hxxps://email[.]d-id[.]com/e3t/Ctc/W+113/d2-Rkw04/VVG7pc97jG_xW7Zv4Nr1-Q7t6W3trWRD5S3vqnN5XFYnz3qgz0W95jsWP6lZ3p0N66mW2QJBZdgW32qY9w5777fFVxcH8z8xdjC7W7FrV4S7L-rxPW4Z0fjX7QFcc9W4hB7fs4H1ynLW55FKJX4k91--W6VR7G42DkKYnW8gWVfG3-g1QCW4SVKS05M5mk0W8HKVpC1qq8-fW1kCFH-9dw4gRW6Rctqz2VMQNXW5rFbx-4vJT4PVRTTsC5KNV_TW1KD-Rr33SxXmW75LMg348q7KbW6-C_B6315pvNN8_nSgWz4MsgW1nHMf281xPxKW24-vX68T6CfKW85rpmk1JQb6hW27wN5L2ZVYGDW5V4Yjg5P_GBrW8QqlKr6gkkB8W3j48hl7BKxk8W4RNcxw426hWjW7dw63W4ktnnSW7mJY8k1Rm03mW5vH-l13rBvBJf5yBFQg04

Analysis

user interaction
yes
max time kernel
46s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://email.d-id.com/e3t/Ctc/W+113/d2-Rkw04/VVG7pc97jG_xW7Zv4Nr1-Q7t6W3trWRD5S3vqnN5XFYnz3qgz0W95jsWP6lZ3p0N66mW2QJBZdgW32qY9w5777fFVxcH8z8xdjC7W7FrV4S7L-rxPW4Z0fjX7QFcc9W4hB7fs4H1ynLW55FKJX4k91--W6VR7G42DkKYnW8gWVfG3-g1QCW4SVKS05M5mk0W8HKVpC1qq8-fW1kCFH-9dw4gRW6Rctqz2VMQNXW5rFbx-4vJT4PVRTTsC5KNV_TW1KD-Rr33SxXmW75LMg348q7KbW6-C_B6315pvNN8_nSgWz4MsgW1nHMf281xPxKW24-vX68T6CfKW85rpmk1JQb6hW27wN5L2ZVYGDW5V4Yjg5P_GBrW8QqlKr6gkkB8W3j48hl7BKxk8W4RNcxw426hWjW7dw63W4ktnnSW7mJY8k1Rm03mW5vH-l13rBvBJf5yBFQg04
Sample260818-gl6wyseq6x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1440	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315060847377961"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{6FA84A7B-26AE-4467-AE82-26245C1D9483}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2B1F7C81-E353-48A5-BE0C-28C89140660D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4088	3972	msedge.exe	86
PID 3972 wrote to memory of 1440	3972	msedge.exe	87
PID 3972 wrote to memory of 4600	3972	msedge.exe	88
PID 3972 wrote to memory of 4600	3972	msedge.exe	88
PID 3972 wrote to memory of 4600	3972	msedge.exe	88
PID 3972 wrote to memory of 3812	3972	msedge.exe	90
PID 3972 wrote to memory of 3812	3972	msedge.exe	90
PID 3972 wrote to memory of 4900	3972	msedge.exe	91
PID 3972 wrote to memory of 4900	3972	msedge.exe	91
PID 3972 wrote to memory of 4900	3972	msedge.exe	91
PID 3972 wrote to memory of 4524	3972	msedge.exe	92
PID 3972 wrote to memory of 4524	3972	msedge.exe	92
PID 3972 wrote to memory of 4524	3972	msedge.exe	92
PID 3972 wrote to memory of 3688	3972	msedge.exe	93
PID 3972 wrote to memory of 1260	3972	msedge.exe	94
PID 3972 wrote to memory of 3688	3972	msedge.exe	93
PID 3972 wrote to memory of 3688	3972	msedge.exe	93
PID 3972 wrote to memory of 1260	3972	msedge.exe	94
PID 3972 wrote to memory of 1260	3972	msedge.exe	94
PID 3972 wrote to memory of 5104	3972	msedge.exe	98
PID 3972 wrote to memory of 2928	3972	msedge.exe	99
PID 3972 wrote to memory of 5104	3972	msedge.exe	98
PID 3972 wrote to memory of 2928	3972	msedge.exe	99
PID 3972 wrote to memory of 4780	3972	msedge.exe	101
PID 3972 wrote to memory of 1156	3972	msedge.exe	102
PID 3972 wrote to memory of 1156	3972	msedge.exe	102
PID 3972 wrote to memory of 1156	3972	msedge.exe	102
PID 3972 wrote to memory of 2520	3972	msedge.exe	103
PID 3972 wrote to memory of 3144	3972	msedge.exe	104
PID 3972 wrote to memory of 3144	3972	msedge.exe	104
PID 3972 wrote to memory of 4104	3972	msedge.exe	105
PID 3972 wrote to memory of 4104	3972	msedge.exe	105
PID 3972 wrote to memory of 4104	3972	msedge.exe	105
PID 3972 wrote to memory of 1660	3972	msedge.exe	106
PID 3972 wrote to memory of 1660	3972	msedge.exe	106
PID 3972 wrote to memory of 1660	3972	msedge.exe	106
PID 3972 wrote to memory of 5064	3972	msedge.exe	112
PID 3972 wrote to memory of 5064	3972	msedge.exe	112
PID 3972 wrote to memory of 5064	3972	msedge.exe	112
PID 3972 wrote to memory of 60	3972	msedge.exe	116
PID 3972 wrote to memory of 2516	3972	msedge.exe	117
PID 3972 wrote to memory of 3560	3972	msedge.exe	118
PID 3972 wrote to memory of 1460	3972	msedge.exe	120
PID 3972 wrote to memory of 1460	3972	msedge.exe	120
PID 3972 wrote to memory of 1460	3972	msedge.exe	120
PID 3972 wrote to memory of 2312	3972	msedge.exe	121
PID 3972 wrote to memory of 2312	3972	msedge.exe	121
PID 3972 wrote to memory of 2312	3972	msedge.exe	121
PID 3972 wrote to memory of 3244	3972	msedge.exe	122
PID 3972 wrote to memory of 3244	3972	msedge.exe	122
PID 3972 wrote to memory of 3244	3972	msedge.exe	122
PID 3972 wrote to memory of 3384	3972	msedge.exe	123
PID 3972 wrote to memory of 3384	3972	msedge.exe	123
PID 3972 wrote to memory of 3384	3972	msedge.exe	123
PID 3972 wrote to memory of 4424	3972	msedge.exe	124
PID 3972 wrote to memory of 4424	3972	msedge.exe	124
PID 3972 wrote to memory of 4424	3972	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://email.d-id.com/e3t/Ctc/W+113/d2-Rkw04/VVG7pc97jG_xW7Zv4Nr1-Q7t6W3trWRD5S3vqnN5XFYnz3qgz0W95jsWP6lZ3p0N66mW2QJBZdgW32qY9w5777fFVxcH8z8xdjC7W7FrV4S7L-rxPW4Z0fjX7QFcc9W4hB7fs4H1ynLW55FKJX4k91--W6VR7G42DkKYnW8gWVfG3-g1QCW4SVKS05M5mk0W8HKVpC1qq8-fW1kCFH-9dw4gRW6Rctqz2VMQNXW5rFbx-4vJT4PVRTTsC5KNV_TW1KD-Rr33SxXmW75LMg348q7KbW6-C_B6315pvNN8_nSgWz4MsgW1nHMf281xPxKW24-vX68T6CfKW85rpmk1JQb6hW27wN5L2ZVYGDW5V4Yjg5P_GBrW8QqlKr6gkkB8W3j48hl7BKxk8W4RNcxw426hWjW7dw63W4ktnnSW7mJY8k1Rm03mW5vH-l13rBvBJf5yBFQg04
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9e8d6c188,0x7ff9e8d6c194,0x7ff9e8d6c1a0
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,717184140664503266,12401227045414647262,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6206480510775523077,5372196920324085066,262144 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,4946901535193048248,13513001350144103712,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,10689801170653601213,18305914272366853541,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11592317346592796985,13146047405663388734,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,14334476595407609342,3917404674288271341,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17900469691470283149,10162149425246225314,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3139169740457833338,5087270014222076975,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7721983677676706447,14249061539823102834,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,13708159255705184180,16152065856759392535,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,13708159255705184180,16152065856759392535,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6212,i,11873834340154216231,3616413355966684208,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,11885791751021247031,11094335677814124868,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3362850194385449126,9888638697128044589,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6508,i,14152548410552279708,5783770799432130355,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6344,i,1633254528765628625,9673469994198639478,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5792,i,8595620149487070732,17728847620102300042,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,14678053877108743556,18016634549238888324,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,7373154736822827645,9946725566592538017,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,1189927184990752713,13321910839214466785,524288 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6224,i,4145087128926595737,2371314075299722547,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6960,i,9922884182159259017,9184773834654250139,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7072,i,9459520670930937822,17180898542031485945,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6664,i,14153807484775471338,13243778947725849786,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3688,i,11003112098513938328,11848343993557148637,2097152 --field-trial-handle=2272,i,8183904436727912472,577172242995425352,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd653207e95e36b35932172cff7b23909d0b98f28889106a0943a7f92f090cf0
MD5 f699719b21efdf089c18246c96ec1151
SHA1 270cfaedbed8a2b997075406147ea63e6ebdd995
SHA512 9322a3108e92eee2ab68b53e8f8c7d0ece0b38ef816f84e42f864e29ba97463621ce5063b38f469be5059be0fa12ba9e5511ccf31c35a3172e304a14817258b1
TLSH
T168D023B075A5F541DB0C017065156F413727446034EFD747D0E66C1F5BB519483EF6D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 41d642cc12d21f4367183c62c6f8aaa01843210df2149bdc6ddbf874006eda72
MD5 b3ad5d76cb3f48b639190e41d27c4812
SHA1 70747f9d6fed6d52d33c0026660ddb2c37b12f7d
SHA512 6e38416bbb2a8f172915d54f8f02dff686c5e09085ecc2b4a650224c31cf245c09b946361c8f2edfd435372b249c25e7bfc17a1784012500ad0fb13f8de1c11f
SSDEEP 192:sxZ/RvyM/jK1Ml8Mk6/f1sgZdp/IdpbkYzHW6+WN6JaZ/YL/uy3SIgrJ:sxZ/BM6/f1sgZrwbHbV/QC9
TLSH
T16F52E711AA385A7BCCDBD209F911BB53D7F5447292941E44AEFCC91C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a62e49963c3a30bda65046e5a835431c307eb06e5a5cc1bc00ca9d2b32b76a89
MD5 6b9bf111988a79626d43aebe5314d0ae
SHA1 62fb5e25513e2153284508a498abaa0cf1ebe788
SHA512 541c7d60758eae180f9e7e7011f117a4223ce06387894a492c569f53ca84fe19276c1c78c89703dd4fb7ad885892d85b4555859e32d2f67576509ad505530eac
SSDEEP 192:sxZ/RvyM/jK1Ml8MsF6/f1soZQp8IIdpbOJkZ1eyHW6+WNj05kxildmaZ37o/YLV:sxZ/B0F6/f1soZk85fHbr4dxE/wCCn
TLSH
T1BD62E752AA345A77CCEAD209F911BB17E3F5546296901E84AEFCC91C04E6BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 240d9b2776c47797e687987b4ab2215465993cb32e020b216251fbd9ef7751c4
MD5 732b93a7649223d3037ff651aa30fc01
SHA1 1a3a538ac98529b6600bc9e7a961036ed1a63777
SHA512 8040fe9c241b47c74479dd611cb6322b0194753d96b954cd77a648fc97807929b52bf3c4efb60302c7460d48c18579046412c1e23cacf591d8ce741419e48b62
SSDEEP 192:sxZ/RvyM/jK1Ml8Mz6/f1soZdp0IdpbOJkZ1zHW6+WN6JaZ/YL/0y3SIg5NJ:sxZ/Br6/f1soZrtpHbV/MCB
TLSH
T15A52F712AA345A7BCCDBD209F911BB53E7F4547292901E44AEFCC91C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7f01acbc43fac7d4c75f0786b73cbfe14ee3dcab21d5e7256d599b922e601f37
MD5 2d329d4b3c5e4925be0f5784cbf00cd9
SHA1 819457617c291fa56470063c68771b5e6b6f58af
SHA512 471d28da886c6517ba0f2dfe11ab2d408d219d2bada1e45d47b3ad1cedc2e5ba9a479c6bde0f72c058edce1b32749c6bea0e3a2fec718cdcb1bb96bdab7a86c1
SSDEEP 768:3vs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNAroO4:3vs6pD1WvxzWju1jahILIsNLO4
TLSH
T1EED2FA3B680CCB7E4F844E5CEC2AAE967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6641990be1daf769226e86f20741628d8cd181390740c8b8c7017e61c1762481
MD5 f2cae519ce3bd31a42a1386f8e97c5b6
SHA1 020a6f152ad1b6133b43276de4f426daeedeacec
SHA512 c4d49e09d278c9a930d857bfef4771ae059b328752cfe8e6b28b6b91b0f777d6c53dff710e5c17b67837099999045dd2e57f8416b6c70b377d87ef2f41b55e6d
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6b:iiRlHWr3o
TLSH
T154E1140231BF0A123D7E6B189255877B8B92B563301DA42B7BE941714D6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7ba8aef1b1d4a6acabae0c4c5cac14933765fc34ed2b5d50219fbf78e35b2745
MD5 92d8d932546c2f5fc4d5db1dc20bbe75
SHA1 865d35bb0959c78abd50aa73f2dbbc3b527b7497
SHA512 a55bea9da2063bef1c6ddc316eec95e8b959285394101a4417b732d1881a5c218d35d985f9fe3684994931be93b875dc0e8d1d8b2985493f12f1d6a3aea89a41
SSDEEP 384:eZcIhsNCwGpUgwa9xOsHev2BySllYJTfY81F5DOFBuL:chBX5rOqevWZuTHn6BuL
TLSH
T159927E721C345CB7A9B7F545B94B35074FB8807BD6896F80D4ED6F1E00DB5A8130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e64989e04300187aed939fa179c0bf9b0773abd1c5c7a12dd18b4b300f56702a
MD5 0690d66959260dd105809c80df259c38
SHA1 918c2298b6862ea654c3b511668505c6c09b566b
SHA512 85546446ce97e01d4dcd27427561528d5d032f323983d33245a83d5b62ef74aa1e3f58c80338b2d549b192057a5947d9246e10f3ca9004e7f496137c38acda89
SSDEEP 384:eZcIgsNCHGp+Nua9xOsHev2BySllYJTfY81F5DOFBuL:cgAUvrOqevWZuTHn6BuL
TLSH
T1FD927E722C385CB7A9E7F545B94B35078FB8807BD6C96F8094ED5F1E01DB9AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5821a44e3d9d87710f7681e3b8d721fcea77bbaf1b2c46647a6c20e063567e2b
MD5 71736557dc2c85ace84573a02d18d54b
SHA1 5c90014f950705f86a31f37d168c7a788bf9d31b
SHA512 82bded72eaeeac73517a4371cc17e10f51de954e7a394835f124d7e39487f177fdbb9ecff35c02159d1c0db57b6615d305862430f2971cbe7f5ec3b2d1802b6a
SSDEEP 192:qONQ6O7+3hQmiUy30+Gttb0sO2b/WgGMprU6:qONQ61oGt9xOsIoU6
TLSH
T1A402E8357D386CA78EF2AD45F68B27279FA5117BE9952F40DAE81E0C00DB65C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4fa05e0c9fc9456239069245d3af9990e51c3352312ef8d734b4bc36e86f53a6
MD5 06d472cbd30895c57b04c26aaf70520c
SHA1 28d76e4ee197982ea606ed886c323b6278829399
SHA512 3dd7f0ee86cb123031cc8211a657c7e0b0fabba0ce0638668bfa28cb56f21adc734cbe49ded3332e34946e2c82d0f33b38812c6e985a48d3376be6886263e691
SSDEEP 192:VON76O7+30QmiUyc0+wttb0sO2b/H5EPcNMSq5KuU6:VON76uhwt9xOsHeM2BU6
TLSH
T139122A367838AC775EE2E585F58736178F65412BEA8A2F80D5DC2E1C00DF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fbe537c0fbdd49cdf8f32c54abe75ed4a7b450fcd1c8303f747f32c3a68c0dd9
MD5 cabd117362adae78c69596a30457e6d9
SHA1 21374098fa5fe853bc7e6bd8e996763957e7d79e
SHA512 129a123b89c7cc89591b1c83171fb6c3f9ddc41d8342d5c89a8751afa4fc8d6efa9b0a8c18a7cab94e1be258288adbe7ba76e602a055fa35c51dabf2bd2209f5
SSDEEP 384:KZcI8sNCHGp2tua9xOsHeD2BySllYJTfY81F5DOFBuL:o8AcvrOqeDWZuTHn6BuL
TLSH
T187927E722C385CB7A9F7F545B94B35078FB8807BD6896F8094ED5F1E00DB9A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 536f13ab646a27d127fa470284619ba024447d59b07c6beb051801bdd7d928ca
MD5 6d2b76868bc015fe2b51b77b2ad586a6
SHA1 e1972be2b80b84e49023a89eb690f475b803b416
SHA512 52054128ff2c7230ac08f7ec4a2a50335fc22fcbd736d25c7b0047ea472416661a0859a73d0d845dda87348c74f01e607bb72e4ab6a4efcc2a0cb4b5cb7deb02
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58f5a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f5a6.TMP
Size 392B
SHA256 e5c25541f70ca61b04ec8912a8bc2540c7564f10df70584a2a1f078caf4cf960
MD5 fe234269e9778df511b4595dc994c19a
SHA1 7dda52ed046ffe5f5cea733a80eb7cc07f754e8b
SHA512 3135bc2fd6bf84c54d362eb3a658882b6e7df82bbf8c68446e046621399cb5db62ea181db7409ea032b054c0e0706aba90b0bbaa792b2b6ea3686383a45aadcd
MD5 SHA1 SHA512

Submit Download

97b3e96a-ab7c-4588-a60b-3c86d0e03600.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97b3e96a-ab7c-4588-a60b-3c86d0e03600.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eb484cf71132de287e60328c0c17a9df4e322836ae5d6f6fcb746e922752a698
MD5 8f54c252e5c1bb655c0d357b7ab9912d
SHA1 0d31e24ea7bef04fba80fa841d310f0d073d93a6
SHA512 afeeeb55152818de58546e6e43ade1e52ebd89fdbb828ee0c8355a867d5c6681c59fe09a939b7c3ec97488e1030200443d66d2282611da498814f8e395118f76
TLSH
T1F241FC48A6EA1148B3B76E5AABF7B46E547FB8772F06D45D10110E4E0B62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads