hxxp://www1[.]mxempresar[.]shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd[.]php

Analysis

user interaction
yes
max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
Sample260825-e17exsfh48

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321055587064770"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{0E09C5EF-8D87-464F-867F-E9F771E18EA4}	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4752	2076	msedge.exe	86
PID 2076 wrote to memory of 2108	2076	msedge.exe	88
PID 2076 wrote to memory of 2128	2076	msedge.exe	89
PID 2076 wrote to memory of 2128	2076	msedge.exe	89
PID 2076 wrote to memory of 2128	2076	msedge.exe	89
PID 2076 wrote to memory of 1732	2076	msedge.exe	90
PID 2076 wrote to memory of 1732	2076	msedge.exe	90
PID 2076 wrote to memory of 4600	2076	msedge.exe	92
PID 2076 wrote to memory of 4600	2076	msedge.exe	92
PID 2076 wrote to memory of 4600	2076	msedge.exe	92
PID 2076 wrote to memory of 3840	2076	msedge.exe	91
PID 2076 wrote to memory of 3840	2076	msedge.exe	91
PID 2076 wrote to memory of 3840	2076	msedge.exe	91
PID 2076 wrote to memory of 412	2076	msedge.exe	93
PID 2076 wrote to memory of 412	2076	msedge.exe	93
PID 2076 wrote to memory of 412	2076	msedge.exe	93
PID 2076 wrote to memory of 3716	2076	msedge.exe	94
PID 2076 wrote to memory of 3716	2076	msedge.exe	94
PID 2076 wrote to memory of 3716	2076	msedge.exe	94
PID 2076 wrote to memory of 1720	2076	msedge.exe	100
PID 2076 wrote to memory of 1720	2076	msedge.exe	100
PID 2076 wrote to memory of 1720	2076	msedge.exe	100
PID 2076 wrote to memory of 752	2076	msedge.exe	104
PID 2076 wrote to memory of 752	2076	msedge.exe	104
PID 2076 wrote to memory of 4768	2076	msedge.exe	103
PID 2076 wrote to memory of 4768	2076	msedge.exe	103
PID 2076 wrote to memory of 3700	2076	msedge.exe	106
PID 2076 wrote to memory of 1900	2076	msedge.exe	107
PID 2076 wrote to memory of 1900	2076	msedge.exe	107
PID 2076 wrote to memory of 1900	2076	msedge.exe	107
PID 2076 wrote to memory of 3164	2076	msedge.exe	114
PID 2076 wrote to memory of 3164	2076	msedge.exe	114
PID 2076 wrote to memory of 3164	2076	msedge.exe	114
PID 2076 wrote to memory of 5596	2076	msedge.exe	118
PID 2076 wrote to memory of 5596	2076	msedge.exe	118
PID 2076 wrote to memory of 5596	2076	msedge.exe	118
PID 2076 wrote to memory of 4880	2076	msedge.exe	126
PID 2076 wrote to memory of 2540	2076	msedge.exe	127
PID 2076 wrote to memory of 4388	2076	msedge.exe	128
PID 2076 wrote to memory of 4104	2076	msedge.exe	130
PID 2076 wrote to memory of 4104	2076	msedge.exe	130
PID 2076 wrote to memory of 4104	2076	msedge.exe	130
PID 2076 wrote to memory of 5260	2076	msedge.exe	132
PID 2076 wrote to memory of 5260	2076	msedge.exe	132
PID 2076 wrote to memory of 5260	2076	msedge.exe	132
PID 2076 wrote to memory of 2616	2076	msedge.exe	133
PID 2076 wrote to memory of 2616	2076	msedge.exe	133
PID 2076 wrote to memory of 2616	2076	msedge.exe	133
PID 2076 wrote to memory of 6128	2076	msedge.exe	134
PID 2076 wrote to memory of 6128	2076	msedge.exe	134
PID 2076 wrote to memory of 6128	2076	msedge.exe	134
PID 2076 wrote to memory of 6004	2076	msedge.exe	135
PID 2076 wrote to memory of 6004	2076	msedge.exe	135
PID 2076 wrote to memory of 6004	2076	msedge.exe	135
PID 2076 wrote to memory of 1068	2076	msedge.exe	136
PID 2076 wrote to memory of 1068	2076	msedge.exe	136
PID 2076 wrote to memory of 732	2076	msedge.exe	137
PID 2076 wrote to memory of 732	2076	msedge.exe	137
PID 2076 wrote to memory of 3184	2076	msedge.exe	139
PID 2076 wrote to memory of 3184	2076	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x214,0x248,0x7ff8c69ec188,0x7ff8c69ec194,0x7ff8c69ec1a0
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,10332346069270240236,9581935682748626811,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,10859077087437124736,9680873385668464412,262144 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,7967135410013386230,14251523917051705837,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3164,i,7232142972694316019,3894352233836518504,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4140396281509161409,774638323148353871,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4004,i,3623244008518248713,1746264185875175622,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4036,i,9662594410012783027,86182399864229783,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4864,i,12241017664499996774,5500576542939797891,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,10070138861393385990,8985758797895617750,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,5342485570201946828,10241405475618491554,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,16822594681954649409,5637493177446590211,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,16822594681954649409,5637493177446590211,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6116,i,15449884510334736515,12923683352608329998,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5096,i,26721762337868987,7569555616826376513,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4620,i,3944261633022813713,13152078714971141835,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,15247856838664879468,5259023243539068313,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,10122651663090180446,9331240967479946062,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,8352237396108023671,2350078389557141978,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3880,i,8544115071687199141,7979609367617260522,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5032,i,15195729801872315684,6195143741873213813,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4296,i,9461213351466998414,2362165583237616031,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6152,i,177991874567810555,16826322828600931917,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6468,i,4626131860496900349,2064511780751033531,2097152 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,15626390447668554782,1321402004791598880,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,15464231675265058654,17428698329091402600,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,3183122926217128967,4064801536253694363,524288 --field-trial-handle=2344,i,9828673761013252496,2740185771982196539,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

0a1abbb4-6ded-40f2-b7e9-796a531e6f38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a1abbb4-6ded-40f2-b7e9-796a531e6f38.tmp
Size 12KB
SHA256 24f03adfd818b05f4e4be6f479e45e0e40b135e54a061a81f6e03168275b09ac
MD5 1faeeb128703a14c8432870e18235eee
SHA1 d3f417db14873144d48f9a390afa8f2d9962342a
SHA512 6121fa27a2b70c68b4a2d5f830fc607ffa9707dec34e21e45a8a15de1432196907ee2c9ef420509c14422e712c96a530907b2e62a7590c33ac14345ba54164a4
SSDEEP 192:sxZyRRyM/jK1Ml8MkF/f/sw1xIdpQXH456+WNGYwKEmx9IgrJ:sxZyhMF/f/sw16GHdGi9
TLSH
T1E042F9116B34697BCCDBD209FA55BF93D6F90472A2900E44A9FCCA1C05F6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 37KB
SHA256 eaac752fc61a41c681a1ddf5a00ec0c166cadceb8f2d573748fb4fc4b0c68ed1
MD5 2f7c3cea64f1a13bb41848046c718426
SHA1 61b32cbaa7869bff2e9f80487d438e08cba32cac
SHA512 424bfff966b62c1f1bc160670b30f0e818b44ebe7856b103891c3875a262413cc05e1415c2bfcf878840a94fe3f64f689ea07a1289a5061115f49704f6275737
SSDEEP 768:nBYqtqIjDqyOg3c3SgcUaQORU2UvPGa6VVd5/RKoYuGHJ:nNqIqy7sighV2CGa6Td5/j8J
TLSH
T1CA03F110267F5C587282E227450AD0FED7B432D89F204A677BD10A257569FEBB742238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 16KB
SHA256 d9bee0f5bd223f88748f626bd3ef3d8d984c9d04182b5d3a77255f3a979a86a2
MD5 d756b736870e5a4bcc1c684abfe6052e
SHA1 46c18b1f03045ead9e512e435e8893f05aa8779b
SHA512 92f4e128d3c3cce435f8204a439038467b98b9f330f7a7a80221ea98f93331bc07765046772bf57cddb8a619141a17a16084c913d1c2595ba42fd1a33bc2d700
SSDEEP 384:hwtnML947hbkylAvXS+0qv6k2bmBoIreQh1Kc/bqyeU59be:hwtnMZ47hbtoLjHoIKQh1KcDbeX
TLSH
T17D72D0045884C4459780AD1C952634180E6DFA67522CE3BCAE061FED2E5FCF867BAB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 33cc3cc9872654bba09a09777ca47926b085f226da1c1edb4a22bfe50d516602
MD5 bf8dba8fe40c72d4cf59d21de9bffaa3
SHA1 4ce96da7345465b0749184c470eaf86ed0ec6bfe
SHA512 f2dd1bc35a6b16a55d79bfd8a883958492ba73989666e53664983be0c2ffa71e2d62778c6e67053184940bb49e9bfac9cd77f9a664448d09edd71e8de44028f4
SSDEEP 96:L2lMZWbYsEDlPRaC+wGtYXIHqwcylzZIhz+d4DSmcfvyBdVR:Lc05CC+dqJyI+djmc3yn
TLSH
T195F1C81286FA5346EB053D7FE4C24CD6B776310D08AF0E33A5488ABEB527BED1364919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c4653fde8f6c6eb77bd5b4adc6295cf933361fb0777a92b7c138eac00ec5343
MD5 26bcfca0298edd3ad121f28071fb23c6
SHA1 820c7e93dc18dc2940836e20efabd87c7575a2b0
SHA512 8206e29e4be7d0754860da80db5251350794a0f0086e48aaed2b48122d7f13b5243d0efdb653a6cb63afcca5086413f31e45afe7538e5965aaa9095022ea1e6d
TLSH
T1BF61D62A02B34797F322363CD4D30A13F3738484197B8D77464445FD7A39B229725A6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d906.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d906.TMP
Size 3KB
SHA256 93d9a91a1f9f8f2d5a6210ab0850611a2bc87a5b66634bfa7d0e87a7a3a36e92
MD5 75e19e212e6f83818979958c029b9423
SHA1 7163826f35c5077e6cf92751b770e946f8d2c107
SHA512 04a52d660fa48bcf415ca9b52742fe9158b4281c130d5e7b843e075fa5eed1f3ae9569e257355c1e00deeda85fcd2652cee512d8a2f69b7f72c0581856025d4f
TLSH
T13061D52A02B34797F322323CD4E30A13F3738488197B8D77464405FE7A38B22972966C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG.old
Size 347B
SHA256 aca5cabbd0cfd3ec678e3b6fce1279b882e1c0cf5d8e8550a71ed8b7291ffa55
MD5 bb4e8277aa17e5faa76ce6818317eaee
SHA1 52375ee870260e7fc31ee1d03234c190ce6a217e
SHA512 6956ce529ef4a380c82b9253a24f0fd2a784ad65c7ba8ce307c9d9172c2a54087b313f65666e58f8dc879467a96ad43c2df3c74d329b41c290ed780d3bf8a9fc
TLSH
T1C9E0D8745DCEC26FA55024C35225834991A4360AE288B9473B09D8C4730505CB293684
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG.old
Size 350B
SHA256 435d5609fd6d9784bce0b3d8aeaccd96f291ae1ac5ecf1eccbdb2ad71107aed1
MD5 54b5bc9c5e195198a7c402e1b1c62880
SHA1 753919884bcfd5a61ad5e862ebb64b57e2ea5c2b
SHA512 0e7b56759ee3ca13c3e64c9907c2a50ca49e825a28dfca047471fc2d53419796fb51d4486750a7c5b06cf592a46035a0ec76134d810097d40d2ae582d4bfc470
TLSH
T116E0D8B058C9C1EFE541648B571D470881E4360BD6C8FD822B09C898725A479B287644
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1ca5f4012bc1f61eb35bc84dc467d043292a089102f6a04db3ba8b5dcdd789b3
MD5 46a2b89ebdc9a16b5137029014f01a07
SHA1 a6b3040bed399e744b5e577c18c225d6b2893e76
SHA512 514504186e3ef412c6784a53b83e87172afde9fbe26d93f06326561ee063064ec44e8b6a457859280c4d1bba287c38b17262330230ed26debef08411b6ba3912
SSDEEP 96:DjOFVOmCQezBc5GOHutRB16eldiEBtQvsrQ1Scwbqwfx:D6FVOmCQe1c57OtH1LldigtQvsrQ1Sci
TLSH
T124B1ABF7C3E5466ED91196F0EA146F1BCE1D054243AC3C0A85D4AF1BA3F24B1E152B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7a4a5c4c1175e82bba63fbeed6fec9c0c90d65ff8211b584c6155cb76e7abf97
MD5 2b629be528f2dbf3858ac16bf6f18e6a
SHA1 15e1ce2e3e0681943019cf803e892043f3fb5435
SHA512 c5331962280af15dd6e5037e76994fccdcd7d12b65cf0bb0600504326ef0336c9469455416388bc6ec90b43454cf6313caefcd0f7c79dafaef0295205ea892b8
TLSH
T169D02323620070FD659C7D914155FC8FC33600510CC3DDD514D06CD8153287D4D4B142
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe598989.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe598989.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32bdbcffc6a425e0bb50554f28a4a8d93426df5357ee5e793562e183956771c3
MD5 4230c935a7b719ff0e20f9a3f4e2f5c2
SHA1 2138513ee51e851707c29bf1453120f19f2a30d5
SHA512 a2c4f847d6509f86da85c07f269b4b9cfd0e1d6a8c7dcdf909d4ff25f5b5492d80be59e11ecf93269d29c522822a0c5f6de237df1680403f59ec59a621170e03
SSDEEP 192:sxZyRRyM/jK1Ml8MkF/f/sk1xIdpQ6H4316+WNGYwKEmx9Ig5pRJ:sxZyTMF/f/sk16fHJGijb
TLSH
T1FF520911AA34697BCCDBD209FA51BB83D6F9047292900E44A9FCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3bd2aa822a42b6808008a4bdd925b2af259756c5a096263fc579968791c7dc07
MD5 a7e1170b3484c961b6756057cae32808
SHA1 1bd8eea2293bf8b33ca819e40f0d0c3d0a6c36e0
SHA512 07064770a21ce2b2b1fd7cb16ab374ea1f8a5c22273bd05e97263c2a2e981872d6f5c00d1f0f9d900cee069518ff80170eba1bce51790aec77b3833eff40e08c
SSDEEP 192:sxZ+RRyM/jK1Ml8M0cBzF/f/skKpjBLbqidpmfJ5tH4316+WNBOj/YwJYLmx9IgE:sxZ+TsmzF/f/skKh8CEHJC/Jjp9hO
TLSH
T15F82E752662499B7CCDBC519FA357F53D7F9042399540E8C6AFCC90C04EAAFD221B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 67c779ec4d70aeeb6ab50e63e883a92b90f291978209c5f73273ce4c610c735a
MD5 9752705a0881f3dd13fc42bfb6da8134
SHA1 f92e924fce308ef5a6462ee33d7ce89f7ea8e731
SHA512 e1ea5d4d2124a6aee4aa8f58eb3d23db8e6b63476eb79c2bfd2010dea2954b855957d3f6b01e0c837d73f5919c229ebb2aa7477a8d91bac848803e663d0774d1
SSDEEP 768:7M4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dMrohRcJak:7M4jeXmWvmKLEu1jacPLZQdXsB
TLSH
T1A4D20A3B240CCF7E4F844E5CED2AAE976ED801CB6A584D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 cd29ac474e034f2cac0b24e3e239b67b0faecc9a3c50387a47aa3ffc166fa380
MD5 14f75b6f47148b6df471032cd8254a97
SHA1 071f22784a3402c7dedc1006c5b3a0147ffa6c3c
SHA512 88c0f419c4e2b057a80966dd417a7a9f0c77432523d6e203d315c924dca8f4f4111127868de34042d920ec09bc0d7d4721fa002e99c3a350c93ee3110f434d42
TLSH
T10051C74F8E4A2D5AC9AD06B328FA015133791CEE4750CA873A9CB131B8D33791D0D65A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 7347400ada853c1eae902c01173e1400a5f4ad91aee643390eff9f76ce53fc1b
MD5 84bd672c4632325fa71e06d3bfde445b
SHA1 fccee390679dc429310effd23ea28676d66e7301
SHA512 e631bb2f082a2e6a77e3c1ff8621cebd76feeb87232eed2c26c21942dce92e67023c0bc3c894916240bf305bd33294b4df593d8e63287a6f944e15e20bdb04fe
TLSH
T13A31204ECE959D9FE8A844B70573B9B8737089CC4721E32359BC62322E267491A4B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5924d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5924d4.TMP
Size 1KB
SHA256 c7c3c476e5695c79e01c72a5dca3361ef434a928f438bef998f541538d829952
MD5 a23c0dfff2550bee984451fb04628c3a
SHA1 3850a830b9c536d348fd1089ca212a518224fa5d
SHA512 966a8099e4a027367324fe91f9f8404de7d3f3415973633e2bfdfd918717ebafcd304dc821084d7ace10fe19d2b507e90670b6d6ac67a09d07f07634413539ce
TLSH
T16031328E4A918D0BF8C4507B0A63B4F8737588004321B393A87CA2399D25B8E2E4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 b31bfad2d4ec4041dee64f8f434acea760521d44eba28c129819c7cecbf2e663
MD5 198fc476197008bb5d5dff7d8d2c2a08
SHA1 d96933c043cf104eb442d94ec99de16b733d95b0
SHA512 1fefe47358efed1e6586d8eb3ade7a8f54a8841a5d90f9fb2e71ebe1dd9f3abaec5a00b18fe5ba199b9ef88d05e2ae7be8f3b4f017dac936c00dff3e1d745f1a
TLSH
T19DA0026D82805B21C01216FD3596C1C1A316CD1A43572B3756A00048CE51D59CD4110D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 6678aac528e915a5f3ea0b989aa7fccc00246752668fbcb85d2eceffa9d7f30b
MD5 6c7e033f25c014a8f56938eb54ffdd44
SHA1 68e9bc2f1d20e9ab58194b67e51813eae8dee5de
SHA512 a5ecd2dc5c61b04a84622b811de183fab35fb9bca9fb2a4b9c771abde304c237ebca42df4119570d0783b96ffcd41dfa141e5bfe55edeb4cf5fe0fd1701c7f59
TLSH
T16DA004D543C1010DDCD331F115D303451300CF101100D30754D10C4CCC535D44D4150C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 91ce06f22c3cd10ede8e25cdd480b76c954a5fe33cceef1a964bd0e46c38f157
MD5 9d2a621b46a35fac58e11323a92350c1
SHA1 c3b38ba7bf55ba1ddf510fff4bc13c7c4d65117b
SHA512 6bc5b5c7d03b8a50ebe40ee67e83af81ed390713ce4bc20f93efcac905fdcc62a6752aecc7848391a7f88c08d0688977875af51e2b88549c6a9a52b4abd0dae8
TLSH
T166E0D8F62DE72D20ACBF47E628B245A84146F468C555AC8E2416A2E751A12682016C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8c4c501c5270fd792a4a51856d09b03ff2fae4f0ab58bc1e6f2994174b3fe70d
MD5 349d648120f7db82c4637f22eaf7d0f2
SHA1 89be8e8ea6669d2a8ddfe0a0a8d423a01932eb42
SHA512 dc25d0a4ad1d72fc63471b9da505c9e1ab98460d5d99d1c4ee2d5205bc53b8f33b691cae8e12f4f37172d379228971d6f0699f0e3e6cf52c1148e89eb87df942
TLSH
T170A00239CD948441E9044379906202CC63148C9C5705276141EC01B49CA954446A3384
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597a76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597a76.TMP
Size 48B
SHA256 4be566cd487da28439b8ee9218677866f114facd7d1d475ec9b90c594d8fb95b
MD5 d50a939e89eb4c3536d2a481e5f9b666
SHA1 7386369a7d9351b6ab944a50c6986baaf9b182cf
SHA512 8fc5cc98ec05244c338ba7bde5971127a44c071a2b6f8f39f88b2323d5912aa5448a94e68dd52387f6c24ee5c3d1fc266fb12275795e62f3c1b8d25e8b5e8017
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 63b69780860c25f9fa099748473b9cc6b4fadf75736145c6723e2499e9ff7193
MD5 44b49e6f71f6b839dffd2a74e772cca9
SHA1 b5986829185efe705c7e5334664253c472cddf8f
SHA512 04c2cc9007d18e892a60d70aa0c454dd5c784ee2ad9a1e06de8fdaacfdc5de26030edad6c8e858f98c7a688244c13d51c57ae5bfd628b7add8cd7a242b3b572d
SSDEEP 96:KAzWK0YWeJOKa8xlQRFDLL+Fbulzl+KrLzv+HtlGf1fm8:QNRdPT
TLSH
T171914C1234BB53513C7E2A1C87A596669E4271A37428B47B3FE810B50E67E508EFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff805a1e-3884-442a-9746-21fee87b05a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff805a1e-3884-442a-9746-21fee87b05a9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 00af01f542977447529f42ec9a66374f547d3a8fbf9f301dff2ef8a121f9ba0b
MD5 b91d663eaf6b34cff38600fa39ad3e19
SHA1 b3e691fd5580d455d58049b18d7a404784b9d298
SHA512 7966ba28675f68cac5e9e62515c63adf90b4406b3e76b36eb3d601cca6b943553c9194ca3b422f149b0e66b93cb071ea80d31e1c555094c27b2dbb54484ef4e8
SSDEEP 384:4ZcIhsNpYHSjib2c4f+2/d9Y45CFrivfwo1:GhxscgbUriwG
TLSH
T18C827D316C786C771CE6E241F08736134FF881279AC96F84D5ECAB2D00A9AAD231B911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 690039f9445222b0df42412791ef633ea0046b8f5dab44ecbe48733c204555fa
MD5 623fae2cea41a3efca8d1bd8a1a4cf91
SHA1 4b71cc5e63b8ee43987c29d62a44053429ace3aa
SHA512 7d88be9ea15e0bd89cccaa182448b3be5e66b26aeb18427a79d01775b320bfe0e09a52d7fe3f5eef429829ccb61cc214cf8a0205fed938d67ce6c175357f40f5
SSDEEP 384:1ZcIXsNpRHSjib2c4f+2/d9Y45CFrivfwo1:NXUscgbUriwG
TLSH
T148927C716C787C775CE6E241F18736139FF880279AC96F84D5EC9B2D00E9AAD231B921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ebeb6f9901a77b9be5c3d3d3a1de480aa73cc03613abb141f2a41fd1a115365f
MD5 25b9cfadf79f93a259e99a8a2094be81
SHA1 18398b1212b430616820b7fa5f6045f8dcc0361c
SHA512 7be603a7416cde107ca21deefb951e69ae7f6a5ea4ab1b337dbaa6e6eed4f0cb82ec7ad3798a57e386c7db5938085558971b62d386d39211805cfbe02b5f7936
SSDEEP 384:DiFPZcI5tsNL8TUNTUlIlRTRSj9mmckf+2/d9Y452Frivfwo1:uFH5tewgtHmckboriwG
TLSH
T122C21AF258D79836DDAE9743E37E2D034EBCC067B985AA80B3985A1CCC951BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bac5114fbe4b7b7be5b15779c36b1f911592952456ea3115cbc9089b01648caf
MD5 cb1cd5cc5dff9be6c2a816657e0b037b
SHA1 bbde4068a024c262a4f365d9f44001bea9890ff3
SHA512 4bf66e7a4e68644beb9198647d79128adcecc4cdd2ca4c2dee5554429524ed762efd14fc367803b608cfea85f8035320f39ae459063fa8c4d2ca6fd2b2f525e2
SSDEEP 192:EON+V6hZ0QmiUyWYpc/+jV40+Fd9YDJ5wOZWeU6:EONw6oWpu+2/d9Yk29U6
TLSH
T1A902C735A8687C778EE2AE46F48737135FE5112BA9E56F84DAEC1B1C00D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 49bd557e5d2ae9a96c4001442cb26c6e34162294fe968e833788e76d9ae7d55d
MD5 88ab82fede9c8a363a88996f55ecae54
SHA1 74795c4f10512b3dc2f9f40afd5955966fafd764
SHA512 0aa39a4dcc84b4a21761c38c933848ae8d579a61b02b8f7235805807e28b4725e53650d6679fe133e5ddc76845434a831e36892ce6f9df871b639f71915e23f2
SSDEEP 384:/ZcIXsNpRTRSj9VcJ2f+2/d9Y45cFrivfwo1:XXYkcJmbariwG
TLSH
T1F7927C716C786C775CA6E245F18736138FF880279AC96F84D5EC9F2D00E9AAD231B821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2344efb326d068968c4bb0689152585f2b91c2c723c24c3c9008f58b75331888
MD5 a8cdb9046388ceab53d43bb12a473015
SHA1 4638eea795d3ee245673770dca2f170dd3dc0e7f
SHA512 4cce46898ea9d4a3b238d15b742cb713a992eee0098cbe5d1f66189d3d5018b32eeea986f14c99afbc1abb58797a27339f9a62a2a3748de12d80bc3b9d87cbdc
SSDEEP 192:XONc6hZiQmiUyjYXc/+jV40+Fd9YD804N95cOqDrq4U6:XONc6q1Xu+2/d9Y45I9rU6
TLSH
T1CA12D931A868B8774DD2A641F08736135EE5523BDEC57FC5E6EC6B1C00EE66C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4712b1ad16f64ecd8286c18ac28b94d6d34a38916df05d83cbccfca8cc2a9110
MD5 32057ba649da7ca2fbf2f7993b41c56e
SHA1 d64619aacf55484514117712bfbb60a461d02197
SHA512 625e7a0bde52f4438704c52067975d4ede66f5cb1416a16380ba46d005affa05d1caadfc58c067d9ac53a23ef9530c452da0afc6bcb5814ffcaa44a893f59800
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7efadcf18bef589e9f93d15e10328be545ebc267366d85a42eeadb59a955f8fe
MD5 0a121cf849d7f959be2bf8ad64d23ab4
SHA1 bc6ec179ce495abb9c7b4202e371164da7722375
SHA512 61a4982b82419f2c22a1182e083d32ecd53d02cb1d7dcb78bd602a6ab2a5f10ee4984f457a476833f45f68b1a575a32d5d100769ad534826387286f3b0db268a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59740d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59740d.TMP
Size 392B
SHA256 026d25f17a1614c15297343bee6db279f3b732807d4d6d56e8f9eac00fc3a823
MD5 109dad50dfa91faebaec16acf96feb44
SHA1 e2e78b37a189cdbc99ade78085867b4bb95470d1
SHA512 5e31b6904aeb255a8560dd012cacf4f7d7cf741205e115275a2b0b5766b02266fb5412f8d477101aa86d0835451c7c5b84b62c995028da1d876ba1a9e32d9159
MD5 SHA1 SHA512

Submit Download

eda80cca-78c7-457b-999f-d73c5fccc95b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eda80cca-78c7-457b-999f-d73c5fccc95b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b24953750ad884004f4da831a1c0dfe309a2a18e8a2514a084c56a3efd998602
MD5 9cf71aff78d39589221305cc947176d4
SHA1 9372358242ded28100d5319eab80fecbe411cc03
SHA512 e7db7b6acf1c82fa8e426581f6862184ba36fd54ec743897f04cd9154d2717454d9a11e687181b72ca83940b04604ba4b2f1e140ef7952879d694256501637c0
TLSH
T10C411A58B6FA1148B3B76F5A9BFBA86D447AB9372F0AD04D10110E4F0A72B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads