hxxps://vmi3474446[.]contaboserver[.]net/?_task=mail&_action=get&_mbox=INBOX&_uid=79013&_token=7d43961e9601c6f0f4fdc268adaee8db86990d41efb653d764e1ce5225e180aa&_part=5[.]6[.]3&_embed=1&_mimeclass=image

Analysis

user interaction
yes
max time kernel
82s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vmi3474446.contaboserver.net/?_task=mail&_action=get&_mbox=INBOX&_uid=79013&_token=7d43961e9601c6f0f4fdc268adaee8db86990d41efb653d764e1ce5225e180aa&_part=5.6.3&_embed=1&_mimeclass=image
Sample260804-fsqymsgk3w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302937152903176"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B884385E-0E7C-485F-A580-5BB55B530D8A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2576	3140	msedge.exe	87
PID 3140 wrote to memory of 832	3140	msedge.exe	88
PID 3140 wrote to memory of 4964	3140	msedge.exe	89
PID 3140 wrote to memory of 4964	3140	msedge.exe	89
PID 3140 wrote to memory of 4964	3140	msedge.exe	89
PID 3140 wrote to memory of 3932	3140	msedge.exe	91
PID 3140 wrote to memory of 3932	3140	msedge.exe	91
PID 3140 wrote to memory of 4476	3140	msedge.exe	92
PID 3140 wrote to memory of 4476	3140	msedge.exe	92
PID 3140 wrote to memory of 4476	3140	msedge.exe	92
PID 3140 wrote to memory of 3244	3140	msedge.exe	93
PID 3140 wrote to memory of 3244	3140	msedge.exe	93
PID 3140 wrote to memory of 3244	3140	msedge.exe	93
PID 3140 wrote to memory of 1096	3140	msedge.exe	94
PID 3140 wrote to memory of 1096	3140	msedge.exe	94
PID 3140 wrote to memory of 1096	3140	msedge.exe	94
PID 3140 wrote to memory of 4020	3140	msedge.exe	95
PID 3140 wrote to memory of 4020	3140	msedge.exe	95
PID 3140 wrote to memory of 4020	3140	msedge.exe	95
PID 3140 wrote to memory of 3112	3140	msedge.exe	99
PID 3140 wrote to memory of 3112	3140	msedge.exe	99
PID 3140 wrote to memory of 4472	3140	msedge.exe	100
PID 3140 wrote to memory of 4472	3140	msedge.exe	100
PID 3140 wrote to memory of 2052	3140	msedge.exe	102
PID 3140 wrote to memory of 3384	3140	msedge.exe	111
PID 3140 wrote to memory of 4748	3140	msedge.exe	112
PID 3140 wrote to memory of 2296	3140	msedge.exe	113
PID 3140 wrote to memory of 3532	3140	msedge.exe	114
PID 3140 wrote to memory of 3532	3140	msedge.exe	114
PID 3140 wrote to memory of 3532	3140	msedge.exe	114
PID 3140 wrote to memory of 4584	3140	msedge.exe	115
PID 3140 wrote to memory of 4584	3140	msedge.exe	115
PID 3140 wrote to memory of 4584	3140	msedge.exe	115
PID 3140 wrote to memory of 4772	3140	msedge.exe	116
PID 3140 wrote to memory of 4772	3140	msedge.exe	116
PID 3140 wrote to memory of 4772	3140	msedge.exe	116
PID 3140 wrote to memory of 468	3140	msedge.exe	117
PID 3140 wrote to memory of 468	3140	msedge.exe	117
PID 3140 wrote to memory of 1064	3140	msedge.exe	118
PID 3140 wrote to memory of 1064	3140	msedge.exe	118
PID 3140 wrote to memory of 1124	3140	msedge.exe	119
PID 3140 wrote to memory of 1124	3140	msedge.exe	119
PID 3140 wrote to memory of 1124	3140	msedge.exe	119
PID 3140 wrote to memory of 3800	3140	msedge.exe	120
PID 3140 wrote to memory of 3800	3140	msedge.exe	120
PID 3140 wrote to memory of 3800	3140	msedge.exe	120
PID 3140 wrote to memory of 3220	3140	msedge.exe	121
PID 3140 wrote to memory of 3220	3140	msedge.exe	121
PID 3140 wrote to memory of 3220	3140	msedge.exe	121
PID 3140 wrote to memory of 632	3140	msedge.exe	123
PID 3140 wrote to memory of 4064	3140	msedge.exe	124
PID 3140 wrote to memory of 3048	3140	msedge.exe	125
PID 3140 wrote to memory of 3048	3140	msedge.exe	125
PID 3140 wrote to memory of 3048	3140	msedge.exe	125
PID 3140 wrote to memory of 4064	3140	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vmi3474446.contaboserver.net/?_task=mail&_action=get&_mbox=INBOX&_uid=79013&_token=7d43961e9601c6f0f4fdc268adaee8db86990d41efb653d764e1ce5225e180aa&_part=5.6.3&_embed=1&_mimeclass=image
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffa062ac188,0x7ffa062ac194,0x7ffa062ac1a0
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5742113602318625606,11977426358765248976,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8017544068027475680,3066392240302420181,262144 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8203991183818167665,13583592915895379497,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6748439810980988787,8156354867687977555,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16920602398190031683,7833631008795196293,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,9930527495398035580,17196525723428727946,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,4765550424785460972,15019953411503229078,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,16407621861501740857,1753789069086208522,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,9414981559556221967,11644401824014838396,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2653263151943103387,14052408360304922152,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2653263151943103387,14052408360304922152,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,9947781619897045310,7296828209314406641,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,2198203917803609302,11018860318364357798,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,10894881096110123888,18236294910904018856,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4724,i,12192900447379999751,11041969704629684693,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3584,i,11498381622946798370,18273998726617322354,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3968,i,9998777517929659471,14870244673546981043,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,8983417545911059631,10585686578796742883,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17389557618447232903,7762930561069269127,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6772,i,14110647680502674607,6999149866949099053,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6636,i,5612086027031878368,17249746770663121639,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4764,i,6262531737009782525,1626080883874640664,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,15831085950212229256,6979123595317914879,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,15831085950212229256,6979123595317914879,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,6124884660882923027,11571526388601039768,524288 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6744,i,6477875010768945801,12808765903190405580,2097152 --field-trial-handle=2256,i,522535536923399894,11508416770614285098,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8c605a069294252273e8780cd3583a8ae688781cd3bbfb104da743dbc8ec3349
MD5 a8e7775101a6fb7a72b1d795773346ce
SHA1 b9799ea7687f7095b06e80335d2c8a7bf7ff83c1
SHA512 e8db48802db3fbad8d233a135d79e6cfdbd9060a89d8c721205583699814479e9913260c391aba1592a96d4083787169edc78efabcd0d5d7fa9451747cc76d14
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T1ADB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 9a0e2b69d0cbd1e8738a8c279fc95914d8d485447f427d96de9ef48be5a580a3
MD5 f75e9ff6712a0dd99e2dc91f3fcdc6d6
SHA1 941addf8abcdc662f9a8e17bc0e156b273d4768f
SHA512 c5be264e390d28f946bddf19ab0dc2015c50b8297ae1f83064026492e50176b7a53de46917c7e5d9f4e05520a0ff1b700213986cea494ac40e5e6da78af41da3
TLSH
T117E020451682E1D46E439587A858DB9641D0730FFD4CE4DD721762CEE8C3014C346CAC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 293a0658077963352920f210cde4c2ca3c23d0f0f73547207434dfe76aaa9d28
MD5 36721ddd4a6dadfcef42ef863cc4c516
SHA1 c9f2a7a884091d642fb3918f870075a9f8f1db06
SHA512 83b50cc1f62efa9233c9da95fe5c8d256e23b6e4d3a52b31164c25f5f5f110926fe71167676ecedfb6d3bf8a6876c5cbc1b6e28b86e4cf4b3c6768e4b0728458
TLSH
T1E3616069974204B5CF63167EF3E0521139F2B4E8351BCF62159079BEB11676C8D3B458
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58966f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58966f.TMP
Size 3KB
SHA256 74c11b1d9510df5256276abd8e216b029d55dfb863d9649d3fcf565ea5c28015
MD5 f2f7af5ad05319a24ddfc83e9cd01ac2
SHA1 5e288af78c920e946bf4fc619726c87b3257c2dc
SHA512 8bc7869f1267a275ba8d1ba152a836b8f8cd78d6792aa34f20a00437708a6431730a4a04da3106481dc778ee9c1b51360fd8301d3d0ebb2a982f85d88faa7290
TLSH
T193618F69974208B4CF6316BEF3E0532238F2B4E8390BCF62119039BEB11276C8D3B448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e15e775e5b2278a3bb63354e9d668070bf4a05d7ff386d28ab1e48e587a1bcaf
MD5 5e2600b846c65a7b9e53195fe49573ff
SHA1 4e3e7d95fb6bf339790b6e80434dbd709df4309a
SHA512 22bea4467759afdbe5943a6c1a2885f0d37545470fbace7a15310efc2c6a6426a115986a26ab43ecaad9d8647a9188e0367b031221403c300db42df511dc0cdc
TLSH
T15F11A0B783D1856E8A1116F09A14AE2BCE2D0512432C7C19C6D4FF27D3E3475D00255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2d8564a10ad54c57c3f4d73417b78a62874beb633fce2a0963b7ceec25168167
MD5 8ca5a2116b1579db497506dd0fe0c344
SHA1 c654650580c8eae71c6be84e3d89ec965f4cc97f
SHA512 10345325e1824f86fef26baf367d6506cc702d56d96b91988fc903e6cc240d4c948bfc869416cd8a5284cc04bdd6e5b82a4192a02a468d8f863625bdf6b726fd
SSDEEP 192:sxZWRuyM/jK1Ml8MkG/fGsVzwFIdplfHW6+WN+K2/YwOLvjIgrJ:sxZWYMG/fGsVzw2FHbi/s9
TLSH
T13552F9126A34A977CCDBD209FA55BF53D6F90572A2940E44ADFCDA0C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 979d0e4b025288ef43e280156481e86620fd6f716d6b8b66658c0082861b4fdc
MD5 2b60955bb1f7a370a9e1d793824797c3
SHA1 630067da550151096526b657bdc79a297ba1ccbf
SHA512 461e813dd6c72862282d8a4235c14af1e1a9a608e362f83620f665f2a40f4a48d7fd0048fae9376720d16b3024d3b8e64fc4dbd1dcc04c1232bc06c64e1e37ce
SSDEEP 768:Re4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dqrohNcZa9:Re4jeXmWvmKLEu1jacPLZQdBk4
TLSH
T149D2093B240CCB7E4F844E9CED26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f8b2943c1b594e200e5d96919ff1c8b2e0ed747d8e0e928d2706c61b023c467b
MD5 cdf912b703561994ab8e7ed91b71f17f
SHA1 d3380e53686337848ae6299dd85129970af283e8
SHA512 89c8eb568eaebd6f75fd6b18cad59967909b758529e2b4d5c0ae15b62a081222b8c789342fc2957c585265cd7351d9b4f7f822eeae74660e30d5ce97e69a72e6
SSDEEP 48:KNOfCuD1IxKuEkDylrIBKsIM0/IZK8Q0Tyc:K41KKuE6mrmKsIf/iK8QSp
TLSH
T19191248B76BF02212C3E694C95908B1717427A637418F42BBBA911724EABE345CFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5932fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5932fd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5cf08d690c8b4d18f0e8e0539673db7eb58a36f66921055c289a224b54120b75
MD5 3d7302ef4021d9ab999db978c8418cb8
SHA1 aa20592425cec5fbfa21ea55a85ec70771499a9b
SHA512 f6171e3e35c83c12d9ef85535a8fd228d9ee78d76d6fbc01647322308b098ac278a9f066d457f662c05ddf05f625c29c5a97c1d76d97867296c2d718689ae6c2
SSDEEP 192:EONG6hZ0QmiUyVFpc/+jVSjzor9oZ5wOZOaU6:EONG6okpu+o8eg2NU6
TLSH
T1F102E8356D686C678EE2AF45F48727139FE8112BEA956F84D6F81B1C00C779C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7d8748d66fdf57e55ecc1641c279a11689bd8fe8de0ef3ee964f897d230434cd
MD5 9445e3ef8a9bba0131bc9d2c53fcb768
SHA1 ff171933a1c32a04031e7ceacbc65c013b909605
SHA512 8c4e5955695bc0293886025a6af53b826f1db4346ea21dfba9e9ee8a694c98dfad92353e512d53727b2b49a9c5796d0b27580607b226fc2ebb2fdbcaf59b05a2
SSDEEP 384:fZcIhsNm43OgI9nuf+o8eHXo+F0BeRs9JKgqijUCE:3he4ex3ow0TjKgqmUCE
TLSH
T1B6927D319878AD7699E6B6C1F48726174FF89027EBC46F94E2FC6F0D004A5AC131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ebaf459086dce19436f4686b2d65d97035d3c5fa486c57678ee0a420cfb03432
MD5 7664f1cc887e732deeea356af6826fb1
SHA1 184421103743f9cd5283f13a29bac33063a0530e
SHA512 95a710847fcd063bdf2566d93907fa48df34640f18a4163f81d79e2123e4db4a5c291954b9168a538889fe83f9257ebcb0443d4c1fda26c8e3cc61156e6ef34b
SSDEEP 384:SZcIhsNmp3OgI9nuf+o8eHXo+F0BeRs9JKgqijUCE:gh74ex3ow0TjKgqmUCE
TLSH
T19F927D719878AC7699E6B6C1F48736174FF89017EBC46F94E2FC6F0D008A59C131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 fb778464a15262ddaac8947799030d114d82a2bdbf8ecac952bcfd2fdffca0aa
MD5 cbd9a25b7f7e48f2162c6efb3d85048c
SHA1 5fdd299b4db7ef804588ce8565689cb329b8efa3
SHA512 6cc1a2d8e7408553650e4975f0d673ae287cfee33310f643627dd89c6f137e3332d3bb45413e85f8e2f030ddb443611e4522676f346d036030e3b36f4477b925
SSDEEP 384:miFiZcIszsNm8TUNTUlIlp3OgI/nP2f+o8eHXoaF0BeRs9JKgqijUCE:NFQQ3wgTOPmx3oM0TjKgqmUCE
TLSH
T148A27D7288A8D97BADE6ABC1F44A36178FF45067DAC1AB94E3EC6F0D004A5DC130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1bb3f7427e5c5f7b87b97ad48dd95bfd72616c20a353d280c73aedc96e05d113
MD5 168b55d3463a252159ec7e5803bbf8d7
SHA1 0a83447c4d7e53f07877908d174399062b924624
SHA512 45bcc1981e451588d72c3c616936136d1f4ff9a7628087e10165ca007d935bc2d37e8f38473db20b6ae3d4b8be2099a28bae8ccaa467e64f9ed57e0ee6be93cf
SSDEEP 192:GONn6hZDQmiUyPFKc/+jVSjzor9oHXLEO5cOqCqMTU6:GONn6JQKu+o8eHXoh90U6
TLSH
T11B12EA3269A8AC674ED26681F48736139EE9512BEEC57F84D6FC2B1C00DF6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 25ab3b60af5dc3548a90c370528098b5e7356b4bac1140abdc0c099fbdc06c77
MD5 f7c92d3c5ad8a8f769c6495c757c0537
SHA1 cf2d826ecc8103c7f6c29ae7988902b778e39589
SHA512 717c04712a185949de58464e70e5a15f4ca1140c0547d8ea7593adab327ef070bfb3d17f072a8def2e270d645dbe31318cbe363de76dfc73728cc4d9111aded5
TLSH
T150E00203E3100059D464033401835F502FE2C06103A353558F31557C3C317007D20A90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2a80dab72280b7102df5e5be16cba8c3acda9f8088b466eeed439a53b2bfbf7b
MD5 466a017c355ed33de89bee37f22effe3
SHA1 a3477940332521a7ec6683378c5beecaa537f0a9
SHA512 eab3f03ad1d02a8d5aedff7239b2586bc0a87f73e58deb4ad3beb1651f364199cdc619d763802f8954cf164355683d11879904e253a0b7ef3c261af64f7c0655
TLSH
T1D8E00142E3100056D464033401935F502FE2C1A103B753568B31A5BC3C327007A21B95
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c7117fd18ac5d32a7a1e3f37640be738a1d1ba018ce28c69d4fa7b335de03074
MD5 de162e9cc9581bc626e5405d0ac7c9c8
SHA1 d06b76be17dc1eccf5be934871198f2761e8f546
SHA512 1407f5decc4ce5a6530c5d1271a5fd0cfab7af54a973741af2d7261a7a3234ef24f69237455880819d069b11ae090bcf50f1c4b25b5230fd4a9d5a4b6d01d08e
TLSH
T1A2E00403F3100055D450013401435F501FD3C031035313554F31557C3C303003D10550
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e606.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e606.TMP
Size 392B
SHA256 aaee4bcd4a30e1137a038126dc9dc51b6358dca89a4c3718ba95e944d91aaa1d
MD5 5f23fb66c4a517fb1f188600144bf48a
SHA1 0b90c418774602daa1d2a95c23220fbeee1b1dfa
SHA512 f64f754441fd48910b45e8594d6aeeff468d6f6f497b6d207eb7971c03fce192f2c9ddb1c734ccf0bcb32571ced234ab2262d08aeb3a661b6668fa0815bfe556
MD5 SHA1 SHA512

Submit Download

ab100693-8daf-4fa3-ab7c-0ee51cff47e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab100693-8daf-4fa3-ab7c-0ee51cff47e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dee3f3d183b47eba72969dc1b61523bc06f7622f2e5620c41e32bc5bf642db0e
MD5 f5b043874636f52c65c52c79086101b1
SHA1 dca4a241c5e7e296230b8fce72887b7c7faa85e4
SHA512 8a8190878d0694dbf76a41f9afdb436bf73b83fd914233047ddcf5789557bebb8114b6675423f7d08952371acb073c8b49ac8f3b1bb132c1bb41f4677e2b775d
TLSH
T1B7411458B7FA1148B3B76E5AAFF6A86D447FB9772E1AD55D00110D8F0A23B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads