hxxps://lp[.]constantcontactpages[.]com/cu/0NYf51n

Analysis

user interaction
yes
max time kernel
86s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lp.constantcontactpages.com/cu/0NYf51n
Sample260804-qenapsfl8z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303226449325599"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{A6E5B028-4010-4577-B31C-006C20FFBFCE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1704	4720	msedge.exe	86
PID 4720 wrote to memory of 2988	4720	msedge.exe	87
PID 4720 wrote to memory of 3732	4720	msedge.exe	88
PID 4720 wrote to memory of 1656	4720	msedge.exe	89
PID 4720 wrote to memory of 3732	4720	msedge.exe	88
PID 4720 wrote to memory of 3732	4720	msedge.exe	88
PID 4720 wrote to memory of 1656	4720	msedge.exe	89
PID 4720 wrote to memory of 2820	4720	msedge.exe	91
PID 4720 wrote to memory of 2820	4720	msedge.exe	91
PID 4720 wrote to memory of 3016	4720	msedge.exe	92
PID 4720 wrote to memory of 2820	4720	msedge.exe	91
PID 4720 wrote to memory of 3016	4720	msedge.exe	92
PID 4720 wrote to memory of 3016	4720	msedge.exe	92
PID 4720 wrote to memory of 4408	4720	msedge.exe	93
PID 4720 wrote to memory of 4408	4720	msedge.exe	93
PID 4720 wrote to memory of 4408	4720	msedge.exe	93
PID 4720 wrote to memory of 3384	4720	msedge.exe	94
PID 4720 wrote to memory of 3384	4720	msedge.exe	94
PID 4720 wrote to memory of 3384	4720	msedge.exe	94
PID 4720 wrote to memory of 1392	4720	msedge.exe	97
PID 4720 wrote to memory of 1392	4720	msedge.exe	97
PID 4720 wrote to memory of 1392	4720	msedge.exe	97
PID 4720 wrote to memory of 2372	4720	msedge.exe	99
PID 4720 wrote to memory of 2372	4720	msedge.exe	99
PID 4720 wrote to memory of 2372	4720	msedge.exe	99
PID 4720 wrote to memory of 3356	4720	msedge.exe	100
PID 4720 wrote to memory of 3356	4720	msedge.exe	100
PID 4720 wrote to memory of 3356	4720	msedge.exe	100
PID 4720 wrote to memory of 4748	4720	msedge.exe	102
PID 4720 wrote to memory of 4748	4720	msedge.exe	102
PID 4720 wrote to memory of 4844	4720	msedge.exe	101
PID 4720 wrote to memory of 4844	4720	msedge.exe	101
PID 4720 wrote to memory of 3312	4720	msedge.exe	104
PID 4720 wrote to memory of 4740	4720	msedge.exe	105
PID 4720 wrote to memory of 4740	4720	msedge.exe	105
PID 4720 wrote to memory of 4740	4720	msedge.exe	105
PID 4720 wrote to memory of 5032	4720	msedge.exe	113
PID 4720 wrote to memory of 5032	4720	msedge.exe	113
PID 4720 wrote to memory of 5032	4720	msedge.exe	113
PID 4720 wrote to memory of 3336	4720	msedge.exe	115
PID 4720 wrote to memory of 3336	4720	msedge.exe	115
PID 4720 wrote to memory of 3336	4720	msedge.exe	115
PID 4720 wrote to memory of 1664	4720	msedge.exe	116
PID 4720 wrote to memory of 1664	4720	msedge.exe	116
PID 4720 wrote to memory of 1664	4720	msedge.exe	116
PID 4720 wrote to memory of 3312	4720	msedge.exe	117
PID 4720 wrote to memory of 3312	4720	msedge.exe	117
PID 4720 wrote to memory of 3312	4720	msedge.exe	117
PID 4720 wrote to memory of 3796	4720	msedge.exe	118
PID 4720 wrote to memory of 3996	4720	msedge.exe	119
PID 4720 wrote to memory of 4504	4720	msedge.exe	120
PID 4720 wrote to memory of 2756	4720	msedge.exe	121
PID 4720 wrote to memory of 2756	4720	msedge.exe	121
PID 4720 wrote to memory of 2756	4720	msedge.exe	121
PID 4720 wrote to memory of 2108	4720	msedge.exe	122
PID 4720 wrote to memory of 2108	4720	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lp.constantcontactpages.com/cu/0NYf51n
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc3d9ec188,0x7ffc3d9ec194,0x7ffc3d9ec1a0
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,7000350492264441182,11359416236038480370,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17140152624895776514,1225872173873553581,262144 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,7755760914126458644,7128565380722663629,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3475426561735245722,15307968770409715316,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4503225600590091758,13646947364454391240,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16306950065663581170,1354178087618865827,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,12628068305504304469,25287379636924565,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,9606030112045853414,1312546179973819821,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5236,i,264282369746922400,16410287481699696874,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5424,i,563099788862382812,9220196327194057680,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12756777237316953074,686938064541707581,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,4392258592084196216,18033755603106469408,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9655193127168096577,14304085134621331549,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9655193127168096577,14304085134621331549,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6432,i,12411859045047061656,6015859783367874220,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4292,i,16184187712224558771,15709380878131421822,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4296,i,11928583811818685183,15725641702921664608,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6380,i,14005455655639083398,15316613547160041154,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4644,i,9252118461373140856,12459047860771606944,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,9023637316053646508,18231291127039490735,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,8996217403065129061,17133407163394759344,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,7612221036312933906,9010638350703982575,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4252,i,11134307681934122000,16700251466788010751,2097152 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,9602464249473171724,18131075195948201687,524288 --field-trial-handle=2372,i,10340276925419465401,10134840464155187279,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4ff639a6c656479ed7e8f5899d6eb4082ca2a8301088f9763e47edad7d9e0681
MD5 ae1b4ddbaf011b66db0f4c87388d5553
SHA1 c731faf41748fde7e0c14b20aaaf0d40c79bd96b
SHA512 e34aff65eb47d276cee696880261c7b0a71b8e2c9e423310e7f5ff89cbcc7631604976ba95c034b0b4b11b274076241947204966f5561debeedcb1ed75ed6177
TLSH
T17181B6351286D8E1F7710031BCE9426EB773A4D9FAA35EE211C4BC372509FD2A55714C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59113c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59113c.TMP
Size 3KB
SHA256 49ca2a37a74c9f23a4280401d7a2b13f5ac656634d3379f65b3fe996184dc403
MD5 033a28f08624883b6f8e7d4243afa6a3
SHA1 f8ff75abe6735e3eea610befb2afbb8faf99d552
SHA512 aca9e596d16c06db1c8bd37d044430d0acf4966cabe0bd07f1f433ca4569098b53ea05ac0166ecfcc30f38892f3c5156cec1155a01234ef2b06ccabf69434ed4
TLSH
T17E7170351286C8E1F3710031BCE9526EBB73A9C9F9A7AEE151D0BC372508FA2A64715C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 aa5d9401820ba84dd61cffa38a23b48e617dff5595db807c1411b078a4c36df5
MD5 6ee164c5298d6f552aee307376755c26
SHA1 96df25cc6c4afb5cb57642cf94fc58138b225688
SHA512 0cdb1f43d92e980e4433653775b72da30df074b5a256f9e0c0b6cf364a02f4339dbc0c322dd6019a94b310208f2bda49ce18e23873ec7ac0667eb59d63b81634
SSDEEP 192:D60e/OBdmwmrmEmNZKFpNJZDRLXvEBYMm6mOImBmiIiSm3l:D60e/OHDCtQZKFpNJZDRLXvE6MH5IKJ7
TLSH
T174D1BFF6C7E48A5DC9511AF0AB642E2ACE2B0A59532C3D1BC9D4EF1FA3E1071D101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0608a27a25dcb00938aeffaacf7041ae226ec27f74381a4828fabbf037732974
MD5 6a78de3fe8431a0dd7f9185654efb7b0
SHA1 989ab46dfe986e2bba9c32b2ba2c9863e58b57e9
SHA512 380104123a155567a1ac85149d106d99dcd81163b88b00a1f77a2bee1b5994c546fd7d1e3d37b3979e1999fedbcc43153b4f09ce433c7389c54353830700399a
SSDEEP 192:sxZvRkyM/jK1Ml8Mkw/fLsQgAIdpGhcHW6+WNtNd/YIpZR9OIgrJ:sxZvSMw/fLsQgBXHb1/I9
TLSH
T12F5209126B34697BCCDBD209F905BF53D6F91472A2900E48A9FCDA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3dc0041edca36baa86edaac7df2b481b8e4a2f56247810dfe5662ef37ca379e6
MD5 f795a79ecca374c0e5d58d1aa74257f7
SHA1 45adb00f66f366536091b2b484712443405fdd3e
SHA512 ad52ba59aed5584812aa1c8ad8c1f3d43013ef57462be57d518affaaff8664a8b29f102a969ed4d909a7ed093cdc32d0ef6dc8937c60cfb110c91d9eda1a650b
SSDEEP 192:sxZERkyM/jK1Ml8Mkw/fLsYgiIdpGhcHW6+WNtNd/YIpZR9OIg5u3J:sxZESMw/fLsYgLLHb1/I0
TLSH
T10C521A12AB34697BCCDBD209FA45BF53D6F9157291900E48A9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c909b736b7d1534ec9180175103aa5dc8393054e0a20c57a4b81e42c49f13a30
MD5 76118a8325a39e1f1731b8d86331e195
SHA1 90714621ddedebdca3e7f9086867ebbf49365601
SHA512 e4db5d251489c9f577f301610f6c243bf7102b229b0b7535273232ab31af59bb8109a1bfcbfababd4f0bba76b99517207c5fcf3c15a5cf53eb238caadd376e02
SSDEEP 192:sxZERkyM/jK1Ml8MwDw/fLsYZVIdpGh0hw4HW6+WN1+3Ma5iXYI7S9OIg5w3J:sxZESYw/fLsYZmlxHbjDXtS
TLSH
T12562F812AA345D7BCCDBD209FA45BB53D6F52572A1800E54AAFCDA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 39119fad27ca52cdfed82f4781d40984fe9421ce21444932d83b236f44bb9adf
MD5 5b9caa80fde68db552d799c14545c3ed
SHA1 ca275544626f89df95f11bc6bb27ddcd093ea440
SHA512 4e5f3651682b9b55c0e976e0ed946c6dca65c9d4927c9d63e84ec29d653b5b01d9989bc817e2d64d40c482ef9cf82dbe4ec92059761de187b5ade30cc4cab466
SSDEEP 768:33sqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9sroRBg:33sqxXlWvJD0Tu1ja54LAs93Rm
TLSH
T1BDE20B3B694CCB7D4F840E5DEC26AED76ED801CB66988D5447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 46f61860d22ca7441a2a141b80dd6fd656bdb53e0c650b73b41f3c98cf637047
MD5 45a15ecc389c7f58a0c149761ace0180
SHA1 8da1d6069e8b2b71bf7ef81f7d224d0711840138
SHA512 5c7aaf0f209931700b5540daf836db4259445ba9845a886152d7020a9b885ba5485f350f37251a687855a203174d432764763bb6356334db14b7a183dd8d0ea0
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2ApGEKnK6g:ExH3ZFDNhfg
TLSH
T174F1221B313A0652387E294CB2A68A3B4F4231A37418E56F7FB850A55E6EE150DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 62bf260b3f8df482f17a9a43e773cceef2569faedb5deb14ac3d0b8461e500f0
MD5 805653fff3559f11deb6f2133a51d3ea
SHA1 f2b35029b8feb99062d9bb5b0f3f7131b02728b2
SHA512 1f420ca02535145a153c4bfa895d477769a54c79ee9393ecb9f9cd4e166afa2b6df294adc82968eaad0540853a2f8165867201ceea7f05a8a2b03ee1d5d28b46
SSDEEP 384:HZcIhsNqRD/3b8kOVRN5Oj9z9d+2fuc0BeRs9JKgqijUb6:vhj5MH5Oj9z9dlmc0TjKgqmUb6
TLSH
T10D927D315C346D769AF6A541F88732174FF89067E6C86F94E1ECAF0C019B99C130F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6fa8036928e08e8ec5157d985de44a30af13b8e0f20ed84070b5b2b19263f3a1
MD5 776eb74b382e57b72abdde6a65c925c8
SHA1 0e60882ff39b36b4bf9507c61bb275ace99269ad
SHA512 bb9e9fd958507c270037fb60ab99c0f12c0ad9cb6d42a05c0a800cc5fa54222a4816ec5264feb1bf558cfbdab45fd1e666be106404ad0c35129f789ab6b46647
SSDEEP 384:HZcIssNqkD/3bjkOVRN5Oj9z9d+2fuc0BeRs9JKgqijUb6:vsUMMH5Oj9z9dlmc0TjKgqmUb6
TLSH
T149928D315C346D769AF6A541F88732174FF8A067E6C86F94E1ECAF0D019B99C130F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0bfec1c7bb93cea33b5379874961632c7f435dc94df09fdfd465a912e8b0b103
MD5 6f801769b97c74d7f915f2f2535db13e
SHA1 090a3792368ffbf6e5e05b4c8d9904df66f608b1
SHA512 96751fd6efbe577e69043b55df630b10e258235565f5e0a0b0ddf98498120f4d2928464e1bfd4d9e527c51057c68b0a2795be74cf63b9af13b9e3e0a5694a71f
SSDEEP 384:qZcIssNqZD/3bjkOVRN5Oj9z9d+2fuc0BeRs9JKgqijUb6:IsfMMH5Oj9z9dlmc0TjKgqmUb6
TLSH
T12E928D315C346D7699F6A541F98732174FF8A027E6C86FA4E1ECAF0D019B99C130F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b7970995efcb4923a85c688b70cc35dd2e1b80ae6b8bb50142d2c19c22636908
MD5 7358da4a751f9fe5fd0f266ca015f73b
SHA1 c51debf0d3333b869ffa4952ab2d3bf2bf300ca2
SHA512 b82d96662f0a9ac16b1921c3fcb2cf7f40ae8a4c51fef19ae3c112af15e934d03a3aefe098e614a4cc45ce91e922376e58b96fcbee0f272da108c3704cc65f19
SSDEEP 384:SqZcIjlsNqWD/3b0QkVRN5Oj9z9d+2fu10BeRs9JKgqijUb6:Fp6d6H5Oj9z9dlm10TjKgqmUb6
TLSH
T192C239F158E75C36D9ADA703A77E2E074EBCD023B1845A90B3D86A0CCD9697FD30A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9174efa8015378231cb82b009e990761ba2568566e82237f4182eb03b9f8c29b
MD5 5fa4efc8e506f0d87401908c2c243911
SHA1 41ae38989e4e68a1a1c06a61dc5abb1509c6161a
SHA512 d00668ca9b37621ca99d7f9752b287c565dfb04aee7501b91a36f0c1be88526e2059a98cf1518a3fac14959c7b8e59d060ba08fc580c94d6ff5897b87e557784
SSDEEP 192:tONiD6JkRtQmiUyBnW+RN5Om5o92h3HRXU6:tONiD6UrmW+RN5Oj9+dU6
TLSH
T19C02E8356D386C779EF26E09B98737175FA4207BE9852F80D6E81B0C01D7A9C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2fec49e3d2ea5fe89705ce29ec7dd3332600e31846ec71475ecd08dad067e113
MD5 1a0edf1c22c82f2be77d77bdb3961eb3
SHA1 b401654b78e4e9a7f893bc6fe0f7d10e6e56d861
SHA512 66bfd5c3952c9c5ea9606700e070f5d8174682d10601e5044033d1977c467dda9457ec2d3ea26c9cc11bd37c68dee8f86b5d61982606904d3c2efc813a63240d
SSDEEP 384:qZcIHsNqWD/3b0mkVRN5Oj9z9d+2fuc0BeRs9JKgqijUb6:IH6b6H5Oj9z9dlmc0TjKgqmUb6
TLSH
T13E928D315C346D7699F6A541F98732174FF8A027E6C86FA4E1ECAF0D019B99C130F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d2d1096f58a0ee60c53ff6eac9f364be3e678bd7ad9bb09eb42ccaf79eba59c
MD5 21ae4d66730df1e8cfbc81509d20e232
SHA1 ad80fc81fb9a9a1eec16bd9abdb1929aba3b9795
SHA512 b65b2e593b2ab8c0271fcd45312164bb70cf6abc3767f73b6e2eb4d3a4c125ef629262cd86dcd698b9e03ca186997b3c1db33634409ca65c908fa40b34a2f656
SSDEEP 192:nONL6JkR1QmiUyinq+RN5Om5o9nz9d+2fuEVc1q0GU6:nONL6UTbq+RN5Oj9z9d+2fuz0U6
TLSH
T1E5122A366D686C779EE26941F48731034FA9612BEA896F90D1DC2F0C01EF99C134F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 627c69b4f106dc71a8264136510b51806e4c38f68618d7ea2a2c9377a1f5eb2f
MD5 eed85de8ce3504059930b93f966b6283
SHA1 80f957ac38dd98a56b8a05cb7d11297598f077d0
SHA512 f735c12d4be8edd58cb7d82ae3cf2f023af815e051b2945cf34ad4dff133981926cb6a1d3e89cd8c3671925394c0c5b36b92e0ce7a91b91037d1c89bc60ead4c
TLSH
T107E00443130000CFC0310330404357301FF3C071131353474D1541547D303115F301C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588047.TMP
Size 392B
SHA256 6fa92d154283cc75abe2a41b14c9be50d74a9acb5a8f75cf7c6e283ba6c1374c
MD5 45ae1425cc9c9735210cec8affc1d7b4
SHA1 fcfc975e8d4a2419a1ad489e098dbfb9354ebcf5
SHA512 f4249756557075653418671e0df92e03ad3f22db9e887e26b39cd0bc4521af68c62d05c53a112cb4d7fc81b7fe503b8dc7b099c35d01ceb6ee1d91dff0db1535
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ebf90ff9cb218a4282a8a164bbb09b6c663840ba755666c00fa3c2156d9ae1d9
MD5 e4bb417f17b47b119a8b5b768515359f
SHA1 934273a24b99bc31125e479a08d088cf32de3f3a
SHA512 ef4037be88543df77488dce2c0079717f7032b3f6aa1596be19f95d4fc9783b4a4349eb75e019facb802b3d3c3f05dd0fb80d5497b1f5a557cac40cf53c5cfdc
TLSH
T1D9412848AAF90148B3B76F4AAFF6A86D447FBC772E06D45D10110E4E0662A40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads