hxxps://myflixer[.]win/movie/hadestown-the-musical-71592/

Analysis

user interaction
yes
max time kernel
86s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://myflixer.win/movie/hadestown-the-musical-71592/
Sample260901-zbptssxblb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327683878192624"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A0760881-57B1-4533-8C1C-8E61835F14DA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{F2069823-091A-48F4-9ECB-92A24D2C7595}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4288	1864	msedge.exe	84
PID 1864 wrote to memory of 2372	1864	msedge.exe	85
PID 1864 wrote to memory of 3944	1864	msedge.exe	86
PID 1864 wrote to memory of 3944	1864	msedge.exe	86
PID 1864 wrote to memory of 3944	1864	msedge.exe	86
PID 1864 wrote to memory of 1392	1864	msedge.exe	88
PID 1864 wrote to memory of 1392	1864	msedge.exe	88
PID 1864 wrote to memory of 4348	1864	msedge.exe	89
PID 1864 wrote to memory of 4348	1864	msedge.exe	89
PID 1864 wrote to memory of 4348	1864	msedge.exe	89
PID 1864 wrote to memory of 2996	1864	msedge.exe	90
PID 1864 wrote to memory of 2996	1864	msedge.exe	90
PID 1864 wrote to memory of 2996	1864	msedge.exe	90
PID 1864 wrote to memory of 4108	1864	msedge.exe	91
PID 1864 wrote to memory of 3512	1864	msedge.exe	92
PID 1864 wrote to memory of 4108	1864	msedge.exe	91
PID 1864 wrote to memory of 4108	1864	msedge.exe	91
PID 1864 wrote to memory of 3512	1864	msedge.exe	92
PID 1864 wrote to memory of 3512	1864	msedge.exe	92
PID 1864 wrote to memory of 1276	1864	msedge.exe	97
PID 1864 wrote to memory of 1276	1864	msedge.exe	97
PID 1864 wrote to memory of 1276	1864	msedge.exe	97
PID 1864 wrote to memory of 4352	1864	msedge.exe	98
PID 1864 wrote to memory of 4352	1864	msedge.exe	98
PID 1864 wrote to memory of 4352	1864	msedge.exe	98
PID 1864 wrote to memory of 948	1864	msedge.exe	99
PID 1864 wrote to memory of 5116	1864	msedge.exe	100
PID 1864 wrote to memory of 948	1864	msedge.exe	99
PID 1864 wrote to memory of 5116	1864	msedge.exe	100
PID 1864 wrote to memory of 1640	1864	msedge.exe	101
PID 1864 wrote to memory of 1640	1864	msedge.exe	101
PID 1864 wrote to memory of 1640	1864	msedge.exe	101
PID 1864 wrote to memory of 4968	1864	msedge.exe	103
PID 1864 wrote to memory of 4736	1864	msedge.exe	106
PID 1864 wrote to memory of 4736	1864	msedge.exe	106
PID 1864 wrote to memory of 4736	1864	msedge.exe	106
PID 1864 wrote to memory of 3088	1864	msedge.exe	109
PID 1864 wrote to memory of 3088	1864	msedge.exe	109
PID 1864 wrote to memory of 3088	1864	msedge.exe	109
PID 1864 wrote to memory of 1096	1864	msedge.exe	110
PID 1864 wrote to memory of 1096	1864	msedge.exe	110
PID 1864 wrote to memory of 1096	1864	msedge.exe	110
PID 1864 wrote to memory of 1516	1864	msedge.exe	112
PID 1864 wrote to memory of 1516	1864	msedge.exe	112
PID 1864 wrote to memory of 1516	1864	msedge.exe	112
PID 1864 wrote to memory of 5884	1864	msedge.exe	116
PID 1864 wrote to memory of 5884	1864	msedge.exe	116
PID 1864 wrote to memory of 5240	1864	msedge.exe	118
PID 1864 wrote to memory of 5640	1864	msedge.exe	121
PID 1864 wrote to memory of 5648	1864	msedge.exe	122
PID 1864 wrote to memory of 5668	1864	msedge.exe	123
PID 1864 wrote to memory of 6036	1864	msedge.exe	125
PID 1864 wrote to memory of 6036	1864	msedge.exe	125
PID 1864 wrote to memory of 440	1864	msedge.exe	127
PID 1864 wrote to memory of 440	1864	msedge.exe	127
PID 1864 wrote to memory of 5996	1864	msedge.exe	129
PID 1864 wrote to memory of 5996	1864	msedge.exe	129
PID 1864 wrote to memory of 2324	1864	msedge.exe	130
PID 1864 wrote to memory of 2324	1864	msedge.exe	130
PID 1864 wrote to memory of 2324	1864	msedge.exe	130
PID 1864 wrote to memory of 5204	1864	msedge.exe	131
PID 1864 wrote to memory of 5204	1864	msedge.exe	131
PID 1864 wrote to memory of 5204	1864	msedge.exe	131
PID 1864 wrote to memory of 5212	1864	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://myflixer.win/movie/hadestown-the-musical-71592/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbc05ac188,0x7ffbc05ac194,0x7ffbc05ac1a0
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,4375212648259644709,7421290298366941941,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,10481903519463163113,1372654955582543115,262144 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,16376440302790103893,8342273636380497291,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13165854543836910555,3577504327284279254,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4283901589669877871,9603102834817784387,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8556298320777562726,7659474025690827095,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15290767934204919083,14188453081761456075,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,13326017058733798949,8915043745707977938,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5096,i,14037454089932739184,5526419218357539319,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,12140663993744124096,14051539476000072739,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10322506895494018398,18298517970303769029,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6440,i,9851428752629577694,8082011668816219663,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,17926711014702168646,4347173169565363030,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,17926711014702168646,4347173169565363030,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6568,i,6332856144520918557,16432056766341094356,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6828,i,16608135853909904563,4812139983306659455,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6984,i,3579539520419576476,9254827504268369449,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5336,i,16646121751904333233,10897644911525755128,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,2687604913609570107,1408750583159777446,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,5968597310178982056,9075006299873881246,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,236733155102545424,5821245217733744975,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,7434510578707917849,9763793050059259183,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,13742754732915875000,12136464492615397038,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,2383723192201888413,17031263051457426803,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,1707301868178772322,12865268237317698363,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,4682469711959167689,4449925425967667284,524288 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4564,i,7418135728141534309,4428838117382468617,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7224,i,8111933272542853130,15767223094012541907,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7384,i,13034680517076086049,4015600542636116834,2097152 --field-trial-handle=2292,i,17444296686585546234,9757906341378309655,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b34ce1da9693521ef33ad2d2a732ceb82878912583c5829467bdd1df59ef2188
MD5 1419434ae7686e2d3050e79472f35d65
SHA1 953eae7c997feedadc00ec0e4e80b53c192e20f1
SHA512 fc2d704f6255b29875e2f905b0938bd54dcb54a3b98b5d7a5472f6d7bd003bf6678d5b04eb5394e9db69178bbabafee73a8c80f30d3c0faf331bf094b4bc3945
SSDEEP 96:0uh+OwgYptoT2BkEUtQsBBBDG+x6SBDb92VJp3d+3Jampp7XIZUN:SD+vtv1oc9pp76Y
TLSH
T192C12DB45CD90C59FF344A32A0E00B66BC7166DBFB9B1F47234DD668A6033CA124E55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d414.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d414.TMP
Size 3KB
SHA256 94dc31a37dce56e821f357e2b6017554e2ba24b4d6891481481558e0db2122c0
MD5 e24c369040d0aafd3974700a2bd836cd
SHA1 6026ce503a990683fd54dea5c7e86d1a75afd43d
SHA512 cc3146dd2c37ac4276c4a999d18c59a89f28eda78f2eb8e9565a277844c56790dbeeea9caede50e81cdcfe437410c422e8fd2a1da1b04d775e986558bcc095ce
TLSH
T1957127340E0900A1FF200A33D4D50239FC72AAEFF61E2E56234D66B5EA0334A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e51de9a8cd2a833b2aca1c8bb94091cccf3c3d9ddcc47eb3c59725952c5545c5
MD5 cb21ea2da0798a4264ca593218d8407d
SHA1 309ca1d3079aec7a0935bfdab86e31a7cc0466b9
SHA512 24afb10c1b11ca6ce358f5eb523dd501b21a356406065517ad8ca098ee9ee111f87b61130492aa6934673c8f3d09364223fc4642081304abbf2000c508ca5a9b
SSDEEP 192:Dw897FQ9jRyWxWLU4AHT0V1pB/VjPW89hVpBhNb5Ax0DQSAyELX/evIg//G4omYt:Dw897FQ9NyUWLU4AHTE1pB/VjPx9hVps
TLSH
T1E7327AB683E4DA6D8D1195F1BB146E1BCE1D0D2403283C2E99F8AE1B97E3471D106A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0d3a1d514b210eb2f68eac1bb8dede0d4752385d87c161f2825a6e884e0d5046
MD5 7d759fd9175e0e0319a66607329e91be
SHA1 7f518c04b84db2641835fb178b77589c22aefa1b
SHA512 b5f6aefbf512c5471a6f44f372f1b89d8c1c3431d0d49bdbb71ea9598f66c72397dac3a037cf2c768f712af41d25c0b2e4a9a55b7e2cbf19298c4ac0f77b2d44
SSDEEP 192:sxZCRFyM/jK1Ml8MkV/fNsc71vnV3IdpJlSRRHW6+WNZUwW/Yvpj9BuIgrJ:sxZCLMV/fNscdm2Hbs/8Y9
TLSH
T1F052E952AA346977CCDBD20AF955BB93D6F9147292904D44AAFCCA1C00E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9c0efb4f71046cd318c1b434932c95fc808884f5896d7a3035cd80613b36a561
MD5 52fb89146779b018b271211b5e94aa83
SHA1 49c99a90b762dc1655e08ecb5aa79fca8499422f
SHA512 c663f4144d0c8e25551811ceff317f7493c875eb76b1cf14195cf53e8c4fafb85f1088c5cf200ff278227bfc35cdc6914a922dc820bf195c5edc9a19c5fb6750
SSDEEP 192:sxZCRFyM/jK1Ml8M9V/fNs27RvNV3IdpDcPvVSqoRHW6+WNm1EyWSuVbYvJuZBuH:sxZCL1V/fNs2BQDXHbAKbrYH
TLSH
T12162D852A6345A77CCDBD21EF941BB97D2F5646292904D44AAFCCA1C04E7BEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9f7402299fbc9a47a482868012436e40a1b4a87a76dd9a74714245c374d1ec9e
MD5 37c278c684d51008e1756ce6b2251c39
SHA1 4b9953477c02dc6a99c9c184f8ce27af32fb5238
SHA512 9bf433ed5f4fbf61a8e449a7de5926ea1757599bbc0644f869589707b6cfe1ebec0955d576f9ed0b94bf87bc33e32826caab6d58ec5c2b7cbc11ae886fbf2299
SSDEEP 768:aAseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pptro3G:aAseJ3xWvhfynu1jaVcL88pGW
TLSH
T114D20A2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f0740d0033109766be0e2cc718fd432bee0b4e84e18a05d702d925b6d8478f3c
MD5 4b31eb01c857a2c74b55489339fef68d
SHA1 da4f19ba1e46af94f101c86b3fb1b27c59ce9bf8
SHA512 87133adca683149230e7bf2c4fd8f4b4e9688b975c82f2964f58b00ebd390e04e2d4277186876410107eed8ff8df0907a9b243ef9706e0d75707574982a874dd
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiwY:KYH+KggmiAgK1KyODKKkU2yesKLiv
TLSH
T1D2C1A712713F02023C7F355CB2AAA6375E4135A33558A8AF7FB800655E6AE116DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\7cf23ff7-ef3b-4edc-bf1b-a1085b88b157\index-dir\the-real-index
Size 72B
SHA256 7e42a8a33e4adfe18202d18a88d51f64b0fccc80460d02adb1e6cd2a8d130ddc
MD5 fffb3582299b32276ccf3ea01d4f8bd4
SHA1 aa1315d80e865cf0d7d09be0e28aec7f5c9369ca
SHA512 3224e29e9a1678be24b93f7d4375b7c83e8f2537bc25326b7cf44f5e62b80539e514c08f1598bbc664f05f4649a7952d14b768e63dc64d3a71eaf3aed31b7259
TLSH
T145A0022515B15127C080037220E1418C7BF0D8A303435A4950D444A598697844996439
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bce2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\7cf23ff7-ef3b-4edc-bf1b-a1085b88b157\index-dir\the-real-index~RFe58bce2.TMP
Size 48B
SHA256 7029fa5abdd9f97d1e61cad4a7b8d821553403870790b920ae16d5e34cdc6299
MD5 a073b933836617c695373da1fe72ff19
SHA1 0da91d015316c67980e05cda77ebecc229ce4038
SHA512 8227aa530fa4f0fa97a9d483550b0f588c6ccd694d727905371ab6c32d3e9fe3c88b23c5613d28577912b8ac70c13d573918ebb877f164b86d870f330ff97ddd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 167B
SHA256 056a1dd80b7574ee5fb65e5cc157e55c361ad9c4566501893e6865526438e6c6
MD5 bdc1420adad9684e99cf17b9b6bb3634
SHA1 c5bee18b332ab66b05ff4746c362d527856f8aa0
SHA512 b52d20ef2d1c03776a6fdedea78d2fecfa316638ee24727e806c51877ef44d07756077ff20eae5a7b0b5fcf1aa66b45d2588f425c75973d24414664e436b2390
TLSH
T1FEC08CF79AA56908236882B48820F40AA613470E1CE86A4E9E210810803033AB2CBF82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58bd11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58bd11.TMP
Size 173B
SHA256 451436489140ea18f6678bb9286f3efcaa7a751e8cbe5272b5652508b45f403b
MD5 1ef23b8bbe4bf6e8d624a7aea97d758f
SHA1 80429eb5133164ca1f99c32d2464769b2c62ddf8
SHA512 8daededad94a350c1d5058f94277dbb6fc2da254314245e7c3234b048d81b35d86515b6c7ed3c1570bf76d36f6e567ea10da8d13e857a120c39b071975bbc61f
TLSH
T155C080F756A5180C23684174C430F00656234F0C1CD4564D5E2134108030337D2CFF41
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590a28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590a28.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 8e05a7eabefd29b93330a1e184c28c43eeef68ca53ba798b13260b36ec57d455
MD5 c098198357dcbc578bc336a783a604df
SHA1 cbd0c33fa4b294e29f3cfeafd279074e5e5cac3e
SHA512 b57a10dbdbaf472cdfbab51785584fe192c439f87db1f0d2816a6b02bc2fc0ef3378aa9529e8bb57b9344782414459e879ac5242b89b6ac85df860d77a16285b
SSDEEP 192:u2m+xasuheOwQxMGsNxTQ9in3ZM77J0QmiU1J7To8BMTW0+FdLuhpFd3EZa8z123:gZcIhsNxTKSi79Ero21dyZdUB4pl
TLSH
T152627D716C746C7BA9A3B146F48A37135FF89027E6C45A50E6FDAF1D00DA2B8131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dcdde8687e4cb784bac143f056220155d84c6f42cd16410c759ad151b1eb47df
MD5 9e8a668e7d3f852aa6d672d7b433b509
SHA1 28b7501a31723cd9b740bcd6ca33ff9d449fd302
SHA512 662bcc0c65a2f965fab5af57fac6078cc7da403f33e205298ef5b07afb042bb9544edcd8e7c9d1bd03f4d4a56a91d71adac6b4148e01b3f8bf2b3da44fdac4fc
SSDEEP 192:lON06vMtPQmiUyJf2ThTW0+FdLuc847SbLU/u:lON06UtRHTudy+2LU/u
TLSH
T149020935AC786C6BEAA3AD45F48A27175FE4607BAAD05B50EAEC2F1C00C765C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 038d08b1890475892d3c0e73cab57b0eab898953182a66e848f2d3ea9089aa23
MD5 abdf9c25ca6809e27d0e45cd34d72494
SHA1 6e64866ecf8e897786bdc1649f632dc1ff2fb929
SHA512 940beecd9d505cf62cb5831f89d6790962fcec16d064d32f13aca79e749e0497f8b80c500665a89000aad68099c56c2fae6126140023e929a6cd405ddee6c018
SSDEEP 384:HiFiZcIksND8TUNTUlIlyKSi79EZo+po21dyZdUX4pl:CFQkGwgv1qo+po4kUX4pl
TLSH
T14EB208F248D7983AE9AEA747E77D2E038EBCD067B5809550B7D95A0CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e50ad224ff91fbacb9ccc7cbf2d2092af6bd0d59c078990fdcf6a8db1dc4440b
MD5 ef8e506f9ff1bf63aa2da64fdc134f95
SHA1 303624a73cd1ca58cfe4bae16ef0f9b8b9c15de5
SHA512 028574d98e94d5980d0ae42a1a380fd5160819479ab68e5cce90a9ec861c34216db06902871011b2d6cef8331e58f799ad7d7bab3d3012c001e02679dc532fe5
SSDEEP 192:uAm+xasuheOwQxMGsNxyQ9in3ZM77J0QmiU1JuTo8BMTW0+FdLuhpFd3EZa8z123:aZcIhsNxyKSi79EMo21dyZdUB4pl
TLSH
T1B7627DB16C746C3BA9A3F146F58A37135FF89027A6C45A50E6FDAF1D00DA2B8131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 364a6b5d5fb917c7e4c46a35b3bc4b624637257030b6fd0a92557f8aade90d6a
MD5 9576a37a698d6e63d6722390c8b9403c
SHA1 cb6932960ef76837b2d2af4a27f00ce6fbd27ed4
SHA512 97071a342510a5efc2f6c7c58b94655968016e5064303c663c1b47ff9cea4458c1802f82868604901f81318a28148c6afff46e800901071b4897d5f50fb688a4
SSDEEP 192:aONs6vMjPQmiUyJi2VhTW0+FdLuhpFd3EZw80I2rqEU/u:aONs6UjRsVudyZdUv4U/u
TLSH
T109122C71AC686C2BAE937546F48A32575FF0912BDAC46B50EAED2F1C01DB6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d7e7a7064b17b215e7da6bd9ee46d5264e63e7450ebdbbaf1f5e4dbb59175d4
MD5 ea68390775451a586e88af4dfaa8e288
SHA1 27f92f63d5db8b473f62d7d81e3200dda7be61d8
SHA512 dbe1462adf6d8a80273ae3c3f2f195bf46bb3f898a17149299c147320a68b6dcf2b4037dacf76812b62433b8714fe162e4b4a37914ce59c3ff08d21d89ade2fb
TLSH
T108E00203E70104E8C028017040471F210F83C438109007475F30015D3C75345BF209C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e6882e2f420be78a52cff6f428fe548c1441b5ebfdd0304a9c088ec801edad63
MD5 4194e16080d60e00aca2dc895d03a004
SHA1 6183ecf5e65fc1eccfe22c5d1d082f941b7ba866
SHA512 dd598c7fe23253d19b8ea589b2f1f8f01fdd649d8c360285d4fcde4a87fb207432eff97ddf7584e68e217ad6f17d9edaa06f525c4ca06f0d4777371e05bfdf0e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5872f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5872f9.TMP
Size 392B
SHA256 a8d37193b20546c8c1994a7f8c0853df4f4eeb407742b57ed10cc34ed439345f
MD5 3a8f22be59013dc1391692547c23c645
SHA1 5886c9d4ccd0e1542500becb758780277db97c58
SHA512 8ad4a1fc05ba59b4d2ea0b0eb66014abc060daa7154e3fdc37d1544024af32f7164b4aaccf7c89d2c59c4d361f55a5d9c6ebf2245b39d140b19f3e01aebd6dde
MD5 SHA1 SHA512

Submit Download

290ecd86-d4c7-42ef-9268-c1636b2d3e42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\290ecd86-d4c7-42ef-9268-c1636b2d3e42.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0bb31689147254e4f985d86b3497444cae5a05a025f046377284f56a6b610989
MD5 3dc0c408ad3da9eabacfe737ac6927ef
SHA1 5e0b69ecf5dc07001060a12569c617175ea719d6
SHA512 eab14267f810a6ad386a2784d7b5671d74aebacc8ed85077a0787c895cad743a335ab142e6febb8b9d674eef53d3f435bc936c167f12eadbfdcaa458b7b20a51
TLSH
T1C2410658B6EA0154F3B76F1AABF6A46E587F78772E06D45E10110E4F0623B00C8A1777
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 a74f777bb41658f85b20f636e7922a81c4d6780490c5a2dfd77289a4b7dc1ff0
MD5 4e10b1bee59f4b060cb11832e281c906
SHA1 8c1ecb0974cfb97d4a1ee5595dbd44b4c385f529
SHA512 92027973086357a567efb7645d7f5f7199f330559a5c8c74f3bc47935496447f00a88873a331789ce4916b606e179071929518c185f26de5eae3c3e46b7065ca
SSDEEP 96:3JQcZrJqbMukREiFQMrJaiTYNHwhkARzrWxDQMrJrukRK9ikQMrJnIukROW:WsL64LN45v4BID
TLSH
T151020E046BEA0646F2F69E71A5727B11FE3AB80A5D188A0E1280410C1C73F44EA6DB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads