hxxps://filesender[.]fccn[.]pt/?s=download&token=71217bbf-69c0-460e-8469-2b84cd0143fa

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://filesender.fccn.pt/?s=download&token=71217bbf-69c0-460e-8469-2b84cd0143fa
Sample261001-shmvfstdke

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{42C5865D-5265-4B29-BC1D-4483037BA449}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1632	4508	msedge.exe	85
PID 4508 wrote to memory of 4972	4508	msedge.exe	87
PID 4508 wrote to memory of 2332	4508	msedge.exe	88
PID 4508 wrote to memory of 2332	4508	msedge.exe	88
PID 4508 wrote to memory of 2332	4508	msedge.exe	88
PID 4508 wrote to memory of 3696	4508	msedge.exe	89
PID 4508 wrote to memory of 3696	4508	msedge.exe	89
PID 4508 wrote to memory of 3096	4508	msedge.exe	91
PID 4508 wrote to memory of 1944	4508	msedge.exe	90
PID 4508 wrote to memory of 3096	4508	msedge.exe	91
PID 4508 wrote to memory of 3096	4508	msedge.exe	91
PID 4508 wrote to memory of 1944	4508	msedge.exe	90
PID 4508 wrote to memory of 1944	4508	msedge.exe	90
PID 4508 wrote to memory of 3444	4508	msedge.exe	92
PID 4508 wrote to memory of 4812	4508	msedge.exe	93
PID 4508 wrote to memory of 3444	4508	msedge.exe	92
PID 4508 wrote to memory of 3444	4508	msedge.exe	92
PID 4508 wrote to memory of 4812	4508	msedge.exe	93
PID 4508 wrote to memory of 4812	4508	msedge.exe	93
PID 4508 wrote to memory of 2000	4508	msedge.exe	97
PID 4508 wrote to memory of 2000	4508	msedge.exe	97
PID 4508 wrote to memory of 4292	4508	msedge.exe	98
PID 4508 wrote to memory of 4292	4508	msedge.exe	98
PID 4508 wrote to memory of 2712	4508	msedge.exe	101
PID 4508 wrote to memory of 2712	4508	msedge.exe	101
PID 4508 wrote to memory of 984	4508	msedge.exe	102
PID 4508 wrote to memory of 984	4508	msedge.exe	102
PID 4508 wrote to memory of 984	4508	msedge.exe	102
PID 4508 wrote to memory of 4372	4508	msedge.exe	103
PID 4508 wrote to memory of 5072	4508	msedge.exe	107
PID 4508 wrote to memory of 5072	4508	msedge.exe	107
PID 4508 wrote to memory of 5072	4508	msedge.exe	107
PID 4508 wrote to memory of 1832	4508	msedge.exe	109
PID 4508 wrote to memory of 1832	4508	msedge.exe	109
PID 4508 wrote to memory of 1832	4508	msedge.exe	109
PID 4508 wrote to memory of 4460	4508	msedge.exe	111
PID 4508 wrote to memory of 1408	4508	msedge.exe	112
PID 4508 wrote to memory of 1408	4508	msedge.exe	112
PID 4508 wrote to memory of 1408	4508	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://filesender.fccn.pt/?s=download&token=71217bbf-69c0-460e-8469-2b84cd0143fa
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffbb95ec188,0x7ffbb95ec194,0x7ffbb95ec1a0
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,11364465308623749930,3262606878239614173,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,4854750343121391597,8099660796029517700,262144 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,802090759132294274,11949611864177574626,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16524695950567309852,12523603645127831312,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,14326631907570700320,5616987536131147282,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,11932978756099271710,1060323644221684702,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,10945733331450139041,7151556722167964368,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6761368204844167210,14150100365512231346,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4942647093414659961,17254258160689438268,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,8822266900876588884,891645189970114367,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5784,i,7544924774228400261,12623767193879618963,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,10104756105225982921,8005738637432000458,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6536,i,8998353642372376664,7765600682819750284,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,2772471467988053379,10495358587316797058,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6748,i,14837712036737045451,13119695169325834631,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:2
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,2772471467988053379,10495358587316797058,524288 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6932,i,14973634678305879021,15713220239989599236,2097152 --field-trial-handle=2320,i,9841987320010753662,13765900897346659137,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
MD5 54b5c89d12a534155a20824f377fc719
SHA1 633c3f7842f6f8f5fca6889975166d8beceab229
SHA512 232113d19f85e9404efda63cedba3028a48c801cab50f01744982526b2603d87acb2c9b209ffaa2266ed46e4496bd525b77408f425a951d529554a9790832746
TLSH
T118D0C06096B83ED9E131203F03700311348C01D351136100D85000490BE808381C1CE0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a6f8c9aced5def2428b725e3d360066d02f97ab61d60709456d26f929696f2e7
MD5 44e08e5680fb9d325be39994c3099d05
SHA1 271274abd49841fe6b940ff09fd3d652f46a0874
SHA512 f807f2ce482715c01ecc6faceaa0c891a32cbc1b9ef1eaa08b2ba60a85522ca1a7fd483c20487728c8d5214234ab93c629fa1b87dc82aec5ae60e8e91d6e0779
TLSH
T1DA712F429022F3D3FB969EF68DC66947BB38B19486431D33CD64D43A7816FA4B0202ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5892a6.TMP
Size 3KB
SHA256 48c2d8a5a3945d1ac7536bf730c4867bc0c94f44369710e152c36ec292e32001
MD5 12e08bf614941409976cc59544bbebe0
SHA1 94120cda5367a2be4c8880508133847534dc108f
SHA512 f839628aa4482dffac0a7504a0b7a041b69e6ef66d99487df2eefe6209248585a79481b34a2cb4a7eda775cdecf53dd7eb6386a39ae574e046855b7d61d119e2
TLSH
T1C66121469012F3D3FBD6DAF24DC27547BB38D19486831D379964E87AB446BB0B0202AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d001585412dd0bee0113f17176ad3ddb84f5a9d3d5f0c869122c5909a2c2845f
MD5 c19bf58e8e833bbaf6a33a8d72c00a1c
SHA1 89a131c54439018ab1f48bfe7b65aa9aeb432ae4
SHA512 7b12fb48d72b437e2b966733c0f858639897ea3df42e2ffe0cc34e06567451c53543f150e821f5b91dd585cd8c1247ec548642c92d9ee506cbeb4476fe88da33
TLSH
T139117DF3C3D586AE890516F06A28EE2BCE1D0605421C7C5989D4EF2BD7E3079E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 87f9f0c7aee11ee47b93c0aeafcc38470e501c71408acd35ac9b07883885860b
MD5 6c18bff452822609d95bb37a908d2d30
SHA1 70369424c9802256bb1daa2a7667ea7957c7ff26
SHA512 239daf98adf7f3d71ad645928b831e8afa35f7d27f3d54772d5582431b7096aa8a1e35fa6565e54a666fc8e1fe20b2072b10cdaa07d8c49cd76283920c072244
SSDEEP 192:sxZrRUng/fXslSWpVgS8OtIdpdhxHW6+WNt9Aw/Y369Owy8rcIgOa8J:sxZrgg/fXslSWvt8OOdHbb/79OU8Oag
TLSH
T17D3284517928A97B8CC7D21DBB25BF53D6F9203251D11E98AAFC862C05E7BDD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a8bfdd2f281787db05d7eb4151de8f0ec83fdf94227c0778151b407e58964d50
MD5 f3b04eb0185ae8c9734d857b99396e8d
SHA1 7301fe47a0b6f784c80ea0548b3d87afb32c0623
SHA512 8c076d7046e552a8896dac69cef692bbfd22324674aaedafc758539c3620684fce2be4ef5042d013e4a3d94a1d26c79dc0958fddd0d043ec5c71b5f2073b78a8
SSDEEP 768:3jKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/grodx:3jKlm7QWvUYe0u1ja8/L/E/rdx
TLSH
T1C5C2FA3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 247a914293709b2fa3f524301d3e077dbf40676cc81f2b37ef44bba4b9439c88
MD5 405b094c85699d9ac9c88c383b8d9326
SHA1 730b45ee147c3b15a2ea8f0d0f1cddf173800380
SHA512 744cfd0b0f1d6a2f642dee78163ba04bb8b01cf1f9cec24681387d8af2c6fd8f1dbecf5f5cf8f0e797963c670b914b70d87a31193f01039f9f7bd20f27fc8549
SSDEEP 384:0ZcIXsNFkoSBbDhNX2h//S1I3RvYASBm1mVfoZkLf6lVZh6DKhHoDoV:yXLXNXG/vZvSNmZkLf6lfYGHoDu
TLSH
T1A0B25BB5E8A46CF754A6E9C1A542FA036FB81077C2891E4CD5F8BA3A309F5F41712C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67954c1641f30a6416c0c4939111a4aa22c92c46174587a180a89cb359e38c5f
MD5 f66f72e54ffbc8aff13216b67b1ff753
SHA1 c6d53ee700399272c9a2ecf3b72aed1a2b27fe38
SHA512 20f98b56d31482410b9d53205c7600d00abbe4fc0cfa5731e4ab3a3457f6e9586de7b062e6b9df55e486caebbd494ece83690887e40feb027f63a99310dbadfc
SSDEEP 192:BONa26JUm0QmiUyh+so//2ywTBCuSLwU6:BONB6+mEXso//SQujU6
TLSH
T1FC02C738BC68BCBB9EE3AE45B4477B239FA4107BA6951F84DAE81E1C01D715C1302C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d3b8e32e58e4764822dd080f13d3935a86de84df2b1557a6160e7d46373c473
MD5 e3c737da0b307974e30ad7c16200c4ea
SHA1 399b99df36b68a5951e1c3b8685bfa48790ef53b
SHA512 ce5819db5501447612b26f5acc11d9bab2d5162d8e641fbe2582deade11a2173d1cd130fc1dde1c6144ba2064a23d4d9897a1303ea40a757e16a1d309bed2356
SSDEEP 192:BONY6JU8QmiUyANF+Co//2yw1jNxuSgrq0xU6:BONY6+MbICo//S1/uNxU6
TLSH
T19712F975B868BC775D93A490F04776139EA44077EB896F84DADC2E1C02EB1AC5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f47bdd4e7e74c76464b0d715d3cd10aa3ae4cd6945c1394e5d56949208e6fa3f
MD5 a8ae184d78fbe6019f436982a791c4a8
SHA1 3c7bf8a87c99185d3f2f8f69ec180fb48e71839e
SHA512 9aef8a5d1e18a119cb35827b22484b5a110519d1304926f4a1eec425fea9d017d400a54e7361ef5472d6399806716b72261330ffdae870720cc767532bc89e55
TLSH
T197411D58ABEA114CB3B37E5AABF6786D447E78372E46D59E00110E4F0A73B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

Stadler & Swart Attorneys- POP.pdf

Path C:\Users\Admin\Downloads\Stadler & Swart Attorneys- POP.pdf
Size 270KB
SHA256 84c4749da195b95696fa4080f67809d343939bca77aad74d89ac4cb5d2f9f302
MD5 e88251948d72d09ded12cc9ffd9d99b7
SHA1 c933487bb6418032829f471a38fcf41ea50f0840
SHA512 0d14cd0563d2d0410e08d86c0d34110ebf58e96a290cd720a8a65ec83fa16ba41a526aaa3f0ca7afed9ed1e38800803da21b3c8d80d5934d8f6ea347d834536f
SSDEEP 6144:Vdayfj5zJb59f14hZkfFrDMUF63hvqS804Toiwfk:yyfdF59TFrDedq1yiwfk
TLSH
T1BF442320FD27D5ACF461F4361BEC2B015D9B211A79D33290AE640C42DF1EEBEA15856E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads