hxxps://email[.]conference-board[.]org/e3t/Ctc/L1+113/d4GScJ04/VWL2Hk63c-XVW25XmGB4Zmh4BW2F3lfm5SjdrwN5SJSmW3hCZYW8wLKSR6lZ3pvW6hmZz05HLLYhW9dZ6Y65M35x2VZv6Pc8sRgsvW2c9PcY96QDLsW1Fp5Xc27L9R8W2clyb_36hXF4W6lZN4c4c067BW6NJR4v91Cy5TW8L8yRh50bDFNW5vpzQl885YxrW6S13Wk3Hd-GkW9lV5bJ8nk9zHW6NP--w5h2SQzW5STPY73yzQC2W85HlST4dQ0vTW1C378J7xWy00W95dfYZ4y5W_3W8Zjj1Z70KBHfW5mw28H58blYQW6nWvvS3ZFM0LW2r0RbQ5nz-cbW3nrntX5VyrBdW2wktnJ4hQgv7W66q2th6FBCmqW64-XXv6rX6sYW2KtlzH2WfK3lW8K9Q5c1pKHMFW4SS8vk2-RYZcdy5p2s04

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
29s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://email.conference-board.org/e3t/Ctc/L1+113/d4GScJ04/VWL2Hk63c-XVW25XmGB4Zmh4BW2F3lfm5SjdrwN5SJSmW3hCZYW8wLKSR6lZ3pvW6hmZz05HLLYhW9dZ6Y65M35x2VZv6Pc8sRgsvW2c9PcY96QDLsW1Fp5Xc27L9R8W2clyb_36hXF4W6lZN4c4c067BW6NJR4v91Cy5TW8L8yRh50bDFNW5vpzQl885YxrW6S13Wk3Hd-GkW9lV5bJ8nk9zHW6NP--w5h2SQzW5STPY73yzQC2W85HlST4dQ0vTW1C378J7xWy00W95dfYZ4y5W_3W8Zjj1Z70KBHfW5mw28H58blYQW6nWvvS3ZFM0LW2r0RbQ5nz-cbW3nrntX5VyrBdW2wktnJ4hQgv7W66q2th6FBCmqW64-XXv6rX6sYW2KtlzH2WfK3lW8K9Q5c1pKHMFW4SS8vk2-RYZcdy5p2s04
Sample260804-v45cqstthv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303384293841368"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{48351266-2B10-4CC8-A6C1-12769D94F329}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2156	3816	msedge.exe	84
PID 3816 wrote to memory of 2232	3816	msedge.exe	85
PID 3816 wrote to memory of 1696	3816	msedge.exe	86
PID 3816 wrote to memory of 1696	3816	msedge.exe	86
PID 3816 wrote to memory of 1696	3816	msedge.exe	86
PID 3816 wrote to memory of 3936	3816	msedge.exe	87
PID 3816 wrote to memory of 3936	3816	msedge.exe	87
PID 3816 wrote to memory of 4280	3816	msedge.exe	88
PID 3816 wrote to memory of 4280	3816	msedge.exe	88
PID 3816 wrote to memory of 4612	3816	msedge.exe	89
PID 3816 wrote to memory of 4280	3816	msedge.exe	88
PID 3816 wrote to memory of 4612	3816	msedge.exe	89
PID 3816 wrote to memory of 4612	3816	msedge.exe	89
PID 3816 wrote to memory of 3976	3816	msedge.exe	91
PID 3816 wrote to memory of 3976	3816	msedge.exe	91
PID 3816 wrote to memory of 3976	3816	msedge.exe	91
PID 3816 wrote to memory of 4644	3816	msedge.exe	92
PID 3816 wrote to memory of 4644	3816	msedge.exe	92
PID 3816 wrote to memory of 4644	3816	msedge.exe	92
PID 3816 wrote to memory of 960	3816	msedge.exe	96
PID 3816 wrote to memory of 960	3816	msedge.exe	96
PID 3816 wrote to memory of 3344	3816	msedge.exe	97
PID 3816 wrote to memory of 3344	3816	msedge.exe	97
PID 3816 wrote to memory of 536	3816	msedge.exe	101
PID 3816 wrote to memory of 4348	3816	msedge.exe	106
PID 3816 wrote to memory of 4348	3816	msedge.exe	106
PID 3816 wrote to memory of 4348	3816	msedge.exe	106
PID 3816 wrote to memory of 3276	3816	msedge.exe	110
PID 3816 wrote to memory of 3276	3816	msedge.exe	110
PID 3816 wrote to memory of 3276	3816	msedge.exe	110
PID 3816 wrote to memory of 4464	3816	msedge.exe	111
PID 3816 wrote to memory of 4464	3816	msedge.exe	111
PID 3816 wrote to memory of 5624	3816	msedge.exe	114
PID 3816 wrote to memory of 5624	3816	msedge.exe	114
PID 3816 wrote to memory of 5624	3816	msedge.exe	114
PID 3816 wrote to memory of 5980	3816	msedge.exe	117
PID 3816 wrote to memory of 5980	3816	msedge.exe	117
PID 3816 wrote to memory of 5980	3816	msedge.exe	117
PID 3816 wrote to memory of 4180	3816	msedge.exe	118
PID 3816 wrote to memory of 4180	3816	msedge.exe	118
PID 3816 wrote to memory of 4180	3816	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://email.conference-board.org/e3t/Ctc/L1+113/d4GScJ04/VWL2Hk63c-XVW25XmGB4Zmh4BW2F3lfm5SjdrwN5SJSmW3hCZYW8wLKSR6lZ3pvW6hmZz05HLLYhW9dZ6Y65M35x2VZv6Pc8sRgsvW2c9PcY96QDLsW1Fp5Xc27L9R8W2clyb_36hXF4W6lZN4c4c067BW6NJR4v91Cy5TW8L8yRh50bDFNW5vpzQl885YxrW6S13Wk3Hd-GkW9lV5bJ8nk9zHW6NP--w5h2SQzW5STPY73yzQC2W85HlST4dQ0vTW1C378J7xWy00W95dfYZ4y5W_3W8Zjj1Z70KBHfW5mw28H58blYQW6nWvvS3ZFM0LW2r0RbQ5nz-cbW3nrntX5VyrBdW2wktnJ4hQgv7W66q2th6FBCmqW64-XXv6rX6sYW2KtlzH2WfK3lW8K9Q5c1pKHMFW4SS8vk2-RYZcdy5p2s04
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff871f1c188,0x7ff871f1c194,0x7ff871f1c1a0
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,2819918014619703831,6619519114352239036,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,7476665322419161965,17743449340007621387,262144 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,6468730363110823029,13444601714060650595,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,2883692534247369138,1481126673470325984,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,1071027424646685139,4708885450294678605,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,9815080884558961282,13956041796366269334,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,6353130599321131156,12584107991333265576,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9375603345928340299,14266329303497864900,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,13727103634886140019,11016990372518846603,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16770419176942165351,135385054587230002,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16770419176942165351,135385054587230002,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,9070233755416151434,7430804214639993742,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6584,i,8641711886911068993,6567022732296769590,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,5832358310384158128,11408048978916534738,524288 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6924,i,11554736467647401115,5121741689563533198,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7092,i,1190682695935748231,8183709270027012175,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6640,i,10902763397091195294,15302592253606099478,2097152 --field-trial-handle=2256,i,12178428607698880878,5717692099080728678,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

40352748-89be-4549-823a-cca7d4133360.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40352748-89be-4549-823a-cca7d4133360.tmp
Size 30KB
SHA256 ce7ea8f69a29b36cb406f9a443b238d05729e202d45620fe2d897cb3124e8f3c
MD5 84faf13a256fd2ffeadd2ebc8cab6a90
SHA1 7fc468a6517ff2ddbd254f8d29e10e6a5bf2a665
SHA512 ae95ae61d43f39eda0b4e504de044219b81638c48e8262a886d5fff73d2e9f7379e5e225b560cefb01a14002f57a7d51e9b4aaadea1bdfd7358c411511ae70e6
SSDEEP 768:11sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9erodVfeH:11sqxXlWvJD6Tu1ja54LAs91dVGH
TLSH
T1C1D21C3B694CC77E4F840E6DEC266FD76ED801CB96988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 30KB
SHA256 14b40de71456fdba1ffaf98050434818d135e877b7a6d879b5fd01d6988a93d4
MD5 e60121be6767e4212436c62f3a743fea
SHA1 60574fd61b96e53cf67a3d8735a9d9106fcfa94f
SHA512 5172e337336a2b832481dde365972b732a4d4106555bdff3fd8b89a57261187405d7fb9742edb6d6f41860966e41480207395ff8cdc550749e41455631335212
SSDEEP 384:0ZPgM+T5tW04KwZ5RJhig2JsxtLRnZ34uoiyrFWswKYEqh9Z9jBH5vIHChb7J5rJ:A0nwXRZ3JslYrBZvdVVrxn
TLSH
T1ACE276485740346B1D67C4568A54B8F3FF5360AE9CBD8BB575A408AC032FDA362ACDB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 115KB
SHA256 033052e2aa05a532696d3229fce83a4cce20e7fb0dee54687d1a7c821a62c156
MD5 f2d483c4e9707483a414544ec1cee39f
SHA1 f9d8f3f6d0469137490e4ae6e978ae1c11c32a7a
SHA512 92d805c96dc63b5771b7d539b577ee18d0288db9287506643aa80c7e7989adc418822820a8c1511e8da67e9166079ca60cb6651a12039aec80472c8e71a67149
SSDEEP 768:c5jGxwd97cjTuhWlJrlM9rmdHhLRnmlIIoqtAHRmNG+2ntb2xoEFtGPXq6yx7/vH:JwdC/amdHhLdm4quMGY3tGPa6Oz
TLSH
T10BC3C6A0F21031EA7323C55A71D0ED872259B153E56A4EB7F22F25D84F846CB16B3F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 79KB
SHA256 54e45a0cb0fb522c4c3637e3fa2d6a7729bf8e9b2266d268cae0ca0583bf6d16
MD5 110df922d0442ba4971d636f26e2dfc0
SHA1 d0615f29fce34c802f84bddf79b02afab8012f13
SHA512 f7f64ae88de4dc1778624515645aebd98b12460a4b67aa3fbdf6c2e40abedd1e3c2d482aa36f669049192f61a138a0f99855185c63e7b1b43b131ae26ad05992
SSDEEP 384:g1Q14x4121e2W2/NlNCHSH0lLC37nqMOjTrm/X532KoNi4oL4Th:g1Q1j121MHSHD32KoNi4oL4Th
TLSH
T11B831E6E184111C447B24B69D3DE8E6CEB3D917318121EEE72C2588F8FA6F5853CD94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 148KB
SHA256 9e5018d546d9fe93cd05ab97be5b613956a691214966a2498b94b0a633c39a39
MD5 3231973101892305a945cd10d0796a73
SHA1 fe27b43c7e9c29715a499cb9e8d868e987ed902b
SHA512 f98b37e485cf1fda977c34bc4740dc689f7c41ae4df75d78aa644b344730a55ab86e98e90be009f2babac2e1edbb9f16e8648af7148caf56f8a4c6ea4a858c7e
SSDEEP 1536:RrEhuY8t8heg/c0Sny3wxobm5FDAV7n52Z:RrEhuYN52Z
TLSH
T1E0E37369E580410412B287A5E7D33BAAAE2E9073530185FCBEE2315F7BDCB9C0159F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 825KB
SHA256 891c4b8292d0c518e005bcaf4a52f5de251f783710d86d409146c030d895c187
MD5 3e5acdb61f25c6c2c7deebd01205ed33
SHA1 13956b8c42a16ecc8e795efec1d41ef80538ac1f
SHA512 63e2865c7712656285526cc86344de2bf4f4007da253babf609a9036ef85544ccb0d02a0c6242f93007ff7d1269988631a7eb4129690ff030b91658d22ac640b
SSDEEP 6144:akyNrEhuY5F05Y4KkwwZVHVhMAjxUX8vZfl4wI49hH:o5Y4KkwwZVHVhMAjxUX8vZfl4X4TH
TLSH
T16905B590EA010859A27777B46BB227B5FE295033870B05F8BDE87118EFB959C1661FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 195KB
SHA256 49b9195d3dc5660e8e329b415832eb952e2f981ebf79c8f29fcaad89ddfc33e6
MD5 22a4ee3dc092b62721fc2b2906bed3d0
SHA1 c45ad4a024ca76638432b899ecae2dd2bd51bd7d
SHA512 df17311705d267abf600c87b45793854dbbadc69f393722bb2fbfcb2c07e755068c4b9924be4ee4cab1ea0a394eb4c956a78f743773f0e3b2e8ec600a6be09a6
SSDEEP 6144:yUbhYwRkxnUVyMFCTxdXD/6Kxd62wabEcMgfA/dEr2mC8r:ygYIOUVy3TxdXD/6KhwuEc7nr2gr
TLSH
T1321422A2FE3B5A572867F4C4B12623282020FEA4C1D5FB32BD8645DE0A6B16513733DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 153KB
SHA256 a78511840850c3e52efc92ccd4b1ac18c841e9bdeb41632e6df61a1875af7fe6
MD5 839372bd9590ae83963dc5ada894458c
SHA1 f871ca4a99d874806ff6ef5914d8e1153359742e
SHA512 b47c6bae3247f8205cc6ee580d832e17f0984f0247eedaa7c596f426b8e6b3be350e12b232a9b310f2662de8c339f4838a56869405c9c1ad6ac27840f07c1780
SSDEEP 3072:c/TaMk4yF9CNuE0VwD9exUrvp8/mjcrLlU6+LQWT/VsoJxdc+HN2M:c/I4GANDDkmp8TnczVjJxdlt2M
TLSH
T1E1F313183B6DDBF7D5342E101FB60E8CAA97575B73D9F9046A3C00DE66CA9C240316E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 171KB
SHA256 b7fbe7ea4fbf174c0d9339f6cf059c6c9cbdd26c76f01f92c5896a2e13b4f8a2
MD5 72999b8e01343ac6ba6ec9c47b356487
SHA1 96a7e7f873045b26027e7a048175257f3e140d7c
SHA512 d3160306d94c0add76f147eb604236b5bc4e0af02894a9fa4fdae3efdc411a8d60ab7c57c6591891bb86dce0e13a333862f92e42d93714a349279c7a409f27e2
SSDEEP 3072:GepXXnCmapXYxK6y32VlW872VXERS/TD59RoHr3lbuUDeM:GAXXCmWCGXjTrRoHUsd
TLSH
T15604128DD27BCACD8DF7BEF780962265A92865F4120C2E519CD67F2C142C937210B98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 227KB
SHA256 9fcb8795fed9df37a673381d6e8d10b7cda278e4b76115945f35f5dded89e8b4
MD5 474788da6eefe0b57c580bddd562f5a7
SHA1 f20abdd31f2bd8fc4e7c4596dda7001d20bcd5d4
SHA512 4caeb54e16fb37f9df90142791f2fdccc3da3cf2597f9e4b4e52ec705179684cbb40b56d182bb5a61405132837413f8e3b55933bd87f23c48008b4142b165015
SSDEEP 6144:UM8jCo9iJ0IOOVDRT4aUOKCVwKAcVqvYbc+7q0+uEpC:UZCuiySt4YVqgn7ZFR
TLSH
T18C3423DB9A0EAC4FCD4D005E4434BB34A4DE66B291B988D0522A06D85CC0BEBEDFF55D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 21KB
SHA256 c0973cf7fe203d43878a422dc0e448b1aec56c0e6fa58cff0bf95fa10aa804a5
MD5 649c76c706bbbfa4383ba9fb7798e78e
SHA1 b60d818d640ea2eb22d55c7e5d829a32aa8d88e6
SHA512 19efe475ca7a9c6528d93e03b3b3c847c7dbc680bee9b11a7b3c2364c05a7fec58ddd75a02729221afba4d9310eab7ecca7fc77cef227088e7d01cd4bc0d722f
SSDEEP 384:1PB+Zb0VIWMN59WPdPnHf5jfK0XhwLvtlqyhOHg3DqpDZ6vFCNBNcx38hampJNnj:+lBWMUlPnHBjvwLjjz4ZyCfNcx4Tpjj
TLSH
T13EA2D18411A61954DA0103BBC91CDEC73C6A79E3F7CDF1722A16B5FA013CEC52D25B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fc
Size 180KB
SHA256 3dfb10900e5b17f10d4e92de866ac4e14fae6e42c260fb27d68ce10c7ca2dbe7
MD5 80a8847e28bd3e2aee589060e97aa1d4
SHA1 343f158eba8e85ebe21da94e21bcaef447c331a2
SHA512 98015b000a624282a3b788ed793fd2770d5c3e36dae19017d382a12de620a9e2aabc27db0e6a97517d9e4fdd831b84b624c7b79fa1ce0a956b5ba18e3ccbb5fa
SSDEEP 3072:f9qcP4uuO3cxgw2ILFCXQJ+jYg9tYp9QC7gNljM/OFE8pmkRky1snnrArB:r3ValJg9+KC7gNlImFPJkE4ncrB
TLSH
T1DB0412341B95F7EA7119004D96F04F557EC2105AED0E12E330F1EFA6F424A3E93E65A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000100

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000100
Size 47KB
SHA256 f7ac6c8abd0c3d406b3d1a9c707d9ce501373f218fc1edfb226399a285364e01
MD5 0b93a13c014a187d86acb3fc07af575e
SHA1 672b155bf2d759fe7c86ec21a300149c9b004540
SHA512 5f6a08f1ad5399f52fc49fbc2907ad525ac5f1c0aa6e7351c1dce656b172d2de02edc1ab5fead8f6976ab5b29870eaae1ad45ce07aeeacbef46aed43eb60701b
SSDEEP 768:/vYy1Q4qmjQuR3p2ykvlOPkiV/WpZVgwoKLIgXN0i8g:/v5PQuR3p2ldSkbVSgXNd8g
TLSH
T18223F3925970BB12EA56482857D13BFA500C392F6AF4530C996ECE8B7097CDF359FC81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2cc14b4ac83a4cba75a24e7105537b7ce9b89b6b4939ce245cbd99b55d9487f3
MD5 28d2f5c4470f289057597c50ee43ecd3
SHA1 d31c46c7b32e1a92e502df1045033eb5f6112662
SHA512 c3e6f3003a6a33139029539b28dcdba5f273dc14f64502f890be595fa9d28b30703bfa323829e34ab4293b88cd43e615aa980f18f36cfcb0b17bac181c3b7127
SSDEEP 192:sxZ8ROyM/jK1Ml8MkX/fbs0BaIdpghHW6+WNlpRYm/YIkX6+KIgrJ:sxZ8sMX/fbs0BzgHbb5/HX9
TLSH
T1D95208016A34A977CCDBD309F945BB93D2F91473A2801D58AAFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b445c45b7d6c66b8bb048cbd646c230cb135e0c994ae36373ed34572f98934f2
MD5 b0879b6ba470a29efbdf72ed68662bfa
SHA1 28e70de04bf5e3eb14b773223cbd92789532d48b
SHA512 37039d10f8b6dc2331175f80880083056f236d148f8a85a03873eac1d7718e204e1f91241f6bba547505b872a58645433d6eb0f6332576527cca4a748af50db6
SSDEEP 192:sxZ8ROyM/jK1Ml8MkX/fbslBkdpgCHW6+WNlpRYmhh+/YIlX6+KIg5NJ:sxZ8sMX/fbslBELHbb5O/+Xl
TLSH
T144520A116A34AA77CCDBD309F945BB93D2F9147392901D58AAFCD91C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfe25e5592dcd056425982789c19837e9e74423d\index.txt
Size 157B
SHA256 fce2dda1a8070fa790740daac9363f3ca87e623b464766ebb59afb435576836c
MD5 a3637d0f880702dba7b7418186423e3f
SHA1 ed787d30f19e2e46a99494c202deb9cd03ef80fa
SHA512 30174326ec92a1f9672ae517d173c3a2bf008c2d2f71d54d81c7119191107f8c4a1576d0318ed07a16009e0dc7bcfb94850053ac07fb420baff666956e22ba68
TLSH
T19BC08C728249B780CBBCB8405071B28AB20B23EA0DE2665CA802C1388222974627732F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfe25e5592dcd056425982789c19837e9e74423d\index.txt~RFe58c762.TMP
Size 164B
SHA256 0dcb8b7e06532be81d101f5ed128c7651eae5792ecaba5ed07ba893ef773f0a0
MD5 6c65b3b8ac9ed3ff9f7ea54fbd210580
SHA1 82f039a28a49456636ecefc2d5b391ce2b416034
SHA512 2a33fec39c56289e9225e8c2106312c6b6c1944fc1549b5bdb30e0c51e5077466916aa7c19f8ddf3a19eb4e42e3159ce075d53fc7563793fce78dd8d96f01480
TLSH
T17AC0807281057740CB7C744050717285750B1FE50DD1655C9802F1388232474527731F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 152fbc971ce4ae4f0fb7ae7295e83e9670a6f066469b24978c955eb07cf9bd77
MD5 15e2afcf77dcd6328e12cbe5eb27a2f3
SHA1 5fc272f2f92d2aed213828043680ff765b54375e
SHA512 54b3d9645c7ca739df3cdd151b49b87aa457260aafaf48d6526838951992f0bafb5180f92d349b9a4d92fe544b783650f86423fcd8953c8eaa5a87ff025fb83a
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTylDIRK4A0TyRCIfKPKcfyZ2IfKf6cPz:KYbaKYIKeDaK4AKiCQKPKOK2gKf6gz
TLSH
T127C10306327A1652383D2958B26686770F4239A3301CF47F7FB964A50F66E124CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0be1ab3cc9e3497ccfb8e09e72b19a61bab3b6d96ae751c038fe82a771b887b2
MD5 22056f7c54980806e3dfdb598c0790cf
SHA1 4d7ccdd8a1f6af776cd647a52ad793d7997b7d1c
SHA512 4b0721ea0c925de05a2856ac323d9a318435386b06a91a2e801411959c1676096deca21edb871f8a744a4b4a82718d005e8b8c35f45e1859e8de3240d9b0907e
SSDEEP 192:tONx6JkRtQmiUyaqSW+RNA+Fd10JoLkRh3dRRU6:tONx6UrhW+RNzdTLM9U6
TLSH
T1D802E9356D782C7B9EF26D0AF48B37175FE4206BBA892B94D6E81F0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36b0362aca80d73afa218b5921bcd70cb9e4d0d27cad8b50970eeeb1f97ff5d7
MD5 9d82230290775959ee5da886450a33fc
SHA1 e0abaa7c8d32d321c31f9be2a4d820fa6e329bf6
SHA512 832f4a51afa71b0f9678c72c6d89eec25b493ab48cc948c8a9801c88b3221ba9914ed44e5e4dd349dd95d01371ff2fe351831b117fc48a8b3571bb303aeee10f
SSDEEP 192:kONZ6JkRmQmiUyahSd+RNA+Fd10JoLkGwPhVcyqSaU6:kONZ6UCKd+RNzdTLrbU6
TLSH
T1BA120A316C746C7B9ED26956F48735134EE9512BEEC93F94D1EC1E0C01DBA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 24770760669e6433f7279dfefecf3dedab657d45f58b9449536b04b123cd29b7
MD5 e987e83025aa1a155f6de4cec3b77c4c
SHA1 3bc4dc0adf591d9b433811eea44a8a00979e4e9c
SHA512 9ed18280e5b0e8112be5f6e986ae839d79386d32edff297863e34f94485b447ad9622f9382e9c7bbc25c6efe2805c1f00e99284ef425edb7df5d78e2d0595c6e
SSDEEP 384:/ZcIhsNjUbQPAIbNx/VRNzdTLEb/XEKqfPbQEiJflBzlqfhBuZ:XhQptHzRAb/XERPbQEixl+BuZ
TLSH
T138928E325C356C679EE6A142F48B75138FB8D067A7C97F80D9ECAB0D01DB9AC0306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f9aaf18006d42d5840e4c28a838c10b4206ec130a48729fadbb4f6ab038d6839
MD5 9cd4e90bf1c9abf7d2292248635a1e02
SHA1 b1152cf8519040205735dc78169e461f9a6a54c6
SHA512 e866b4f77c7fdaa91931b43f4207fcd65c8c47cce21035b54c7022a0d09a6449a1249e0474f4f433e36a877bbef6c278cbd71b690e3297cb0928e379054b4ea5
TLSH
T168412758AAED1108B7B72E56ABF6A46E047BB8772E06C49E10110E4E0A73A41C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads