hxxps://www[.]mass[.]edu/forstufam/veterans/health[.]asp

Analysis

user interaction
yes
max time kernel
22s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mass.edu/forstufam/veterans/health.asp
Sample260727-q3fkrsteld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296336275855895"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{F9E4EC8B-C469-41CC-A632-EDB2AADB8C94}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2652	2800	msedge.exe	82
PID 2800 wrote to memory of 868	2800	msedge.exe	83
PID 2800 wrote to memory of 4516	2800	msedge.exe	84
PID 2800 wrote to memory of 4516	2800	msedge.exe	84
PID 2800 wrote to memory of 4516	2800	msedge.exe	84
PID 2800 wrote to memory of 440	2800	msedge.exe	85
PID 2800 wrote to memory of 440	2800	msedge.exe	85
PID 2800 wrote to memory of 3196	2800	msedge.exe	86
PID 2800 wrote to memory of 3196	2800	msedge.exe	86
PID 2800 wrote to memory of 3196	2800	msedge.exe	86
PID 2800 wrote to memory of 1428	2800	msedge.exe	87
PID 2800 wrote to memory of 1428	2800	msedge.exe	87
PID 2800 wrote to memory of 1428	2800	msedge.exe	87
PID 2800 wrote to memory of 3016	2800	msedge.exe	88
PID 2800 wrote to memory of 3016	2800	msedge.exe	88
PID 2800 wrote to memory of 3016	2800	msedge.exe	88
PID 2800 wrote to memory of 4604	2800	msedge.exe	89
PID 2800 wrote to memory of 4604	2800	msedge.exe	89
PID 2800 wrote to memory of 4604	2800	msedge.exe	89
PID 2800 wrote to memory of 1508	2800	msedge.exe	95
PID 2800 wrote to memory of 4132	2800	msedge.exe	96
PID 2800 wrote to memory of 1508	2800	msedge.exe	95
PID 2800 wrote to memory of 4132	2800	msedge.exe	96
PID 2800 wrote to memory of 2016	2800	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mass.edu/forstufam/veterans/health.asp
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbe706c188,0x7ffbe706c194,0x7ffbe706c1a0
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,2022835162207653423,13771121871063722316,524288 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17270027209689125992,14720274909312121043,262144 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15657737345790174039,12445442363277518937,524288 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17283725503040749859,6135018433271753033,2097152 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1231966305941451361,8858330442304939859,2097152 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10441820732408042942,13101976702300439112,2097152 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,13630056155023907288,8426559023360759223,2097152 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,1368497152188531776,14501128162911289554,524288 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,7214068063568791676,11461666804141063362,524288 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13461448120923185793,8750631162734198838,524288 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13461448120923185793,8750631162734198838,524288 --field-trial-handle=2108,i,2651085842405136814,18137631246404645439,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3972125ccfb256a36eab4b28165dd68868bba79dc6401d7f34f770b32293a499
MD5 30fb426c8e8ead5769d80c2eea1c30be
SHA1 0a5a8bf594fced44d1bf1c3f4a9f9da360a496a7
SHA512 bac51e517b8a87895129cf9246b931cb9c8b89337d7d254381c5fe49411138aea7906fd0eb22e7aed1069cf30602651c172fb943bb114ad8f6ce13d0542dc505
TLSH
T144612C3800554C53E7C52133E4FFC94074B985EAFBA3EE2691336CBD6A0E729815DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d4c0.TMP
Size 3KB
SHA256 5fa737b0cf4b256fbf89f3006003080df92001516a15f09bb8443abd33dbb9d1
MD5 fa97e5fa5ff32dae28a2d452dfe8c8c3
SHA1 9f9c24d694c7a821f7673c228e7df4450d28df37
SHA512 0da0cab4c96add8b5fa4db55cc23c83e4edeb728fa5368b1d0979e8f4d656de64ef7fd4667fe9397aa5628f522491b28fcb4edd2c0d649910d4b0e3730da1632
TLSH
T11E613D3800454C53E7C52033D4FFCA4074B985DAFBA3DE2691336CBD6A0E725804DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 95268ff36fcc4bd9d50efa90848b019ebdc03befbf1656f5cc83d5c07af761ea
MD5 8aa5b55f7aed78e9e9fd3956861129c9
SHA1 17a2d6491872442c17454960cc8ef8f60a8f87ce
SHA512 ef0a95c061356af66c5248f53e306e2a9be6f182f2b53583b63c2ba02ad6e5d1a18a152d00a9f1a429cb95115c0c0a5b241ceafcb36afffb7fe34d7cd9901eae
SSDEEP 192:sxZMRKkUG/f/s19KaIdpxgHW6+WNlkK/Y9Is/OWGIgrJ:sxZMrUG/f/s19c6Hb3/2+9
TLSH
T15822A6166E28997B8CCBD219BB25BF13E6F9543192D45E58E6FC8A0C04E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 00f02f519416d1554721db63a6432b2738114b851e044b23bf828f7b8ceefdd3
MD5 9875c69e0a6a0d8440581cfa714bc134
SHA1 80036e57ee7ccab443f48430c369bdef03aaac03
SHA512 eaa6c570dcbdbf0bd7eb527ecbf0ba6ba8c95293c4393545bb993863d708f2a19afd8342f463d7376e9f9ce15dcea6090afc57cb2949e426b810a99a7c30c953
SSDEEP 192:sxZMRKkUG/f/sY9KaIdpxgHW6+WNlkK/Y9Is/OWGIg5BJ:sxZMrUG/f/sY9c6Hb3/2+x
TLSH
T1A222B6166E38997B8CCBD209BB25BF13E6F9543192945E58E6FC8A0C04E7ADD231740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6a46c985e49b5d97dc869e9dae2f104ffc74a2ae88db7308d6d04019a8879b2e
MD5 9dff620a94e432f5dccb9ef15122668b
SHA1 941d8fb58d12c35dde50630c9753a9dd5c2000ff
SHA512 9809d5b9c811da72f39591febfe23ee259b0bb8b1bd39e10ea7f6409562d913edade66d6d7f8196ee3f0a9253847d85dcea55cd0d4154c9b31052b9bfce66c99
SSDEEP 768:5fyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7aro/bqH:5fyvIZwWvu+Q+u1jamFLeR7R/a
TLSH
T148C2E92B240CCB7E5F801E9DDD5A6F9B3EA802C797588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2824f8b42f7e17a7f17175be833f1788ec6f32e12277cac9e75f9b9711b97146
MD5 06708b977f7155b07183f6301465ca44
SHA1 1743c63e07db9705f6635c049761f37664a5a2b1
SHA512 837b954f4968faa98e15329e811edb30be93505dd0e360fb4899213b84d9146f89d5f99e5af49df195c0790fe52e13340261118539371fc30b74c9d8749cae2e
SSDEEP 384:VsNOk95fzivVce+CeODejhYfOObjI9G6w7oN:VUrc32OijhYf29MoN
TLSH
T13B726C36BC384D769EA39651F68B3513AEB8517BC6893F80E1DC6F0C02DB6DC531681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20b1ce6e8191d61148a3075c6aaef40f97395403a945929b4f30193f3264ace0
MD5 dc4a69dd42125edf8bd7941e5b4533cb
SHA1 a52e646cb6cb9e5306e3b5765ea3ffb64a2d5efc
SHA512 1e5e810d8ed9ed6a4dc2a47fc9af2a63ec840a8de4a3a0ee69f192841354b47f04554321cbd19775d927a16d1dcf7fbcda2027e2756f01446668981d6028d410
SSDEEP 192:JONj6v+YLNQmiUyQjZh+CGLOD9oquskZU6:JONj6vz/dZh+CeODeM0U6
TLSH
T1B702D735BD281C7B9FF2AE45F98736179FA8217BE5952F80D9E82F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f27f22a10138fd919a909eb74c3097c792aec8faba69dc64117cbd0babb4e381
MD5 a37f644e30670dd060b20c273378b968
SHA1 31717edbb9e14bc23c11f13e160e103d9451392d
SHA512 8bbe2afb8d19a362c7a39d8c5ee84da0d335dc7b8f446412e43934dc4327b07276ab42adb2b93cb5c49bf6de425bb7d45e35484de024b668c72da0c4c7a15362
SSDEEP 192:iONH6v+YLfQmiUyHjMh+CGLOD9ojhDCHnq0U6:iONH6vzd8Mh+CeODejhQfU6
TLSH
T108122B36BC385C6B5EE26585F58735179EA85137EA4A7F80D4DC3F0C01DF69C234A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 989289f4d19c5261fdf1344d3861c6e60a96550b8002ada818b7c87ae3b48f14
MD5 206470c820e87cfc937758769dac5f49
SHA1 8be3aab0456cfa1c6779d92b21bc5042906eec3f
SHA512 c753e488aaafd6c200f135cab816b7627d0512e09a6fb5d858707a697cfbc1b7114bc9d96ca96775c2b969a2438d5a93f9e5c30cf408d33b2d0d29c514893a58
TLSH
T181412A58A6F91148F3B76E1AAFF6687D547EB8272E06D45E00010D4F0A32F40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads