hxxps://jhtlaw[.]com/zap/negociia/fatura/67822479920/67822479920_5797496869_10072026[.]pdf%20URL[:]%20hxxps[:]/login-uk[.]mimecast[.]com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0[.]O7KhXNuvC0dBcA5tZqnd4XH4P87aHYNqQ4QdG1q4vEgfZbLD9Bf02dNPg24ZkVwe6qqEb0jOLnozNuwmr5ZbyMKNpZcq7ppkeBcJjdA7j-WurkihwOXoIuUAh4ZxCx7BqeF-2O8FGMhDTZZqAHFdVtY3NTLe5E5jNrmxEcCTL39A_GnT6w7eA0AocQXNA9xNPgpD7vR27ukwa_eergoIi3w_oW9DM237izWW9N-brbWqabAYQd1oTFRI7_v6X0F9QClR1N54pWwAjz_1qrSV0RZvDQh4tD9zD3ZPogLjdXfPnMb3mac2LsKTUwGQU55E_yHqXTkDb2viMab6oEcMjg[.]UAoEgxkcWdlQXtrv[.]oouF29NJ_WLSckEDRfRJDUyFhqI2dDrf6GiTUroT0-69n4sq3JWbZGtBAtl07TEB3ScUy-ZFiJa4vj9-t0AZmJvWdMi8tGkPlFy3X3KFnjnbvrWZO7TA7-MtxWpuewk_05sSR_rJ51izGF_lDQtB-4W50V1G0J7CXGiUKa5pLHI1TgfQnmdLqti7zwDdlZnpIcyIIRithhDJ8Gpoil_3nG8BV_EEeaA2h23Oc5x21NEdRi4X3unfEl8_gcb3uk29gynhzEzsGpSaxKk09DHynAgTbGcN5qp-FCaZNqTReMQDPrOPz5MF4pR5gqrqaE2bfQgrIng7Wx__dzweyzkKB0hW11qDQMf4wqVfEU1LvNmb2qsmBMntZwNEmiVt_kq6sufprjmJV0evpGZujP_4VU6kEfEC-hQkStbseLtCdSMuj3HEXl-cPTgqwEtKXBaelymIcP8Y88V8RD1c0w[.]7CLYtNQJuR23-Qu6NqM6jA&action=safe URL[:] hxxps[://]login-uk[.]mimecast[.]com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0[.]Zh6vtlY2BvXZbz_zHZgqH1GG5Ad97ykpSKh5MzkWpr2eW5rZIsx0tw7f8p4w2sHqhz4CqZmB1e-XtZbLsfd25QtzwOU_bMRJ3cG0F4-CtSnI8L8A3dFOeANk8QRp2lA60_l5xhjSUZ5NV4FbYsMqkXKrvDgJrI7vSdeXES9FttOlD6E_cIpcNxb4SsuX3uQP-DwFLHZSnH7tChb7fff9NLRv_uHv9C6wzDXcqOyYUBfG7snlF54Hi6rTv4ovfWrTvFfr67P826f5jHIUrYBOrxJwpfSdeKwI_Q7hUSG1-c_wUz9Dk45Rk0U0rtHlfE-aCKL1rDJaKoNxp4xdvH2PFA[.]xbOttcaM2J47JKhU[.]BuMHO1RV41nkiFSeSCKWqwlKU2k6U8sksYAdzKDA2a7xNuLvUap-0IBbW7xgZWiu5iumkdPVdygZ3ncwUiAJoPHWjGFmb86eFNhHG22aPBTV2Mdp6LqTjIZKUIOAejfjNtxItKUHtfI5Zw5ZZ6_i2OQUoMitYoMtTEl2yC8F9CUu9mC6j8nJikmDUwXJ54mOEgFEsE-jmLhNWCEpbtNWUP_60pLDM7CYbo8bTmwLCFzQEK7aC9t_XIUnIXCqrX7P9qQKf8jmrCCduMTmjorXjH3e55p7Iu9XK2OLDlFF4B7k3O6_ol-X87xNXqIqolhXmQxn6b8YmJfLED_MH3Rk_JIdxoB5q5dvFEylmoLVW1S4g4EkrwKeuAaaxTbPQgMMEwkiWmfZNL5RJhxHks84f5SqvOcttrXGaeaqP8rv6hxmEc8yKbziJa_jFaEkM58-s560eYfVQjSQqgNrr2g[.]KMV3V74rN1g-4z3EfAiidA

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 05:02

Sharing

Behavioral task

behavioral1

Sample

https://jhtlaw.com/zap/negociia/fatura/67822479920/67822479920_5797496869_10072026.pdf%20URL:%20hxxps:/login-uk.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.O7KhXNuvC0dBcA5tZqnd4XH4P87aHYNqQ4QdG1q4vEgfZbLD9Bf02dNPg24ZkVwe6qqEb0jOLnozNuwmr5ZbyMKNpZcq7ppkeBcJjdA7j-WurkihwOXoIuUAh4ZxCx7BqeF-2O8FGMhDTZZqAHFdVtY3NTLe5E5jNrmxEcCTL39A_GnT6w7eA0AocQXNA9xNPgpD7vR27ukwa_eergoIi3w_oW9DM237izWW9N-brbWqabAYQd1oTFRI7_v6X0F9QClR1N54pWwAjz_1qrSV0RZvDQh4tD9zD3ZPogLjdXfPnMb3mac2LsKTUwGQU55E_yHqXTkDb2viMab6oEcMjg.UAoEgxkcWdlQXtrv.oouF29NJ_WLSckEDRfRJDUyFhqI2dDrf6GiTUroT0-69n4sq3JWbZGtBAtl07TEB3ScUy-ZFiJa4vj9-t0AZmJvWdMi8tGkPlFy3X3KFnjnbvrWZO7TA7-MtxWpuewk_05sSR_rJ51izGF_lDQtB-4W50V1G0J7CXGiUKa5pLHI1TgfQnmdLqti7zwDdlZnpIcyIIRithhDJ8Gpoil_3nG8BV_EEeaA2h23Oc5x21NEdRi4X3unfEl8_gcb3uk29gynhzEzsGpSaxKk09DHynAgTbGcN5qp-FCaZNqTReMQDPrOPz5MF4pR5gqrqaE2bfQgrIng7Wx__dzweyzkKB0hW11qDQMf4wqVfEU1LvNmb2qsmBMntZwNEmiVt_kq6sufprjmJV0evpGZujP_4VU6kEfEC-hQkStbseLtCdSMuj3HEXl-cPTgqwEtKXBaelymIcP8Y88V8RD1c0w.7CLYtNQJuR23-Qu6NqM6jA&action=safe URL: hxxps://login-uk.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Zh6vtlY2BvXZbz_zHZgqH1GG5Ad97ykpSKh5MzkWpr2eW5rZIsx0tw7f8p4w2sHqhz4CqZmB1e-XtZbLsfd25QtzwOU_bMRJ3cG0F4-CtSnI8L8A3dFOeANk8QRp2lA60_l5xhjSUZ5NV4FbYsMqkXKrvDgJrI7vSdeXES9FttOlD6E_cIpcNxb4SsuX3uQP-DwFLHZSnH7tChb7fff9NLRv_uHv9C6wzDXcqOyYUBfG7snlF54Hi6rTv4ovfWrTvFfr67P826f5jHIUrYBOrxJwpfSdeKwI_Q7hUSG1-c_wUz9Dk45Rk0U0rtHlfE-aCKL1rDJaKoNxp4xdvH2PFA.xbOttcaM2J47JKhU.BuMHO1RV41nkiFSeSCKWqwlKU2k6U8sksYAdzKDA2a7xNuLvUap-0IBbW7xgZWiu5iumkdPVdygZ3ncwUiAJoPHWjGFmb86eFNhHG22aPBTV2Mdp6LqTjIZKUIOAejfjNtxItKUHtfI5Zw5ZZ6_i2OQUoMitYoMtTEl2yC8F9CUu9mC6j8nJikmDUwXJ54mOEgFEsE-jmLhNWCEpbtNWUP_60pLDM7CYbo8bTmwLCFzQEK7aC9t_XIUnIXCqrX7P9qQKf8jmrCCduMTmjorXjH3e55p7Iu9XK2OLDlFF4B7k3O6_ol-X87xNXqIqolhXmQxn6b8YmJfLED_MH3Rk_JIdxoB5q5dvFEylmoLVW1S4g4EkrwKeuAaaxTbPQgMMEwkiWmfZNL5RJhxHks84f5SqvOcttrXGaeaqP8rv6hxmEc8yKbziJa_jFaEkM58-s560eYfVQjSQqgNrr2g.KMV3V74rN1g-4z3EfAiidA

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

150 seconds

discovery

Report Analysis Logs

General

Target
https://jhtlaw.com/zap/negociia/fatura/67822479920/67822479920_5797496869_10072026.pdf%20URL:%20hxxps:/login-uk.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.O7KhXNuvC0dBcA5tZqnd4XH4P87aHYNqQ4QdG1q4vEgfZbLD9Bf02dNPg24ZkVwe6qqEb0jOLnozNuwmr5ZbyMKNpZcq7ppkeBcJjdA7j-WurkihwOXoIuUAh4ZxCx7BqeF-2O8FGMhDTZZqAHFdVtY3NTLe5E5jNrmxEcCTL39A_GnT6w7eA0AocQXNA9xNPgpD7vR27ukwa_eergoIi3w_oW9DM237izWW9N-brbWqabAYQd1oTFRI7_v6X0F9QClR1N54pWwAjz_1qrSV0RZvDQh4tD9zD3ZPogLjdXfPnMb3mac2LsKTUwGQU55E_yHqXTkDb2viMab6oEcMjg.UAoEgxkcWdlQXtrv.oouF29NJ_WLSckEDRfRJDUyFhqI2dDrf6GiTUroT0-69n4sq3JWbZGtBAtl07TEB3ScUy-ZFiJa4vj9-t0AZmJvWdMi8tGkPlFy3X3KFnjnbvrWZO7TA7-MtxWpuewk_05sSR_rJ51izGF_lDQtB-4W50V1G0J7CXGiUKa5pLHI1TgfQnmdLqti7zwDdlZnpIcyIIRithhDJ8Gpoil_3nG8BV_EEeaA2h23Oc5x21NEdRi4X3unfEl8_gcb3uk29gynhzEzsGpSaxKk09DHynAgTbGcN5qp-FCaZNqTReMQDPrOPz5MF4pR5gqrqaE2bfQgrIng7Wx__dzweyzkKB0hW11qDQMf4wqVfEU1LvNmb2qsmBMntZwNEmiVt_kq6sufprjmJV0evpGZujP_4VU6kEfEC-hQkStbseLtCdSMuj3HEXl-cPTgqwEtKXBaelymIcP8Y88V8RD1c0w.7CLYtNQJuR23-Qu6NqM6jA&action=safe URL: hxxps://login-uk.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Zh6vtlY2BvXZbz_zHZgqH1GG5Ad97ykpSKh5MzkWpr2eW5rZIsx0tw7f8p4w2sHqhz4CqZmB1e-XtZbLsfd25QtzwOU_bMRJ3cG0F4-CtSnI8L8A3dFOeANk8QRp2lA60_l5xhjSUZ5NV4FbYsMqkXKrvDgJrI7vSdeXES9FttOlD6E_cIpcNxb4SsuX3uQP-DwFLHZSnH7tChb7fff9NLRv_uHv9C6wzDXcqOyYUBfG7snlF54Hi6rTv4ovfWrTvFfr67P826f5jHIUrYBOrxJwpfSdeKwI_Q7hUSG1-c_wUz9Dk45Rk0U0rtHlfE-aCKL1rDJaKoNxp4xdvH2PFA.xbOttcaM2J47JKhU.BuMHO1RV41nkiFSeSCKWqwlKU2k6U8sksYAdzKDA2a7xNuLvUap-0IBbW7xgZWiu5iumkdPVdygZ3ncwUiAJoPHWjGFmb86eFNhHG22aPBTV2Mdp6LqTjIZKUIOAejfjNtxItKUHtfI5Zw5ZZ6_i2OQUoMitYoMtTEl2yC8F9CUu9mC6j8nJikmDUwXJ54mOEgFEsE-jmLhNWCEpbtNWUP_60pLDM7CYbo8bTmwLCFzQEK7aC9t_XIUnIXCqrX7P9qQKf8jmrCCduMTmjorXjH3e55p7Iu9XK2OLDlFF4B7k3O6_ol-X87xNXqIqolhXmQxn6b8YmJfLED_MH3Rk_JIdxoB5q5dvFEylmoLVW1S4g4EkrwKeuAaaxTbPQgMMEwkiWmfZNL5RJhxHks84f5SqvOcttrXGaeaqP8rv6hxmEc8yKbziJa_jFaEkM58-s560eYfVQjSQqgNrr2g.KMV3V74rN1g-4z3EfAiidA
Sample260707-fpjedsat21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278741778498182"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{0727CF31-D27B-41B0-8154-0329D502C8BC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1820	2968	msedge.exe	84
PID 2968 wrote to memory of 2132	2968	msedge.exe	86
PID 2968 wrote to memory of 2064	2968	msedge.exe	87
PID 2968 wrote to memory of 2064	2968	msedge.exe	87
PID 2968 wrote to memory of 2064	2968	msedge.exe	87
PID 2968 wrote to memory of 4452	2968	msedge.exe	88
PID 2968 wrote to memory of 4452	2968	msedge.exe	88
PID 2968 wrote to memory of 2976	2968	msedge.exe	90
PID 2968 wrote to memory of 4600	2968	msedge.exe	89
PID 2968 wrote to memory of 2976	2968	msedge.exe	90
PID 2968 wrote to memory of 2976	2968	msedge.exe	90
PID 2968 wrote to memory of 4600	2968	msedge.exe	89
PID 2968 wrote to memory of 4600	2968	msedge.exe	89
PID 2968 wrote to memory of 1660	2968	msedge.exe	91
PID 2968 wrote to memory of 1660	2968	msedge.exe	91
PID 2968 wrote to memory of 1660	2968	msedge.exe	91
PID 2968 wrote to memory of 4104	2968	msedge.exe	92
PID 2968 wrote to memory of 4104	2968	msedge.exe	92
PID 2968 wrote to memory of 4104	2968	msedge.exe	92
PID 2968 wrote to memory of 2660	2968	msedge.exe	97
PID 2968 wrote to memory of 2660	2968	msedge.exe	97
PID 2968 wrote to memory of 3128	2968	msedge.exe	98
PID 2968 wrote to memory of 3128	2968	msedge.exe	98
PID 2968 wrote to memory of 5028	2968	msedge.exe	100
PID 2968 wrote to memory of 5024	2968	msedge.exe	101
PID 2968 wrote to memory of 5024	2968	msedge.exe	101
PID 2968 wrote to memory of 5024	2968	msedge.exe	101
PID 2968 wrote to memory of 2588	2968	msedge.exe	102
PID 2968 wrote to memory of 2588	2968	msedge.exe	102
PID 2968 wrote to memory of 2588	2968	msedge.exe	102
PID 2968 wrote to memory of 2152	2968	msedge.exe	105
PID 2968 wrote to memory of 948	2968	msedge.exe	106
PID 2968 wrote to memory of 372	2968	msedge.exe	107
PID 2968 wrote to memory of 3956	2968	msedge.exe	108
PID 2968 wrote to memory of 3956	2968	msedge.exe	108
PID 2968 wrote to memory of 3956	2968	msedge.exe	108
PID 2968 wrote to memory of 4548	2968	msedge.exe	115
PID 2968 wrote to memory of 4548	2968	msedge.exe	115
PID 2968 wrote to memory of 2304	2968	msedge.exe	117
PID 2968 wrote to memory of 2304	2968	msedge.exe	117
PID 2968 wrote to memory of 2304	2968	msedge.exe	117
PID 2968 wrote to memory of 2868	2968	msedge.exe	118
PID 2968 wrote to memory of 3928	2968	msedge.exe	119
PID 2968 wrote to memory of 3928	2968	msedge.exe	119
PID 2968 wrote to memory of 3928	2968	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jhtlaw.com/zap/negociia/fatura/67822479920/67822479920_5797496869_10072026.pdf%20URL:%20hxxps:/login-uk.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.O7KhXNuvC0dBcA5tZqnd4XH4P87aHYNqQ4QdG1q4vEgfZbLD9Bf02dNPg24ZkVwe6qqEb0jOLnozNuwmr5ZbyMKNpZcq7ppkeBcJjdA7j-WurkihwOXoIuUAh4ZxCx7BqeF-2O8FGMhDTZZqAHFdVtY3NTLe5E5jNrmxEcCTL39A_GnT6w7eA0AocQXNA9xNPgpD7vR27ukwa_eergoIi3w_oW9DM237izWW9N-brbWqabAYQd1oTFRI7_v6X0F9QClR1N54pWwAjz_1qrSV0RZvDQh4tD9zD3ZPogLjdXfPnMb3mac2LsKTUwGQU55E_yHqXTkDb2viMab6oEcMjg.UAoEgxkcWdlQXtrv.oouF29NJ_WLSckEDRfRJDUyFhqI2dDrf6GiTUroT0-69n4sq3JWbZGtBAtl07TEB3ScUy-ZFiJa4vj9-t0AZmJvWdMi8tGkPlFy3X3KFnjnbvrWZO7TA7-MtxWpuewk_05sSR_rJ51izGF_lDQtB-4W50V1G0J7CXGiUKa5pLHI1TgfQnmdLqti7zwDdlZnpIcyIIRithhDJ8Gpoil_3nG8BV_EEeaA2h23Oc5x21NEdRi4X3unfEl8_gcb3uk29gynhzEzsGpSaxKk09DHynAgTbGcN5qp-FCaZNqTReMQDPrOPz5MF4pR5gqrqaE2bfQgrIng7Wx__dzweyzkKB0hW11qDQMf4wqVfEU1LvNmb2qsmBMntZwNEmiVt_kq6sufprjmJV0evpGZujP_4VU6kEfEC-hQkStbseLtCdSMuj3HEXl-cPTgqwEtKXBaelymIcP8Y88V8RD1c0w.7CLYtNQJuR23-Qu6NqM6jA&action=safe URL: hxxps://login-uk.mimecast.com/u/login/?gta=apps&link=cybergraph-report/eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Zh6vtlY2BvXZbz_zHZgqH1GG5Ad97ykpSKh5MzkWpr2eW5rZIsx0tw7f8p4w2sHqhz4CqZmB1e-XtZbLsfd25QtzwOU_bMRJ3cG0F4-CtSnI8L8A3dFOeANk8QRp2lA60_l5xhjSUZ5NV4FbYsMqkXKrvDgJrI7vSdeXES9FttOlD6E_cIpcNxb4SsuX3uQP-DwFLHZSnH7tChb7fff9NLRv_uHv9C6wzDXcqOyYUBfG7snlF54Hi6rTv4ovfWrTvFfr67P826f5jHIUrYBOrxJwpfSdeKwI_Q7hUSG1-c_wUz9Dk45Rk0U0rtHlfE-aCKL1rDJaKoNxp4xdvH2PFA.xbOttcaM2J47JKhU.BuMHO1RV41nkiFSeSCKWqwlKU2k6U8sksYAdzKDA2a7xNuLvUap-0IBbW7xgZWiu5iumkdPVdygZ3ncwUiAJoPHWjGFmb86eFNhHG22aPBTV2Mdp6LqTjIZKUIOAejfjNtxItKUHtfI5Zw5ZZ6_i2OQUoMitYoMtTEl2yC8F9CUu9mC6j8nJikmDUwXJ54mOEgFEsE-jmLhNWCEpbtNWUP_60pLDM7CYbo8bTmwLCFzQEK7aC9t_XIUnIXCqrX7P9qQKf8jmrCCduMTmjorXjH3e55p7Iu9XK2OLDlFF4B7k3O6_ol-X87xNXqIqolhXmQxn6b8YmJfLED_MH3Rk_JIdxoB5q5dvFEylmoLVW1S4g4EkrwKeuAaaxTbPQgMMEwkiWmfZNL5RJhxHks84f5SqvOcttrXGaeaqP8rv6hxmEc8yKbziJa_jFaEkM58-s560eYfVQjSQqgNrr2g.KMV3V74rN1g-4z3EfAiidA
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffb804fc188,0x7ffb804fc194,0x7ffb804fc1a0
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7909784285609223531,3305718116022960546,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,71215431412974600,3883380643743310354,262144 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15735283672770589097,4711933551531096300,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1702927735966188051,2990028765665549181,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3304684884731171503,16751058499085619522,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,4677519994474816863,12298857337266167519,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,863744368699363914,4923224492320058628,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,15248864928600849518,18238882458932030581,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,585278913440829748,9587810845227637522,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,7068564131734714994,1067293089638709705,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,7068564131734714994,1067293089638709705,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6300,i,7025396682532371243,8778964939812996347,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5492,i,1678248373089569083,16232341590917419669,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,5738166741570760842,17117711433881075736,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,10581715982744370873,6263610230630499745,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12820514111513280367,12151565893701020529,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=756,i,5540453992266002823,3976648386703589894,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,12073080996885096549,16988532789021563645,524288 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5976,i,375385018939376306,9511142966473332532,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5008,i,9992400054387072749,15177691665932474410,262144 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5524,i,4060707581865193703,17643276703013994498,2097152 --field-trial-handle=2316,i,11587937150772548377,14809210583457588497,262144 --variations-seed-version --mojo-platform-channel-handle=1028 /prefetch:1
  2⤵
  PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c235e3983ee116b74fa6ba01346af30d7a6b8ec25f353c01ca5a069d7a798f18
MD5 0de92288a8ab96d0b810ff0fded1fadc
SHA1 96a6946a243a9d0f6e18f234c5093ec472159acd
SHA512 49a4d168b9a18177a1c1313e56f405bc3efe39628105819bf64aa9de2cb85147ae04503943800fadf7ee8bbdf17245df672d1d8fdfe14da928c1cab5b7056126
TLSH
T160615D8545E23558F3703371E3D2220435B1C6DA4C034C7255806ABED6E9BB5BE5EE48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 eb9d51fc894d91122d9665a5df4efe70569a5e0e4e5e5f29e18c76851c5cb35d
MD5 604ea96ea74139e722ebe90021d13c21
SHA1 332b79e32c784d6388154b413024a768cbd5cffb
SHA512 e516f0f26760ab5fece82d376d0c4ac259c440a7f0bfd179a1a39f741bfe393182cfac8b5c8941f89cbc411cd79fcf5510805e6b0694153bf9138a19794497a0
TLSH
T177117DF3C3E5856E890156F06A24EE1BCE1D0506431C7C1685D4EF2797F3075D10299B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f7346c9b935937bb4dbe7f854163be5362d83b59693a9bdf833baa695e518a8
MD5 89d7231902e3a12225aa240bef0b76e1
SHA1 7ff765949c647eaa0707e5917bfb98ebf26cf876
SHA512 555af0b2e7a96199350b9083a5b02f57676ac13bb0af05d3f111abae72fa0e87bef4d3d1acc24f0e0d90a75191c82703cae779b28d40eda6a8434b3c615daae8
SSDEEP 192:sxZe6R6yM/jK1Ml8MkF/fTs3302IdpJHW6+WNGYLlTKzIgrJ:sxZrQMF/fTs3E3JHbGt9
TLSH
T1EE42E7166B345977CCCBD209FA45BF53D6F80473A2910D48A9FCDA0C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5f10ef7a23f9d7674e9810e372e2fd8357b967b4ae546ba5f20911b81980ae7d
MD5 3a634c2a10ad3a9b71ff491c5a36bc15
SHA1 b0c8742defec7f5a590958e12f67cb803bb24e1f
SHA512 4c2082652f176f8f75ac4372501eef966d4cf79c633c5ad120730b8de1fae41e5c32ed1587d245233d7cf647f99b52a9bd27ae81911ac230b10c31c31a9a3bf6
SSDEEP 192:sxZe6R6yM/jK1Ml8UQ8kF/fTsh3k/IdpcPHW6+WNGYL/e9zIg5EwJ:sxZrQqHF/fTsh0wqHbGP2U
TLSH
T1F152F816AA345977CCDBD209FA45BF53D6F41473A2510E48AAFCDA0C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0b23b0923bb30f6c800adc0e3d4eece7c84d8402c3bef64b9839bec3e4ad7e5d
MD5 1b0d191cd8bff3b589a3b14b22358758
SHA1 3ccf956db1d04a69458fb1daec2f11a19d165f67
SHA512 2254de460c582d542177440c63ffdd34180ebe3b4e1e78c74818a9428b366ea3a2d756af107ba3f39405d8e2caed0bb60ab37dbf03c14421346160079cad6041
SSDEEP 768:YOs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNfrodV:YOs6pD1WvxzWju1jahILIsNMdV
TLSH
T1F8D2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0954920f8b5f7272c8377c8be76f1b29e91a5f370cd4d317def739597fed35c4
MD5 53bb81f8e103b1ef1b86f961590413b7
SHA1 16afb37d17937e5603aebef241bfffa58359168e
SHA512 b051ed733fc0a0a8523de44ad6d66f029a278a3dff01237448b07dfed69c60c1420374a9e6dd17820448e483dd24fbaecb1b7fb92c99f1aa627d9f3c90ec98bd
SSDEEP 96:KUAAKtePCcAKp26OhOKiApKIKbq66aMKrKZnwVRnC:ii7r9tX3wnwVRnC
TLSH
T16EE1141232BB47122C7E790DA354C7674B42F6A33014E82B7BA920B11E66E744DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f71d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f71d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ae60aceb24be4e0c66ed6a5bdca847c7c3858d6ee6e05b67006342367ac555ed
MD5 9305295c0d243c1bbf6cb5fa865f876b
SHA1 dea067d10fb92207a68d995029bb9d223122b2ec
SHA512 5d365117f05ec535728e0d4808c5508699497d104b7a817d94bb37c7d32351cce987e59501ce891aa45499c1fff88c50c9030e66bd652d1422b60e1e702fe9b1
SSDEEP 384:itNn/s3n9SfsNfNtGFLnt5a9DO5MzYzJr3FgOObjI9G6w73f:ij+9UkyMhOs8h1g29MP
TLSH
T1CA928E36AC285C7349E3E296F58B3A179FF4407B96872E84D5DCBF0C02DB6AC4346919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 94861c05c27c0bfab4453404793e3bdc416936bb7f1c0a434ebc85487eaafaf0
MD5 b6feaaf23796524ce20aa1589df58ba9
SHA1 0fb105bda0784fd6012a012859aba196875d359b
SHA512 8cabbbdc3ff81066716f320a51c8ef2a6e2f1bff8db7585c4c4e776a77f423ce373b69476a51875c607b29aeac8933476b169b66666ba4da79148ed13036c8ad
SSDEEP 384:jiF1tNn/s3n9SdzsNB8TUNTUlIlitGFLnt5a9DO5MzYzJr38gOObjI9G6w73f:OF1j+9ywwgUyMhOs8hsg29MP
TLSH
T134A26B3798588D7B9DE39B95FA4B3617CFF440BBC6866E84E2C8AE0C01DB1AC0346D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f1bbf15a76ac45b1f5e2a5f5ba48878293c703bc30e0cc8beeaf42439ee0f775
MD5 9892535815e375acb96b762bd08cbaaf
SHA1 d85c67bea423040b419cf28437423450ec57bebf
SHA512 291455e969f76629a3b38a16db4949aa291fa1c7691e95224a92c07798c992564f2bd83f058304b92971816ff1d8b2981f38d12b9e563cbbfa24c8288691cdee
SSDEEP 192:qONx6O7+3hQmiUyA8Gttb0CO2b6h2SUgGMZU6:qONx61kGt9DO5MSaoU6
TLSH
T1EC02E9356C686CB74AF3AE46B98727235FA5103BE9962F84D6E81F0C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6f9034a321ab79c63850f8138e77ba0d4e8d9206c6620b1906e8b321735ef4a2
MD5 fe37ba9bdc998e4e38712c33f5e20e2f
SHA1 faf4f3a58157d4ee421b96f92f022848900c4639
SHA512 9bc9f4691426c61fdff9e1749638694e37e72b066eb36d3b09e9672b54212eff6dbb94a5f57625e80feecd52ec2e07e43082697ab98cd4762e81605917a60f57
SSDEEP 384:HtNn/s3n9SfsNfitGFLnt5a9DO5MzYzJr3FgOObjI9G6w73f:Hj+9UZyMhOs8h1g29MP
TLSH
T19F928E36AC285C7349E3E296F58B3A179FF4407B968B2E84D5DCBF0C02DB6AC4306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a68ce12429176633adcef55fd70cc1dc2bcd4b5f585b37c57775dbdfeadab2f6
MD5 3d5442be2c44448f4a013dbef8460bcd
SHA1 8272b28c24dbf28e031c95e0c96bc5ba0d8e3685
SHA512 c071e62aeefec221eac4d4c19187ecbed121c0ca2117f3e91fd80b9f5ed9979798f5c2b17fe500629893dd7ae884d7763b5b30f67bf691fd7f7b297f21f7ecaf
SSDEEP 192:BONC6O7+31QmiUylb87ttb0CO2b6h2zcF0SJr3ZcNFqEwU6:BONC6RYI7t9DO5MzYzJr3ugU6
TLSH
T1D4121A35B8689CB75DE3F585F98736138EA50127EE8A6F80D1DC6E0C01EF66C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 12b4b257d0e360e39615458e40a39d69d484b73560abb4843506e78102ff6eaa
MD5 ebc93c8dcef056aac716e65547b4bb4c
SHA1 90434e4e6defa6b5ee0c47b68f8ce80524522e06
SHA512 8909fa6dfe71f87afd9dfb405e2326ce6a57e96561c63e0a7cd7cd84255f458fda18e093f25827cd47f50370cb99db890bd50d4552c329d25a2aa4a809f6e7e9
TLSH
T17441DB58BAEA1148B3B76E165BF3686E487F79272F1AD46E00010E8F0B67B40D961733
MD5 SHA1 SHA512 TLSH

Submit Download