hxxps://cdn[.]kornferry[.]com/privacy/subprocessor[.]pdf

Analysis

user interaction
yes
max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.kornferry.com/privacy/subprocessor.pdf
Sample260731-lyklpsej31

Score

4^/10

discovery link pdf

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x0003000000016887-202.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299654000616611"	msedge.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2CEC472C-95B7-4197-A09E-D885DF322BC6}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
632	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 612	4116	msedge.exe	86
PID 4116 wrote to memory of 4064	4116	msedge.exe	87
PID 4116 wrote to memory of 3664	4116	msedge.exe	88
PID 4116 wrote to memory of 3664	4116	msedge.exe	88
PID 4116 wrote to memory of 3664	4116	msedge.exe	88
PID 4116 wrote to memory of 4128	4116	msedge.exe	89
PID 4116 wrote to memory of 4128	4116	msedge.exe	89
PID 4116 wrote to memory of 1952	4116	msedge.exe	90
PID 4116 wrote to memory of 1952	4116	msedge.exe	90
PID 4116 wrote to memory of 1952	4116	msedge.exe	90
PID 4116 wrote to memory of 4972	4116	msedge.exe	91
PID 4116 wrote to memory of 4972	4116	msedge.exe	91
PID 4116 wrote to memory of 4972	4116	msedge.exe	91
PID 4116 wrote to memory of 2220	4116	msedge.exe	93
PID 4116 wrote to memory of 2220	4116	msedge.exe	93
PID 4116 wrote to memory of 2220	4116	msedge.exe	93
PID 4116 wrote to memory of 1884	4116	msedge.exe	94
PID 4116 wrote to memory of 1884	4116	msedge.exe	94
PID 4116 wrote to memory of 1884	4116	msedge.exe	94
PID 4116 wrote to memory of 3108	4116	msedge.exe	97
PID 4116 wrote to memory of 3108	4116	msedge.exe	97
PID 4116 wrote to memory of 3108	4116	msedge.exe	97
PID 4116 wrote to memory of 2396	4116	msedge.exe	99
PID 4116 wrote to memory of 2396	4116	msedge.exe	99
PID 4116 wrote to memory of 2396	4116	msedge.exe	99
PID 4116 wrote to memory of 2584	4116	msedge.exe	100
PID 4116 wrote to memory of 1836	4116	msedge.exe	101
PID 4116 wrote to memory of 2584	4116	msedge.exe	100
PID 4116 wrote to memory of 1836	4116	msedge.exe	101
PID 4116 wrote to memory of 5080	4116	msedge.exe	104
PID 4116 wrote to memory of 632	4116	msedge.exe	107
PID 4116 wrote to memory of 4808	4116	msedge.exe	108
PID 4116 wrote to memory of 4808	4116	msedge.exe	108
PID 4116 wrote to memory of 4600	4116	msedge.exe	109
PID 4116 wrote to memory of 4600	4116	msedge.exe	109
PID 4116 wrote to memory of 4600	4116	msedge.exe	109
PID 4116 wrote to memory of 4644	4116	msedge.exe	110
PID 4116 wrote to memory of 1808	4116	msedge.exe	115
PID 4116 wrote to memory of 1808	4116	msedge.exe	115
PID 4116 wrote to memory of 1808	4116	msedge.exe	115
PID 4116 wrote to memory of 2000	4116	msedge.exe	117
PID 4116 wrote to memory of 2000	4116	msedge.exe	117
PID 4116 wrote to memory of 2000	4116	msedge.exe	117
PID 4116 wrote to memory of 2872	4116	msedge.exe	118
PID 4116 wrote to memory of 4644	4116	msedge.exe	119
PID 4116 wrote to memory of 2120	4116	msedge.exe	120
PID 4116 wrote to memory of 4696	4116	msedge.exe	128
PID 4116 wrote to memory of 4696	4116	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.kornferry.com/privacy/subprocessor.pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa09cac188,0x7ffa09cac194,0x7ffa09cac1a0
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,7917433310637986754,17796053845516101597,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6659726533223126052,16952153270638368986,262144 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,11413654008488280021,1606304467873086862,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9076800106613377865,1751049654910718471,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14742149018334631784,10292922677991440509,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,18375411604416822620,1580922016134203305,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11204747597129121484,4681204794192968474,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5040,i,5999882758931656895,3245165402533094620,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5328,i,16797493523488075259,9964892982798174103,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,17703206276427000442,4998207940856105510,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,13269922362015235742,11986293597417748009,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,18283337035269662590,13157243340400488238,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,18283337035269662590,13157243340400488238,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,7242803173074898334,14411673274159162440,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,2650769059447380382,7984783660400830091,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6820,i,15508988972678200161,13339179837996844526,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14666339092727991306,16261548537687949345,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7012,i,12715097303203123911,6480271299807849940,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4200,i,17309315088075753094,17434143712415722544,2097152 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,4410335156100668147,10013373131725249925,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,10633787139763609134,2472595102589087619,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,13127627541046683611,4199040650910041144,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,7830458732664613374,4856810916348841713,524288 --field-trial-handle=2208,i,8271828849317993920,18274584366618326892,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d73067b89bfbc8be18b0b2c7a013e0648e11acf6d419cc96664827462a16015
MD5 fd3b87c3ef7f311a59719fab4676e817
SHA1 31532a1694583782361759345564eb4a7448aabe
SHA512 4b35e9889a206184314fad501c94584a148b944fdbad4bb60c229098cf22016df6ff34c65e2cc6e0d35e4a3e10c58cc4b6392a7f446dedb1ba25c42268f0745e
TLSH
T1FE51CB34439E29E0D71D12F0C4E2CA593B7963C5FF4B5F3252701F76962A7A90522F28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b9fc054bb12ab803aefe818bf87277a52d6a3507aec5d45dbdbf18d52f6d0712
MD5 c62b4edf29a9ba6f982f139d0846d724
SHA1 638fdc1d4dc82fc70dad769f978e3cd0c31a1953
SHA512 c540669180ef780e8739ec7c835360bf74a0fd2be06fad32ded622f6f85ae5724f4489c16611ad79e1fd5b36051d5cdd33524d81d949fca0ae865cae6b92381b
TLSH
T18B61C970439E28E1D72D12F0C4E2CA993B3953C5FF4B5F3252705F72962A7A90522F28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e114.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e114.TMP
Size 2KB
SHA256 e401bd3da77d5e3dd77b33250c07fd2c16a604ff82c9dd6039033fbe0cf6e5ce
MD5 98ea2d5f95623bc30f5263b0e9256e72
SHA1 7751d64b519eff8434f6874ecd92eb13bad7aa41
SHA512 9131e30486a588e509d5ca1c44286077bf7ad99e0899713a1715180bcbc94f0042d43437d7356acaec8d46cb6162ea77ff4858e60d5b425ef82fbb44c3624a31
TLSH
T1A651737047AE24E0D32D06F1C8E3D6993B3593C5FB4B5F3201701F36AA267A90666F18
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 37b245a57670ca003bcb739ad46ee5a383fcde12a79e76252b6a86847ec4806e
MD5 0181fc534a3c1b0242117b29829270a7
SHA1 ab1e2303c1371169d8fafb28ce7e42b3dcd41514
SHA512 be84564a1b682196a55e433a1f008d57441184fca848ebd89cd92d2f6c08960a32b284cbb30a832f8308ee1fd04d03c16aa907458044f52aabc71b6462f671a7
TLSH
T1DF117AF3C3D5896E891116F06A24AE2BCE2D0616421C7D2AC9D4FF2BD3E3479E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cf3a84d19ca7f39903f5c46b5f824366f982c2c87e812aff538b072e560ccf57
MD5 09e67bb834ff9741f933695c3867979b
SHA1 50d0636deee5538ee70b700f1c6e2b58c140ad3d
SHA512 24352d829313570305a66de286c5cd68371b2041ccba8cd900078a5960800573a2fc8f4161d33778b12b3b144e0422dbd6994a989ac75045ff142a713865a394
SSDEEP 192:sxZ5QUnuRMkL/f7si5WhCodpa0HW6+WN5+Bg1/Y9IhqOwpTKIgrJ:sxZxnu9L/f7si5QnHb5Z/gOb9
TLSH
T10D32A7566A38657B8CC7D219FB25BF13E6F95031A6D41E54EAFC860C04E6ADD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9ae019c5c2a2b65c5f81d80e454a79de13b16a7e4215b8968212c4347acaf470
MD5 339a9edeede7867ab0c4228e5c81c3fb
SHA1 dbce9cb048b5b8612868268914b0a4dde4ae2273
SHA512 a5f64689b20640b36de3ef19bafe5419e0c45a35eb2cf5b8a3542ff756d83a59da7150fd9e442c24e2ebe53e09cbd589572201984d453bcc5fba1ee9bf5c039a
SSDEEP 192:sxZ5QUnuRM9L/f7sIOlWhCodpdMp0HW6+WN5+ZmUZY9I7SRwpIKIg5XJ:sxZxnuwL/f7sIOlQu6Hb5UTZ2RUD
TLSH
T1CE42B8576968697B9CC7E219FB15BF13E6F95032A2D40F54E6FC860C04E6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5148930011b029828d35fe18baf724dec558099f261f6f924fd29b6a60458dbb
MD5 bc311d373c5784919f41307f6fee0f8c
SHA1 1f481f52065206ab9301bd988f31b87dd2f17001
SHA512 f2ac7592430cf4a382cb748276fbd51aa96fdeb7788209d2fc852e371fae34272a7232c66ffe2246e28f9b46bbdfe614027ce585b6aff12ae63769a3af26b6a5
SSDEEP 192:sxZ5QUnuRMkL/f7sIO5WhCodpa0HW6+WN5+omeXY9IV/qOwpTKIg59J:sxZxnu9L/f7sIO5QnHb5lxXdiObN
TLSH
T14332B7576A38657B9CC7D21AFB15BF13E6F95031A2D40E58EAFC860C04E66DD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1ebd3bd1af1a7277568b609e796fb8e838bdce90fb0238b0a0dd37479d76b2d7
MD5 20e4e40344ecdd97d0921075b407fa12
SHA1 1a7b11c66b600c7708425989e619445b47fa9a56
SHA512 d2a9a81427bb3ab47c8cf9031cf00800e3ff9a90fe98ac62ae4a53c150ad0d42167e6334182cd25fe72ec64eb37d711732b14bb9b464f25034cbea3e92fe327e
SSDEEP 192:sxZ5DUnFRM9L/f7sIOlWhCodpHMp0HW6+WN5+ZmUZY9IrSRwWIKIg5XJ:sxZOnFwL/f7sIOlQs6Hb5UTZmR/D
TLSH
T18942B7577978697B9CC7E219FA15BF13E6F95032A2940F58E6FC860C04E6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b524cc567134ccb87f0b5d190cc5721a3cad7a168b5be57bddda8d22bd017f17
MD5 84c64ad77dab0103b770047468fe3546
SHA1 05e1ad94e29d0ccdfd5dad86b4f80625014210cc
SHA512 60b65dca86bcf67d02ff38a4371a4b2efa712e75292bd36bfa6579e610e42df76af114b093ff6bf39a678c22cc060f45a4c383d029361ca2f2f68496b09b7a42
SSDEEP 768:pDyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7nrowbqF:pDyvIZwWvu+Q+u1jamFLeR70wY
TLSH
T146C2EA2B240CCB7E5F801A9DDD5A6F9B3EA802CBA7548D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3099f5296ed8ac8cd83c7188f1008b7cd4c1b89fb994da24e82bf7b299cd5773
MD5 dcb92773d04ada46f1d7dbf904507725
SHA1 813b3575743ce91f89cc9a7071a7a187872b0c48
SHA512 02770f2345c7705aabfd09e946806bf89b0ca45e00f6e784e0474f46d4277214ceacbe0584deebf10fd3f12c0c74922396862929c0e4fedb10bc6eeac4d29fee
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygQKVWKnaQKbq6g:mTr70Hg
TLSH
T112918405703A0AD2387E694CE365953A9E827167751CE8AF7FB800A14F67E225DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bd60732-0764-4bf1-80a1-4efcd41d082c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9bd60732-0764-4bf1-80a1-4efcd41d082c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cb5df80a3d85644e68e4becdce2a07ec00c35b1f4dd9e6c9f9f2f314c6fa15e1
MD5 74ff584214c3db238dd4b951b217c001
SHA1 19319f0c4817fb5aae176716a713c389e0e0240d
SHA512 a84afb57b26fedcebd8a29f1faca2b0a4f4d171bd2726a4b2c08aba4615c3b4eff9c25ac8b2b20957de408849bb716f59a749619a6e9a91c412cb4b6e648b9ff
SSDEEP 384:IZcIhsNzE/HziXiUGe+CfOESJrcMOObjI9G6w7s:2h/TlURnOEShcM29Ms
TLSH
T133929E366C745D775AA7A511F4873A134EF8907BE3882FC4D0EDAF0D05EB6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 63d7fbb4adba1c3d2fbd5a709b75cee51b584c84f4cd8471668e255bcc520d4e
MD5 1a4c9a97ffd8dca565abbffddbdd114b
SHA1 44c78b2dbb533f832a4444408c40bad795e275cd
SHA512 0adb77e11605d28751ed7b947552ed866f1680fca0190f06fc82082430611dfa5ddc901bc8342b6da694bfbec2502f51f5a6a1c1c7acdd6670762564594df1ab
SSDEEP 384:EiFiZcIyCsNN8TUNTUlIl7/Hziw8UH2e+CfOESJrRMOObjI9G6w7s:fFQfIwghTqUHBnOEShRM29Ms
TLSH
T1CCD219F258D7497AD9AE9703B77E2D024DBCC067F2446A84B3D89A0DCD961BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c76da0d4894fce96bd4d1a957cb93aeabe3c0eb195e59ef2ef1dbbbf8f7e6975
MD5 bbe7b7da880c0ac1a5d01d98aa75951f
SHA1 ca4d958d4904ebf1083adb0a59c74b5b0f1fa63c
SHA512 84f0984050e5a89434108930e89a629042d7dfcd3cf6c9615dbbf52ad628651f7ad9ac2dd6050b58ef1e6f739000d7c395ce54240a0cfb76aa9a9665fb8d3006
SSDEEP 192:JONys6v+YLNQmiUy05Zh+CGSOImWusu4U6:JONys6vz/fZh+CfOuLU6
TLSH
T13502F935AD682CAB9FB2AE45F48737175FA8213BE6952F80D9D82F1C01D774C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6042c637019e92a6adb773ee788991a398e6a514d306172a1ee90d34c66ab5e6
MD5 cfffd6ecc454fccbe78906ff4275ee9e
SHA1 d07138dcbe3c8ae40e191627ad81cf59a9fe4f99
SHA512 aa7405cf08b1a55b2a1ac5258ec989d97da3dfcd739bfbc4b39481fefea2f62bfefaf13809e54b9380a977437fadf9a99e7dee399e8972f285cb36f494396120
SSDEEP 192:5ON26v+YLEQmiUy25Sh+CGSOImqnSJrACHAqKU6:5ON26vzAnSh+CfOESJrhMU6
TLSH
T178120A3668786C7B5EA2A544F48736135EA8512BEB4A3F80D5DC3E1C06DF79C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 56f572323828be956e3247fe638def0ce661f9fd9042732d1360b8035b537c94
MD5 e46057b1265dcdc9bcf41a437901957b
SHA1 a52130204efa91253c299c56455f456bfa61bd23
SHA512 ac9904422e07b3d5499317ade0db517884a19c6c895a93e4deb1ea27c97a233043d682c097ca36f55599a1f07ea01b0bdae098c765adaf20210a292c996cdc5e
SSDEEP 384:IZcIJsNz+/HziCiUGe+CfOESJrcMOObjI9G6w7s:2JZTSURnOEShcM29Ms
TLSH
T1BB929E326C745D775AA7A515F4873A134EF8907BE3882FC4D0EDAF0D05EB6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3d16ae98082714afb4c7b0a9b8bc265cf9ba703e6c033a9c334ad2458fb74023
MD5 ea9fa045b326602117ea8b023c68d372
SHA1 dd2c48808900d1129bc0259d18432634bebbbf47
SHA512 a7fa8657d47b135508eb3cc8793798d71dd2ad67f51882ab94894a8c69e393c9836d25f3e42b3c1ee122a428b410a0372fcafef11f163d674066a93a04a02069
SSDEEP 384:2ZcIQsNz7/HziwfUH2e+CfOESJrcMOObjI9G6w7s:kQ0T5UHBnOEShcM29Ms
TLSH
T1E5929E326C746D7759A7A515F4873A135EF8907BE3882FC4D0EDAF0D05EB6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ace9a1d9-f204-47cb-ac9e-437b896bab1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ace9a1d9-f204-47cb-ac9e-437b896bab1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 74c95b836446fb24d340a552a9829577fecbba4e39b4e3a82eadf9b55cf9f317
MD5 8c2561a10cd4f3419941051c4bd439c3
SHA1 773cd30cb65f70dc8c673499ef5fcc6c13e872fe
SHA512 7958d4598d9b658d9988ef8d13c99677400b62d0f9a625f2f1a99b91fab70120e3f98744e1c4844da29b3137134277640734918e33fccf94e2f4e012ba1b25eb
TLSH
T123410958AAFD1148B3B76F5A9BF7A86D447EBC772E06C4AD00110D4F0A63B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

3770bc6d-5595-46e1-9173-06635b8cb5e7.tmp

Path C:\Users\Admin\Downloads\3770bc6d-5595-46e1-9173-06635b8cb5e7.tmp
Size 157KB
SHA256 ee6f090f60380ed3f3f0096b5bea15557f1bcc8ad0efc0d3bd47baa82ffeccd8
MD5 3f0086f6276b74911099b20edb835edc
SHA1 ad0a5f69e83e9365bdb00732fa3d4fe4160433a0
SHA512 07bbc4ce5387f900b17633e9a2c5821cde1847d7e5e035c967cc4c2cddbc8240628154814154aa7249b8b0817af8f059b41a4bfdd65e218f350aeca1b4c7dc0e
SSDEEP 3072:KuMGTZgem4W548IbX0tQUJcLQnWcy1cbnWO06smHHmlOAwN:KusemJCktTM4S1cLzsOOt6
TLSH
T14AF30360889E6CDEC39217C15A0F3CAD74AD3272E2C51745736CC78603A4A7FAA1B95F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads