hxxps://www[.]simplebooking[.]it/ibe2/hotel/10214

Analysis

user interaction
yes
max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.simplebooking.it/ibe2/hotel/10214
Sample260930-wfeb3sweqf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{31161908-7D83-420C-AD1A-BE09D3588CFE}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3964	4552	msedge.exe	86
PID 4552 wrote to memory of 1692	4552	msedge.exe	87
PID 4552 wrote to memory of 1304	4552	msedge.exe	88
PID 4552 wrote to memory of 900	4552	msedge.exe	89
PID 4552 wrote to memory of 1304	4552	msedge.exe	88
PID 4552 wrote to memory of 1304	4552	msedge.exe	88
PID 4552 wrote to memory of 900	4552	msedge.exe	89
PID 4552 wrote to memory of 2268	4552	msedge.exe	90
PID 4552 wrote to memory of 3432	4552	msedge.exe	91
PID 4552 wrote to memory of 2268	4552	msedge.exe	90
PID 4552 wrote to memory of 2268	4552	msedge.exe	90
PID 4552 wrote to memory of 3432	4552	msedge.exe	91
PID 4552 wrote to memory of 3432	4552	msedge.exe	91
PID 4552 wrote to memory of 1500	4552	msedge.exe	93
PID 4552 wrote to memory of 2296	4552	msedge.exe	94
PID 4552 wrote to memory of 1500	4552	msedge.exe	93
PID 4552 wrote to memory of 1500	4552	msedge.exe	93
PID 4552 wrote to memory of 2296	4552	msedge.exe	94
PID 4552 wrote to memory of 2296	4552	msedge.exe	94
PID 4552 wrote to memory of 3764	4552	msedge.exe	97
PID 4552 wrote to memory of 3764	4552	msedge.exe	97
PID 4552 wrote to memory of 3764	4552	msedge.exe	97
PID 4552 wrote to memory of 4940	4552	msedge.exe	99
PID 4552 wrote to memory of 4940	4552	msedge.exe	99
PID 4552 wrote to memory of 4940	4552	msedge.exe	99
PID 4552 wrote to memory of 1768	4552	msedge.exe	100
PID 4552 wrote to memory of 4604	4552	msedge.exe	101
PID 4552 wrote to memory of 1768	4552	msedge.exe	100
PID 4552 wrote to memory of 4604	4552	msedge.exe	101
PID 4552 wrote to memory of 1708	4552	msedge.exe	103
PID 4552 wrote to memory of 3784	4552	msedge.exe	111
PID 4552 wrote to memory of 3784	4552	msedge.exe	111
PID 4552 wrote to memory of 3784	4552	msedge.exe	111
PID 4552 wrote to memory of 1384	4552	msedge.exe	117
PID 4552 wrote to memory of 1384	4552	msedge.exe	117
PID 4552 wrote to memory of 1384	4552	msedge.exe	117
PID 4552 wrote to memory of 3120	4552	msedge.exe	118
PID 4552 wrote to memory of 3120	4552	msedge.exe	118
PID 4552 wrote to memory of 3120	4552	msedge.exe	118
PID 4552 wrote to memory of 2972	4552	msedge.exe	119
PID 4552 wrote to memory of 2972	4552	msedge.exe	119
PID 4552 wrote to memory of 2972	4552	msedge.exe	119
PID 4552 wrote to memory of 3784	4552	msedge.exe	120
PID 4552 wrote to memory of 3784	4552	msedge.exe	120
PID 4552 wrote to memory of 3784	4552	msedge.exe	120
PID 4552 wrote to memory of 4316	4552	msedge.exe	121
PID 4552 wrote to memory of 4316	4552	msedge.exe	121
PID 4552 wrote to memory of 4316	4552	msedge.exe	121
PID 4552 wrote to memory of 260	4552	msedge.exe	122
PID 4552 wrote to memory of 260	4552	msedge.exe	122
PID 4552 wrote to memory of 260	4552	msedge.exe	122
PID 4552 wrote to memory of 2176	4552	msedge.exe	123
PID 4552 wrote to memory of 2176	4552	msedge.exe	123
PID 4552 wrote to memory of 2176	4552	msedge.exe	123
PID 4552 wrote to memory of 736	4552	msedge.exe	125
PID 4552 wrote to memory of 1056	4552	msedge.exe	126
PID 4552 wrote to memory of 1844	4552	msedge.exe	127
PID 4552 wrote to memory of 3784	4552	msedge.exe	128
PID 4552 wrote to memory of 3784	4552	msedge.exe	128
PID 4552 wrote to memory of 3784	4552	msedge.exe	128
PID 4552 wrote to memory of 4316	4552	msedge.exe	130
PID 4552 wrote to memory of 4316	4552	msedge.exe	130
PID 4552 wrote to memory of 4316	4552	msedge.exe	130
PID 4552 wrote to memory of 208	4552	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.simplebooking.it/ibe2/hotel/10214
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fffce4dc188,0x7fffce4dc194,0x7fffce4dc1a0
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,7589201224165201756,14576504818901423038,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,17820845120453280543,14446498463859845578,262144 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,3683134065435057433,8255875543392472297,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15796461568844313269,13998506428432674889,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,18383371666092864568,4903320795278918722,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,7556687892035891950,1085337521289632161,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,3702074037675297554,6512327326687353242,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5044,i,7882212746467806538,14720067879602127949,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3448,i,17257882220075586881,17120546939839964038,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,16135407002145003119,14652397075866503560,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,14372642122744846015,8448221281678150313,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10447044424159991803,11356061109920199721,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10447044424159991803,11356061109920199721,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6456,i,6786348215171606763,8335085864721494620,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5348,i,4478538761512233359,18032098434835207640,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6076,i,18399209760209962218,14629807623240928904,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3576,i,16920320793461053752,10915036086749649757,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6588,i,6096956332107747419,3393049848086890581,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4184,i,5294552685339393227,12992318300870107642,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3732,i,5544713117678726348,7757725750576491988,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5284,i,16311616495283014186,11916155636815527301,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,18183563947495705769,13678840363890021360,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,10311033179417424520,10550444682388797318,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,9003400536515954259,8975459365784572612,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6492,i,9104295555176151763,14866313040001802500,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6088,i,5131926602853552382,13570140417569475306,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,2136876217220467790,12661742446821261586,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3500,i,17898755479336764132,564469786900170884,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3528,i,11489710929587454858,5684937213019630206,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,883688799738068667,7695627869887476579,524288 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6220,i,13269854482842558099,7774272884790041476,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=760,i,12389981930079612841,2849980165837266109,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3528,i,14837572059183551360,9703178512380933515,2097152 --field-trial-handle=2264,i,17335855860184113590,8901640910040893043,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17af66fd342962e87eaf2cdbe67304f045fe55f8932e3c9f61b3f39c10c52c04
MD5 30fe6384a9ad37426ff0e119dfc10058
SHA1 6bdb0bc8090d89bee09dc4ef959f1ef9f8f8f512
SHA512 7a1312526d41453ffbc64b98fea2d6327100ba5de5bd59ff8464663704fdf7ce4ca85cc05a674effc87ce1fd1275a339d53f0a9b76f0709ebc56ae7b22fd8f33
TLSH
T1D461978257934C90FF9885BCE1C5258B39B0E54B9FAB9E5F0DB8C87B583A314D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 52e518ea3719d7dfff807fc10cdfdfb78914e71924a55c1f9e0af5eaea6c948b
MD5 570970cd10c10ea0cb7420a5274d1e84
SHA1 298ad053463ea937cfdf4b147b4ea1f8bfdbbb73
SHA512 5f93eb413449b5f12761f62ea3f87883b493201394a23e998bd988b6b8f6d6ddbee3cf1dd88e766ebbd970a301ec3e2ee71d191547c896534d8d4ea87eceaaef
SSDEEP 96:yRGZEb34dmXUnw+6k6kiSUfF95csIgkN9SL0wKl9EV3E:MG2b7XUgkXUXKsIgkLSL0wC6m
TLSH
T1B5B1DD8793924852FF54C2BCE4A01E473868B14B2F8B2B9F1975DB6A3E33791D11E2C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591ae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591ae1.TMP
Size 3KB
SHA256 a6ff19445be2f15fdf4d24a1bb8f202a22ec87e7d55239e8f8b10a48d7136d56
MD5 72ea6fd005ac221cf641bde638815897
SHA1 66c24a789b002e94ffc9d094edcc2abb5b6d0703
SHA512 81981a7881f054aeed1ac953fcace703ea719f3fd96afa4f5b1f5da01b1b5edb9933f518dabdddf07ab96be5b19af266f60d202c12d23125de23f77c625c0d49
TLSH
T11F61958257834C90FF9885BCE1C4258B3AB0E48B9FAB9E5F0DB8C8BB5936714D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 21258eaa81be93b88183d127d46403adb08ef76c223cfcd0e0c38df0b80d662c
MD5 f4b6efd7394c2f736fec867cda42131a
SHA1 90c835d0d9ddcd3a6093f1ecbd945b11c5d425f6
SHA512 b60bef483b73ea9300b4f2a9c4de3e6d36a7681699bb242d82bc2b8a433b64c6f6c4e793d21b3105b00366dfd0dd84a482fda172210102eda1034bc3579f6c16
TLSH
T1905189F2C3E6816DD91196F09A14AF1BCF1C0456436C3D4A89D4AF5BA3B2471E152B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2d9802ed4af804e57596fbe6d9ef17e4f76b6a2e8bd82ecb2268eea94dc89845
MD5 bf47fa0e32b47846de255731fea989be
SHA1 13272e8849575708e3098119c1bd2066a77bd482
SHA512 a7a4025be3f96aedb1202aa9878d1f1f66f301ae5cff769fe772a8cb91a5c9f4aff95c375235838a73d43050c3b40a0f15ae3fbeace2de28f170b9b68d3d1f54
SSDEEP 192:sxZfROW6/fVsLTC7Idp7MHW6+WN3Xl/YYBhIQIgrJ:sxZfn6/fVsHCkAHbl/fF9
TLSH
T15422B8526E28A57B8CCBE21DBB55BF13E6F9503261D01E48EAFC861C04E6ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 906d2756d14a79924af5ead38747075520310cc20d8023256c0225d2ebb40a8e
MD5 e8447183103fc042ede1772741e0e295
SHA1 cd7478826877ff07f8d3577a2e12790efa72c0d1
SHA512 149e717d2d270ca64489b8ed66adfbe91a821d51d389ef69d3e979c2eca6daae1dc9db644738f117f4aa5a4cd03d8f1eeafc8328afb3b34872e312f7c2dc2778
SSDEEP 192:sxZfROW6/fVsOTC7Idp7dHW6+WN3Xl/YYBhIQIg5aJ:sxZfn6/fVs0CkZHbl/fF4
TLSH
T1AE22B7526E38A57B8CCBE219BB55BF53E6F9503251D01E48EAFC861C04E6ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2204a1bb29db932ff2b418c67cd22a47b22fe926b71b8cfdf4027e6e2c2891dc
MD5 4ec88e2632c22310be51a19077a9c206
SHA1 4219ba7cfe979135cf35c1d30a57bf11e0e2b813
SHA512 19805646093a42326d0dfa4e588827b9b3332535c278dd9a28f3d29325e898184e32b92b386b8d4834dfa1483650150dbb72a533754fcdb1663a3b4c7fd094de
SSDEEP 192:sxZfROMO6/fVsOICobredpmW3EHW6+WNBGl6Xl/YYBKIQIg5wJ:sxZfFO6/fVsXCwuZ0HbCE/fii
TLSH
T10442E9526A28697B9CCBD259BA15BF53E6F95032A4D41E48E6FCC61C04F7ACD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1ce152ff31d9a834457e8c3ff68bd0069e9879abaf733840f65166a56747d8cd
MD5 eb7e13991eb05148c3ddc70bd022f3de
SHA1 b767e2ad3696178d6fbb5a7e5078abd1195591a9
SHA512 0ebc4ede53298cf60c831561c9517cb38d474939c4523b03914a85ac563f2f92a8f6203108d0592376b7f9e5813dd141bc3c70f1921db4fd1faf1bbebe5daf61
SSDEEP 192:sxZFROW6/fVsOICHabrIddpmWmIEHEF6+WNBGl6Xl/YYBKIQIg5wJ:sxZFn6/fVsXCHa6ZGHJCE/fii
TLSH
T1A142E95269286D7B9CCBD259BA15BF53E6F9503295D00E48E6FCCA1C04E7ACD2307C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 23cfd73c0c3ec97b7261e07231c3fb9ebe062d111d6165bdf3178a6622c5e6d6
MD5 630bd8e9091dac0ad4d5cc06e2a309d4
SHA1 717478769049ffca4c48c24a6705d52f8a6e06a8
SHA512 dff7bb89afbaa20fdc4ffbebda17fb57656375c1bd0fd24867423bb0beed27f2b06ad4502d675b4881066b01fc315a6919c893b234eecd72ae8293f8c1f204d8
SSDEEP 768:4ZyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX7roptlp:4ZyYR7jWv3NpBu1ja/CL8OXIL
TLSH
T1D6C2E92B644DCB7E4FC01E9DDC5A6F9B2E9802C796548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\the-real-index
Size 3KB
SHA256 2518d0d4df82f7c69a0ff54016813348ea372293565732bf9828946b867ce3b9
MD5 e18598f422c79fcf2574bba5065191c2
SHA1 ea5a31d1b287b3cf2e018c22ba267f330202eb37
SHA512 96b31dece5977584aea821bc7df3bbfdd80bd1262748c3a19f354d3d7f8f6d1efe48067c14dc83e71d7f9e08934177e76367010b35aefed127477badce614191
TLSH
T1C551C70F0E132B16ECE8627115BA044A37B4A6CC5B595D1B94FEA034F8C3B1D2D69669
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\the-real-index
Size 864B
SHA256 06c69a258bbf3b0512b5d9b125a32a4f5bc6a5fd322f290e342bcc3d9b47baf1
MD5 7f9af9f99b6c0c9ff28dcdab027e90aa
SHA1 ffe092899632b8baf1a5439ba5341a5b66c058b1
SHA512 08f243a027a0657e202d55b208a7f32c982e571ebb971abf4e63405598c7be5afb882ae853921aab490a62b739c3acb6e74c05af5a969212fcf459df4a7d8f04
TLSH
T13B11DDDE1D534A9BFD540278243DDD86A27902CC1310760FA1AEE12A8CD7B407E81AA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594ced.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\the-real-index~RFe594ced.TMP
Size 864B
SHA256 6f62170e62eed18a67a26d642ab99a9d2508c45de5b558b48cf8f8aba1581212
MD5 64f1ed6cd7a660e5ea453c236c96b30d
SHA1 910e1b26f7865fbe340e12874cd4d8cae52c3c62
SHA512 4eb9eb3da19ae902e0b2c944bb5763e72eed8539c86ebc48c6ff4215868da535c90e3a6acefd1b256c5baec3c5dfc5cadd408ac9e86623b9ddc629ef80b1bba7
TLSH
T1EB1141E901638B0AFC4803709A2CE946717582485344674FE3EBE16ACC82B84AD82FF0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f76e46e8-555c-4cc8-b482-de7c9c3dcc83\index-dir\the-real-index
Size 72B
SHA256 b4c522676211e3bd169cc5977a8095762f28fa9868e2d8a700ba2a21ab69e0b4
MD5 6e2a6d61bcf38f6f2d864516fa817570
SHA1 2766718a1b9b05ee2429e89005d32fc3132263e4
SHA512 842c95de32dea50b12c596bf90c12990541636963d39eb96642a87f28cb6bf2dffb6d0845d75c9d9472178683d42c35f6c71b985c6ebcc96303a7159091fb857
TLSH
T1C4A002500F860006D52611B1355222751300C8601500630748A79554CC728504E4520C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f76e46e8-555c-4cc8-b482-de7c9c3dcc83\index-dir\the-real-index
Size 72B
SHA256 ba91dbd3aada9932e1ed80ee1ed44f08865d95cca320ce3a0923d89b8ba260de
MD5 e34de7360f0e98e44893b07ff7446e55
SHA1 fc88ba0862ad0afaca82ae226db5e69111c295e0
SHA512 8982a0fc6ef6a0a480620d703188fdb05ffaedbb026f3620b97868e833aeab809d0e6aee29c1f5b8b3f129a8cb70301d36e54835478f4836af48b66c14a7fc94
TLSH
T182A0022092800112C0032FB12BA60383B754ED2A1301670BD9960954FC50A41496130C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 35d33e8be99bda9c4a7654ffc5236103a14bdf9bf46808f0159dce966f675e06
MD5 552df36f08ac70a589fad4e9c29d8592
SHA1 37bc411993e755ee7a261dadb5977f21f137e56f
SHA512 accbbf95c5c6b64aadf8d4811a3d96c73e478da3b6d8d0cbc756c2672c234a69ece5bc59fbd538b0690ff7226df91b363a6699d9299f8e0e3c91300fefd7bf4f
TLSH
T189E020FB2DF71810E96F83DA207094608651B454DE45ED5F5415DA9311B1369344DD22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d3077e13b8c93015ecc700437d68a39af2bde415ecd04512ffefc6553095cb37
MD5 23c50f7a24a74f3d246ef52b02f2409b
SHA1 5794fb1fe10aaf24aba606dea0bf34f38ccaeeb4
SHA512 9d36d9ac34ab47f040e046cc822c15dc39f45d9a48841bd8780c5d49f01c27f6dfa03392d7d0bae921a5cc897235e5a295ad2b4c5b793bdd3373d8eaef06adb5
TLSH
T1A4A002119E499002CE20267554A67B4037D148AA4105139AC4DCF1A8EE93970D5C9961
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a3e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a3e7.TMP
Size 48B
SHA256 ed76e4243dc8d26e37221cae324fdec6d063ea0291fa5ee25adc150c87723289
MD5 dff7d458a8a2cbb9fe0f1a62e14aff20
SHA1 fdd6c5e378b7b24690ba44e1fa2435586bf1fd97
SHA512 8ee269fdcce4e97a0c45f7974b990fecf8c01d70314bbb3469bd51a47af5b0a2016fc89b11b3be823a9bb733d0fe55ee8ce9b231cc0711d5bc9f71991e84fff7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 132e9f96b9beda958b75edd986fe3a8e0115a6ff81a08418cca3de0a901dabab
MD5 62b6cabbd2b81eaee04b24f26a7c8375
SHA1 98b660946a8fecfa6a8228b53ce09e101cdd71ed
SHA512 8911cc5bd04bffdf50bdd380db89ad0f42345be8f62277e2bfd65cfa0bb26a2c7f24dc8e11ee3702080a6e107e12d18fe37d06478f79ec54c428b4d749be4978
SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHYYs:KAmYKDKmut+KmsNv2KEkSV
TLSH
T144912111717B1245387F658982A4D67F468232A73558FA3B7FBC00628EAFE445CFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b53d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b53d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 368239643a1bcfbd6bd76f798fd78db646d413bb2e86e3eb3b390bcd65eca431
MD5 cdfd6f2ece626791a606670c2a4d15b1
SHA1 fab50952c887b279978e7588727eef109ba9c216
SHA512 fe8a98891c1ac58afb471cb4d88538d2e938f3e77762d4b916602c88210ee348d44366d11a9ba3de66b60bdbdc4f875a4ce79cfce404444d9eaee551ef51a2c0
SSDEEP 384:5ZcIhsNMeNd2iRvnuQX5+DtE8A1WpXMAjxtgOIwZOy9Lxot:Rhod2cFkDrBjxXsG1S
TLSH
T115828E31A9B89C7B2DFBA585F14632035FB49467D6C8ABC0D9EC6B1C01DE6A8130ED12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51a92e3f2d42ab6747b50f9a1e65a77e4a6795c704d2b27759beaef9298c1013
MD5 bcedf00820085d4ef545f043d56f3772
SHA1 26ffa8b067732ed38018cc469a2ffa8ac3553b86
SHA512 5548ac09a376d9e4b151a8ccee10df32ef877d4720425632f6021570e64956877bba56ac3c15ec30dda7aaf5d868ee26372a78f867af56692bf7e926970550bb
SSDEEP 192:EON76nnHGQmiUyJLQYcX5hQDP1UjzorA1WXMccGU6:EON76nCeQNX5+DtE8A1WLzU6
TLSH
T10902EC34E9B87C7B9EF36D46B08633136FA5216BA5946BC4DAE81F1C00D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8bf2a76d03a69a37465dcacf75c7ee25a047f56fd83159e8570bd554f0ef6373
MD5 40901f7f73bd050b1995e8fd2e68b29d
SHA1 e6e2582282b4bc758529dee75a330ff61449bdad
SHA512 4ce5eb804d67cecb09b4dc93b4ed0ea9e2b2d6da37b428fb5e3699d33d02ee7b1a7bd9d1e71236a5ca13ed99a2a18f1b8f4010bf969870caa0ca2ae24bdf1731
SSDEEP 384:RZcIhsNM3T5d2iK0nP2QX5+DtE8A1WpXMAjxtgOIwZOy9Lxot:5hFd28P9kDrBjxXsG1S
TLSH
T11B828E31A9B85CBB2DFBA185F14632035FB49427D2C8ABC0D9EC5B1D01DEAA8130ED12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e35e8f67414233dd9b14a57475aafc26a22d4e76dc3cb11094010424eb5aa1e8
MD5 67574ce8a928751517e6824caac2acee
SHA1 48948a3d9255787f245336c779bd61357b74e6b0
SHA512 8f925780abde216af8ad73e2b12d4d304828f020cf0da1448a0d13dd02460cd3c737881a58f50aa22d0e197873e6c443874f1eed9c0787ab2af1f77cc9321e13
SSDEEP 384:6iFiZcIfzsNE8TUNTUlIl3T5d2iKenP2QX5+DtE8A1WpXM/jxtgOIwZOy9Lxot:xFQbZwgbd2WP9kDrUjxXsG1S
TLSH
T18EA26C3399A8DCBB6DFA9A85F14A32039FF45067D594EBD0E6EC5B1C009A5E8130AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 00f61e1250b7e172ebb3e113868c4a4636977ba816ce756ec7faa766d0f0b346
MD5 6441e9562d16b17896f65d919ef42093
SHA1 b96ccec66035b78ba6fa842c379de3be7172ced8
SHA512 02cf7c231e41a736e362a61b05514ed481bba2d833f01b38bc9fc8ce64201e55a08bd1b50b79e0f5b080cfd2584a92d31541958ff7cea02fb2a112984606e239
SSDEEP 192:EON16nnHsQmiUylL7WYcX5hQDP1UjzorA1WpXRql/g3Mrq5xU6:EON16nc4KNX5+DtE8A1WpXMOjxU6
TLSH
T18E121C35E9B8AC6B5EE26586B08732136EA55127EA487FC0D6EC2B1C01DF66C134DD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d76580b-f098-458a-badc-a1955c1d578a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d76580b-f098-458a-badc-a1955c1d578a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1710823aef0311676ca4039d3e11d2c13296ef16ec75b7743d390c201b57bc12
MD5 acbb37d9dab840e0da23130ebe55d740
SHA1 72928210c4e7993ecfe181d2220aaff752605d22
SHA512 db1d15a8efbc34b9b90d20e2cca6e7d9860bbc379e63514a8098a8ac1912e0c25840ce7792c7fecc4daec66032083fe4917008b9543403b6752f2dd9b69aa940
TLSH
T17D41095CBAFD1148B3B76F4AABF2B86E447AB8771E06945D10100E4E0A72B40D9B1773
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads