061636623,6001434552961882850,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,12600458365259828645,4139105466272173249,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3428942033393831826,8229660170367263300,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3428942033393831826,8229660170367263300,524288 --field-trial-handle=2416,i,17461914216955085651,5026732292786828889,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 56KB
SHA256 e67424b4a2e955b2e3070cb05ffcef79a44e0cb9a1983dc57dbe4963663204f7
MD5 a3ce55518f54b62aecd7d174ac647fa9
SHA1 9e9ebf0fdd895499277ad02333d62d7ce0eab192
SHA512 f7182b7ad125e0347dec32c65221dbe060bd2299329249859e84392a322584f1110b00bcd2b7228b844e1b98f669c032bcda8e506f08560e9dd774d9c0394c3d
SSDEEP 1536:o6DRkF7IntuQZILaRqE65OqhUOW8CzLD5tm8EgpcHNZDaYd:o6DRkButtILC65Oqh9CT3CyiZDaq
TLSH
T19C4301F088FD619278328915F15D24190F3CBAB59E2AD008AECE36E24C1D35F9DF6C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dcc8fad0de718cafe09b59b7a04775138f96cfaeb70af9ab449c9e254f32f652
MD5 22e632123f6a1b9d0ce953c6e12d16e6
SHA1 6e5344be1ce1be249d4509f4e0ee648a4b223860
SHA512 ef37154182b4022ddcb77f7b5648ca11b391ecd701ccb7df38b00239b83c145b9c3b0efd1bdf95b27748b93cda880155341a7e560b8e96678e2194e2df215b3e
SSDEEP 192:sxZBRryMqZjK1Ml8MFd/fFs8xBxE0CXUPzodpR7ORT/W6+WNnwO/Y0d4WumIgj3J:sxZBYdd/fFs8xB60LE+/bt/5jDjZ
TLSH
T1DF62F8166A34597B9CDBD219FA45BB53D3FA452392804E449AFCDA1C00E7BEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\30b3a115-9bb6-4dd8-b611-349f1a07b2c9\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\30b3a115-9bb6-4dd8-b611-349f1a07b2c9\index-dir\the-real-index
Size 576B
SHA256 361e01432ff8743478f2b72363228391811da08b40ae0e8e4db008b5925ab541
MD5 e1414d5ad8fd79b962ac18845e17be9e
SHA1 3a7bdb10b5ddcce514d27aed917aca0bb0f9c2d4
SHA512 9d18a4a09c6e33073346430d7bd95a062c239d69c92418ee330ec654f5bde252e6deacf963fe841ff7a8b6190c6c6c97abe80cdc9d94badc7c7d2fc69d54e8f1
TLSH
T169F0F1D19A65089EFD410F757A7E08D0772DD48154A612CB846CD0FFFF3F2518A50141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ed59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\30b3a115-9bb6-4dd8-b611-349f1a07b2c9\index-dir\the-real-index~RFe58ed59.TMP
Size 48B
SHA256 ac9bdb835723f997839850c2c38ccab875cc51b97bb71286bcbf246ee21b9b4b
MD5 145249912a6895f5b206574b7e9992ff
SHA1 4041494afdd05fc3a505dca76a35b6e6a1698ab2
SHA512 10e742a5d31e4790e95cabf7ebdb9f41f39a36a5b38fd5eee6aa0feac14fbc363a0e94ab1657c796af8ad33fdd1ab72572d8539d17896525da26b308cdc44b11
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\799866ac-5cca-468a-8853-bbd032fe5551\index-dir\the-real-index
Size 2KB
SHA256 8598062b77c885c51ee5080f7950b03e9b48cc80d1bf7354dfde18266b7d5e71
MD5 c84e81edb2c3e0ab312ee9587dc41867
SHA1 58470ec0f9e60685e03d297f0d0699084ee0a56c
SHA512 adfdd7898de3d71c5df012cc2a3edbe3b2812ea86ad0ba8f33a929f7c4cd591c09500434e54455ef24ef9f3bf52094c87bb95fefca70671f8d11ba20a696e7e5
TLSH
T17851654CC9806B9DE87161FE199115F247762C38FC58C3A18198F5B63413A681B5B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588632.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\799866ac-5cca-468a-8853-bbd032fe5551\index-dir\the-real-index~RFe588632.TMP
Size 48B
SHA256 dfd2227515862c2e3957f3323d1664a14c23ea7efaa8b6f9d9ecffe27eac2ff8
MD5 9de28c179a865d88c49324c5a90881df
SHA1 a30ed849e37d8f15c22b9465785d55f14a9e60af
SHA512 318d8d777dd58000961eae72233ddafa72438d4044a420d7924ca32144108a81a6c41882aa99e45c8cb48caca3481f969939d09f8177372eab31ad0ffe2b10ff
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 c6207271d06a30077d07f15bc8d367433b3c22985d35511202366877e8a7bb22
MD5 ae8175a5f7f0c1f9c2da8b720c33f8fb
SHA1 19ab8fe494c573965e19bc62265dc06ad976b1c0
SHA512 3f0a84cde1623e07868121bb7da77cfc00dcb66e84b06a015ee60603dbbabbc3bbe1925012b823dea2647f82a5290e9d48c7e7b5173b74edc0128cf0c30ba702
TLSH
T1B3D0A7C546718A156634D7445838616ED5164E1CC88088D4C948B05120B8603C801925
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 ba41c4e3fe20b7ff411d8f3dfb478edcf8011890f71755edb1fdff2ded3dd345
MD5 367fb0a8a00fc8f240dcaa3748acbe03
SHA1 a79db5bbdb4965530d9b796c293dfd13e60d284f
SHA512 838e90774afa132613db44c8e3b3e2e13c71e24ddb7e1e34941cf2605904ed60fe947c48d3249a9841ddd43dc6fa2fffcd48cd36486480e396cdceb80e0a78f2
TLSH
T11BC09BD64B5486565574DBC4583C767DE91B874CC8D0CCF4D50C504530746138801D35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 86eafd447e57d9457152594ebd652730bf4f45b62682f00326b7f4e9ea332479
MD5 32957bdf9514c50bf0f9c4c2a61d4fd0
SHA1 40fbc0fcfca2e37bb3ac62131e63936fa1368cc9
SHA512 548cc0868cda0ac5436a8949c4acefbee49b57f406add3e9d6224f3ce77d3de03e0316ea3c6af750a900c28054c531b8c926a8507282d68a464b820f74bc67cc
TLSH
T12ED022D94BF28A02A230AB805838629DE917CE0CCCC4DCE49C6CB08238B8203C842A37
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 49ebac93a023570bafb8101f7a0ad13a0ef8a67da21344baa0c031b27a875bfe
MD5 b215c02dac2ddde44bab0daa879ab0f0
SHA1 d638288a8fd5846d6805c74b26f59b7fc373cf4a
SHA512 6f5aac3f7cb432d05c8493c4a6e8876ebc2729eff40e0d1f24e36c5d90f9a6bd13d67970be31663272351547d3eca1985dd0d46c68061bf4bd0178c3b15fe8a5
TLSH
T1C0D0A78A2F95418595309ED42838B6AEE62B9D4C8CD5CCE89A4870453174E13C421E39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 da9d0bc964af3b517fcd3f065d4939f2103727906dcd995aad25f613bd06cbcb
MD5 88f6df3204dbd311e73d6453fe5ef79d
SHA1 5f409909a8c27b3559a4fb56473b9f49bb7af46d
SHA512 0c7273783f822d7d4f3c0aa05dbc0c974ceb1c58559d0f98071eeba10ce71ab496bca53354365049a12fd586ebc368a0e3dc66d006fb0f1e406c5c47e53e2293
TLSH
T1D6C09BD64F5546565570DBC4583C776DE91BC65CC8D4CCF4D90C504531746138801D37
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 aa7bf96ad2992debf1b8d980489f4433534eb86dadcfba4c45047bc25ddaef57
MD5 33dfd146ef21251338d875e182def081
SHA1 a3cabb7be7fea0930363ad783bc77d26d8506aee
SHA512 5680f50e7ee7cb9cfca80323aecfc5e0c356ca38f6c40868648617890d6d20ae25917d20904bf8c25987ab502c5be5611832bd4eb63fa6c8ed78ac8d067e4d01
TLSH
T130D0A78A6F854185A530EFD42838B67EE61B964CCC99DCE89A4880453174913C821E39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58701a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58701a.TMP
Size 137B
SHA256 024f71638689bdf9bbb7d7a8d832c550aa8f2c73c59b6de678c9c6f6ca8dc7c3
MD5 ab0f17839051166bea86ffe8952a29fe
SHA1 2ef51fb5973f6262b7d2fa627a878a44a78de067
SHA512 69c2512976d1288bf359ba938b3328fb75a510c945305b879b3414f51252014db73f4917a0c6498d671430ce682e25685ae25a38539ed8de5e06bcd35af4c11a
TLSH
T1D6C09BD64A548A5657715FC4583C766DE92B8E5CC8C0CDF4D50D70453074513C801D75
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 a63d2e1b9909c85222952478c72ec3875187a080368bced0f32916e0b54aea5b
MD5 f35f4ac0a4dc3ef6a0c14c0ae63f5338
SHA1 1171f4613e14679e9c3507e67661c8edad2b139c
SHA512 5712787c884fad0de1bbed32caa8e7e138c7e6bad9e58678f501fa4b67df95f29dbf6bcb846258017d0d1b6a2b52b74b16c55f7aa02e9bafa9d9f96cdfe6bff6
TLSH
T137B022EC3CAC3023CC2C033C308E80C3B03C8E382B02038B0AE200F8883F2008808222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58df30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58df30.TMP
Size 48B
SHA256 7ea5b854498fad8de766dc1f39c6f15400ff68d8515e4bbbeffc02320853c297
MD5 095500c94bf15461d888ee04a6b0aa97
SHA1 6d0e61e0e3f3f8c2538b714541dda5459e2f9819
SHA512 110bcaffa5cd22c5072e1e8170c7aaf82e60f88a810a219b0356302ae8a7fd54bcdfd363c1ecba2f6251dbb38f98575b1a047f79f0573b1ac7e59bdf78511a2c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0b7f3b82e5d4e8fa1d91c67b2a5ac8d6a0effd9d160c36c519e1bbcd340edf29
MD5 aac6722d95a8189b6137f0301658fecc
SHA1 59d44eb6b5e3344a90669ceea563dd1acdefbee5
SHA512 46a55c8b609371cd6259f22d5be8c79408881bc531b5f1bedf19a2d62b530338cf2edbc16f5675466dd7a6e67c323e6f1afe51dbad577700bba9278b333992df
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7edn:AFBHhTofhno2mB21q3Llbfe3sLDdeEpu
TLSH
T156B28E56717B12023C3E290CE6919B370E8272A3355CA56F7BB800BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 34ad21f7c0cb9dd42205263cf8dc1d33ff42c9c40760f05cadc995427d14a368
MD5 b5ce315e05fcd2e04ab79bcbcf906c14
SHA1 b7cd076dbbc42809892b5cf1999408d255d549d2
SHA512 ecc7f30115f56a76f52cf17fdc4a49d6b2873d7c821e73cf35141c8daf82a2a1b2dd550e61d04ea10f6ce2a2fc6a4c42395f176c472b4ea499d1b6bd079b66fd
SSDEEP 384:n5FiF9CcmyWCs38NI8TUNTUlIxBydvIokajkpfb7oBUG1lWeAXphkP+lFYS/F+H0:OFccps3bwgd/7JoCG1laXphkoFYS/j
TLSH
T12CC25B32EC98C9B7ECEA4F99F74A7A02EEE00163C5885AD4DAC81D5D00DB1DD5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e1a5bf729fb7019440256a4b84b7ec458576f5d203ba3a11f65d888279913ae1
MD5 89df1854d0a5c34392f50947206c37c9
SHA1 8f6fff773cb57e6433faaafad57b8b6362aebf8b
SHA512 7b28d1b4b968b5c5fb750d6080ee31432d64e85606bbfa3fc62a767746ae85d4682df4345ca3d6607aada8b984da4e7f4d02c1c9e9f4415e8edd24f863e57fd5
SSDEEP 384:n5eiF9CcmyWCs38NO8TUNTUlIxBydPSJjkpfb7oBUG1lWeI1iXkZhkP+lFYS/F+U:7Fccps3pwg9+JoCG1lfXshkoFYS/j
TLSH
T139C24B32EC98C9B7ECD68E99F64A7A03EEE14163C68C5AD4D9C82D5D00DB1DD530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1850d08ee23709df802dc7587ba5d95acb0467afaf104bb794c3a2c92a280b47
MD5 1789dc5f0c89812a9c4c4f6d88328007
SHA1 c25f2a41d29bc90b1a7b7a48f9651f6eb9c922aa
SHA512 db72a4533d4a10493161657bc5596391ab540bd1a6a0ca5b7bbdc7d7645d56f60af3c261e7741429c453e25f97db43128753a85c881b58a562fb9ad6e44cc793
SSDEEP 384:n5FiF9CcmyWCs38Ny8TUNTUlIRXyCysjkpfb7oBUG1lWeI1GXkZhkP+lFYS/F+HJ:CFccps3ZwgiRJoCG1l5XshkoFYS/y
TLSH
T191C24B32EC98C9B7ECD68A99F74A7A03EEE04163C68C9AD4D9C82D5C01DB1DD534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0516146c70fe6e4b17f023cb1981e9161229b846cc5f80ada08fad5524aed7f3
MD5 fde62c9f5a3a89b97819bdaf98732853
SHA1 1f748ccb7a5a6152d4d7805f962c0722b3e107d2
SHA512 3309618486cf418c03ef974488d6c2713ad88344d8d5da286b2db490dc4feeeddf41a9ea201928db230f2d7db4765028d913558d0eee945fbc054a3df27a6343
SSDEEP 384:nCiF9CcmyWCU38Ny8TUNTUlIRQyCysjkpfb7oBUG1lWeI1GXkZhkP+lFYS/F+HyJ:JFccpU3ZwgNRJoCG1l5XshkoFYS/se
TLSH
T1E1C24B32EC98CDB7ECDA4A99F64A7A03EEE14163C68C5AD4D9C82D5C01DB2DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads