hxxps://www[.]constantcontact[.]com/legal/customer-contact-data-notice

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/08/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.constantcontact.com/legal/customer-contact-data-notice
Sample260824-jdk1mathmf

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	15	https://www.constantcontact.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a300ab0dbe41e21a	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320304029542229"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{7E61ADDC-6D2D-47E3-8A31-CB56625D9CB1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 3996	980	msedge.exe	80
PID 980 wrote to memory of 2940	980	msedge.exe	83
PID 980 wrote to memory of 5868	980	msedge.exe	84
PID 980 wrote to memory of 5868	980	msedge.exe	84
PID 980 wrote to memory of 5868	980	msedge.exe	84
PID 980 wrote to memory of 3204	980	msedge.exe	85
PID 980 wrote to memory of 3204	980	msedge.exe	85
PID 980 wrote to memory of 6064	980	msedge.exe	86
PID 980 wrote to memory of 6064	980	msedge.exe	86
PID 980 wrote to memory of 6064	980	msedge.exe	86
PID 980 wrote to memory of 5276	980	msedge.exe	87
PID 980 wrote to memory of 5276	980	msedge.exe	87
PID 980 wrote to memory of 5276	980	msedge.exe	87
PID 980 wrote to memory of 5608	980	msedge.exe	88
PID 980 wrote to memory of 5608	980	msedge.exe	88
PID 980 wrote to memory of 5608	980	msedge.exe	88
PID 980 wrote to memory of 2164	980	msedge.exe	89
PID 980 wrote to memory of 2164	980	msedge.exe	89
PID 980 wrote to memory of 2164	980	msedge.exe	89
PID 980 wrote to memory of 5048	980	msedge.exe	90
PID 980 wrote to memory of 5048	980	msedge.exe	90
PID 980 wrote to memory of 5048	980	msedge.exe	90
PID 980 wrote to memory of 5284	980	msedge.exe	91
PID 980 wrote to memory of 1356	980	msedge.exe	92
PID 980 wrote to memory of 5284	980	msedge.exe	91
PID 980 wrote to memory of 1356	980	msedge.exe	92
PID 980 wrote to memory of 4028	980	msedge.exe	94
PID 980 wrote to memory of 4764	980	msedge.exe	95
PID 4764 wrote to memory of 5852	4764	msedge.exe	96
PID 980 wrote to memory of 2928	980	msedge.exe	99
PID 980 wrote to memory of 2928	980	msedge.exe	99
PID 980 wrote to memory of 2928	980	msedge.exe	99
PID 980 wrote to memory of 5208	980	msedge.exe	100
PID 980 wrote to memory of 5208	980	msedge.exe	100
PID 980 wrote to memory of 5208	980	msedge.exe	100
PID 980 wrote to memory of 4512	980	msedge.exe	101
PID 980 wrote to memory of 4512	980	msedge.exe	101
PID 980 wrote to memory of 4512	980	msedge.exe	101
PID 980 wrote to memory of 4116	980	msedge.exe	102
PID 980 wrote to memory of 4116	980	msedge.exe	102
PID 980 wrote to memory of 4116	980	msedge.exe	102
PID 980 wrote to memory of 3256	980	msedge.exe	103
PID 980 wrote to memory of 3256	980	msedge.exe	103
PID 980 wrote to memory of 3256	980	msedge.exe	103
PID 980 wrote to memory of 5116	980	msedge.exe	104
PID 980 wrote to memory of 2112	980	msedge.exe	105
PID 980 wrote to memory of 2320	980	msedge.exe	106
PID 980 wrote to memory of 5316	980	msedge.exe	107
PID 980 wrote to memory of 5316	980	msedge.exe	107
PID 980 wrote to memory of 5316	980	msedge.exe	107
PID 980 wrote to memory of 5860	980	msedge.exe	108
PID 980 wrote to memory of 5860	980	msedge.exe	108
PID 980 wrote to memory of 5860	980	msedge.exe	108
PID 980 wrote to memory of 5056	980	msedge.exe	109
PID 980 wrote to memory of 5056	980	msedge.exe	109
PID 980 wrote to memory of 5056	980	msedge.exe	109
PID 980 wrote to memory of 1288	980	msedge.exe	110
PID 980 wrote to memory of 1288	980	msedge.exe	110
PID 980 wrote to memory of 1760	980	msedge.exe	111
PID 980 wrote to memory of 1760	980	msedge.exe	111
PID 980 wrote to memory of 1760	980	msedge.exe	111
PID 980 wrote to memory of 3028	980	msedge.exe	112
PID 980 wrote to memory of 3028	980	msedge.exe	112
PID 980 wrote to memory of 3028	980	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.constantcontact.com/legal/customer-contact-data-notice
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ff9e2a4c188,0x7ff9e2a4c194,0x7ff9e2a4c1a0
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,2418379716024905030,18403937045301184465,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,705186066414495849,16461976520744180467,262144 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:2
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,1761412093060792310,266710754130826696,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:13
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3164,i,9127046048324476743,1518740278701379725,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3168,i,12129448267717229850,13789709815459653815,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,3153930274150609051,1935569684307824788,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4608,i,16880706764581584422,2651685016467272779,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4536,i,2566706991483523980,9104977555022482391,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17225332653027332693,16236097759531267995,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9092909397839087415,5915439202013996143,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,13978411481432824579,2714843368494560597,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,13978411481432824579,2714843368494560597,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,17356413712624445716,13161835008082060527,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6916,i,11002203521372161186,12772345047253126269,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6900,i,4883721262434551540,14334620788133085899,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6052,i,10362297032228917891,4085191784577579641,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7148,i,9081168226507981350,14450530691960924200,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6044,i,3626852063883310842,1203119943041883981,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,17197852134663381412,10976071170381170627,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,15815665075529868108,10192520651046839963,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,10115360306191572152,16904655202934655289,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4520,i,8576873647320785060,15695289647760505377,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2252,i,16560774398390914626,5880941243201889399,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5012,i,13959310531984500649,5562695986746064889,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,6297459869002714409,17339693262632831165,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:12
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7096,i,7482194560730549939,7580807231218895498,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7308,i,1870072502529400961,15844375398264554090,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7296,i,15984153812512043441,5118408007217845886,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7528,i,6739223019843482245,8169126416479077893,2097152 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,1414872903060579106,16350809294031512579,524288 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6656,i,14021665067160730629,17337385173901685394,262144 --field-trial-handle=3828,i,7010397210316252829,9671561414937129662,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

869215ca-7271-4b8d-8148-dd48536b85a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\869215ca-7271-4b8d-8148-dd48536b85a3.tmp
Size 27KB
SHA256 6b80fbd6deefe3f25b2d968283097d8d40c3ae358f479dd62afe4d763bf1c5ff
MD5 187159379ee7d6cb73b1847bc15226d6
SHA1 93ec100e4d583c4a19148b7f8f9c7b67364a21f2
SHA512 5cdad838a16ccf929b56c96b2ac821bd8fcb2cd9ec695891ff06b7366b1bf1ec8f5fd43fa298eacd77ab005e514919a6a519493dd815f6d2abffa8346e702f5e
SSDEEP 384:n5EiF63yFaeO8d8N88TUNTUlIRUyHFLjGfb7oodhLCiMTKy4iT9YA6WHy/7Ig1W:hF63IzhdvwgJOoRTh4iRYAN
TLSH
T163C23932E8A4CAB7ECE64AD5A70A7657EEF001A3998C9ED4D6DC5D1D00CB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5fd08a3e3f039d6966a85debc48f35bf103bd709c96390eb00327be0c20b0c6f
MD5 bc3dd903cf93c6804ec4b5c976f3e3df
SHA1 c92eed5b2b92316c267966cb5d760890da7ba1c1
SHA512 8875a9d68a22e18cf754ddbfa41fabc44defbcc1f9bfcb83ac2d42b119b04760b991e2f3c170cdcedd9b5ff53a99814e552d2284bbe71c2cc7eec2bb33091a7b
TLSH
T1D1E023EAC974EC3714F9071DD4690646D65113572540855F363D561C4FF072A01CA41C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 33KB
SHA256 af20e8651b76633c895eda923e5f655e564ec523918d2d194bc0d9705a70b571
MD5 a29e1d648512da886127212cf6ce1169
SHA1 67ab9bd622bf8f3205373f545cef86e49a164e5a
SHA512 0a59b28f697d4e8eb81931307554e4ea1f7c9781bdcc694b00b678e2028dd71c9db1bbba9184d6ba100a3069e1766d30b0d9bc7fec0d2d72bbcbcdaa258a6895
SSDEEP 768:TAJoFdOiyCONQTDPWVZr952LS08Sf9U7FHf05w8yvz4Kq:TLbOi3O+Pg9Pcy7aGBW
TLSH
T199F2F19A161C6F85CE7A94DE43EF388204BA388A706BE0715CD65BED3E3542C8541AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 6ddaaa34f7d6da84002fc7989bf399f872ed8a68385415adf6a8db79e46a6c51
MD5 2cf5e1a781f470335768a8d05c05e053
SHA1 f206a5c4e27b802eee66e9066b35aab96ec5c41f
SHA512 c138fef082a2056c061f954ea6566f19efce508ae981e57e0cb2580ddc5e2910e6f419d173a4b9ad6377e499204ab15662db90eb89ce99be65b8ef788062f39f
SSDEEP 192:9Cng8FVGQwgh7rVkXdL4+76QZY14xXYInE:GGMh7rVkty/4xov
TLSH
T10D02E9683AD98803EFB265B150F01D02BDBAE14AB5636F4353807674FABB7D4C807782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591e3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591e3c.TMP
Size 3KB
SHA256 a7a44edcdba1e4fe3622916ec86ce14a4827c78014ac54e895a29086e4c03d7c
MD5 56fda41a99b12fdacc73490de3a9ccf0
SHA1 54bd2f0cafd69c899a31d75e0cee1f575d8eaa78
SHA512 6d7067bd6a4e92b134243789b149a8ca929995e33fbaccfa90c15c4a959ecc7ccd7e878e5aa7f7f23b9808796ae94cdea55e97e7fdc7d8b358114cd1237103ee
TLSH
T1D471903C3EA2C563E313023195D20A01BDBBC2AA39735E151380597AF9FABF1D817AC4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6917c9e75726bcb737a100e3d4e74136f8df123eba0d9a4dd4b5ae7d31480b60
MD5 31bd1f2bf33dbdbfc396ea43dca7e8aa
SHA1 a3a40c6b50ab0653fe9d33516fd6ba92a8c34b9c
SHA512 819f16c463a442e6533ebc638c18270fbdfe1b76c1fcd3910792ff12bfdfdd051ae1de466a8c63933372c50833f3556bc4b79dd85a8448b5c2a804d5c9700de7
TLSH
T16F31AEF783F4856ECA0196F0BA18AE2FCE2D0515432C3D9A85E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 b782031d6719cb83775e4ec26d5143ae86dd8cb88938e07ffc5b207349ef3eaa
MD5 0eb6fae254e682750e1696c1be17e5d5
SHA1 502a8516c02069c4d62b3242fdb3bb8a5ca1af97
SHA512 54ce79ef5d272525bb47f80302bd5588b239989b09c27d37f215670fab697ad7d7f420b5880b3b748b371710c01f70a29b14f4568149b53103dac9480d3afb70
SSDEEP 384:D1LrZLbq3G4qYKA0eieQQL1e7bYegVBPceLEvYncgDal3QnQL5BeJaaiGWihA093:dZQynpBEmiRVe9+
TLSH
T167B279EBC3E6826D8B1159F56A242F2F9E1E4818436C3949C5D8BE1FE3F2070D25479E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d8b3bb8384d4dc43ce7e13ac2375df7d786788ae5d1cb4c4b0c4cc587158f577
MD5 2a973156764332acb87582384f31b3fd
SHA1 70b878f6cfba684971dbb2cf07834b2be74f9e92
SHA512 f1427ec9b4e551dc4616103695794c39beeffd4ef6ebd30b792f823a373e95fbd950f3b277d76fde757fcbb7faec6b3c16b7773bde67fda0b73a55de07996354
SSDEEP 192:sxZk4RC9JyMqZjK1Ml8UQ5Fe/fGstXE0CXUNodpqjS/W6+WNO/sXY0dSs/XeIg5i:sxZDDq/e/fGst00Ly1/bJX5FGcj
TLSH
T1A072F9156A349977CCDBD20DF6447FA3D3F91522A2504E44A9FC8A1C04E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 24cc5487f63f24e57a9d1aa615a6f5f1ffa1be83b9f76015103219413ef70777
MD5 68ef45aac37dcaaec198ddfb17965648
SHA1 006d8c19403e623c14e768656934435d60bfac93
SHA512 e841b4cc593a3f9159cd347f440dd950320ed1b69dfc886f51ccb81f485ddeea09bed24e066b7b33b61a36e747ff6d269cfbb74993932391e901645ae8649562
SSDEEP 192:sxZk4RC9JyMqZjK1Ml8MFe/fGs8vrxE0CXUgzodpqjX/W6+WNOkr/Y0dVWtXeIgv:sxZDDde/fGs8vr60LDI/bp/5WGjj
TLSH
T16962E7166A345977CCDBD309FA457FA3D3F9153292904E44A9FC8A1C04E7AED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 97a0e37c0bca2d041bd04fe55bd0f12425fa1d199ae1dcdd6b1ef7488af5bbf5
MD5 ff77a2cc235c783a9ebeb81bdcfaa2e8
SHA1 3e6d965a5578b5c84a644cc85388b430597afa27
SHA512 367c11861439489c12405a93912b8988f51a5af30fc403782397f97d1a99e6f3e5f54286cf5ba18f72eea6af65005cd78fbe630314cb38f73f06d53054367571
SSDEEP 768:ciWKy8Eq2+dWRm5rQg78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1c:ciWKy8Eq2+dWRm5rQg7u1jaKTQLpCFsq
TLSH
T1DCE20A3B280CCB7E4F845E5CEC266F966EE8018B66A84D5447FA894C03C73EB551A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 08959a44081f8b3c40361d7fce6ec6c1f36165d506fcea72ab559fd1b59bb89c
MD5 3e8f46347146e2dd942b2b5400c4bbeb
SHA1 d9ff1543ed1875c6ae491cd46cee61575cdc58af
SHA512 554361cc139a90b424b87d7ee4c4a0db935ec83979ac348f9feb0badcab34f6feeaab0d6d5edc4e917afa4795f3f8b17764b1d69d8d2997b575595e66e0d060a
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72zS:AFBHhTofhno2mB21q3Llbfe3sLDdeEpd
TLSH
T1EFB27056717B12123C3E290CA7A19B370E8272A33458A96F7BB804B64E67E115DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c8bef5c7c8ec9ec676587e8df1d97245c401f5e59a6fdda9067a6a35d4d49d14
MD5 b7c6ad472a5e02b7570a7858dcb8ed3b
SHA1 62eace282fada61889ed144bbe5da7aa17c7f1b9
SHA512 2d177b428b42397cd06394d013b62094950b0b4518db744fc4c09d0a1d706537fb4ae67d4a733065b7b9e409f349b197d33ff949fb73d392756ab3af064769a0
SSDEEP 384:n5biF9CcmyWCs38NY8TUNTUlIxBydscojGfb7oodhLCi0Ky4hkP+lFYS/VNHy/7c:wFccps3/wgabo7h4hkoFYS/P
TLSH
T14FC24B32E8A4CEABFCD64FD5E74A7943DEE04163868C9AD4DAC81D5D00DB19D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 478eeaf7acdc25fbe607934daedf9268323f0dcac4b28786a1fc6f4078fbe3a0
MD5 524cabecdc15edfc6e2449eeb11e7d84
SHA1 9296df2cc8dc2f29c49ba1a44842daade57abb02
SHA512 5281a8eb409bdd3ea85f71c72fdab0d79ebfa69da139bf3c2daa5c517b6f51293cb360ec7f0bb1938c447eff1abcc443942d3fb4868bb58ba256abd4503f5d10
SSDEEP 384:n5EiF63yFaeO8d8N88TUNTUlIRxy3FLjGfb7oodhLCi0Ky4iT9YA6WHy/7Ig1W:hF63IzhdvwgwOoJh4iRYAN
TLSH
T15CC23932E8A4CAB7EDE64AD5A30A7657EEF001A3998C9AD4D6DD5D1C00CB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8da414d6d8a6dbe2c35b4fe1430df92ce9c8f7c8bdf8f676f6959b4a78a4a72c
MD5 89ddc941167628bf0875135b37f1f1b9
SHA1 97aa5c46080cf1d4a38c824acdeaa92010ce0f71
SHA512 1ef275a3f18cfef271cd39ad8ca7c605357fe7d5a0c031f7345055f87c6fd5dc0b5035810dc7340a6dac7edae7148b0420f470a3011bbb93692aa29b28718004
SSDEEP 384:n5EiFZ3yFaeO8138N88TUNTUlIR9ylFLjGfb7oodhLCi0Ky4iT9YA6WHy/7Ig1W:hFZ3Izh13vwgmOoJh4iRYAN
TLSH
T1C6C24A32E8A4CAB7EDE64ED5A70A7A03EEF001A3858C9AD4D6DD5D1C00CB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 613cb3d649fc7f1f9e2d983b8c2386884fedc5fdecf72fd4b37b3c4b370aa824
MD5 f982229dcd68a34cc7266ad46b01d839
SHA1 2e2b5f240e20ba417759e9d1a9ff488edf1b51c9
SHA512 55cbfbfb11c2512a025efc699e09c4e2e03ba16b5345e1b38e34dea20be991e812c532ef09d2010e4a3a64325408bca75edc4b9c3fe900e5061147e4a75a09a2
SSDEEP 384:n6iF63yFaeO8d8N88TUNTUlIRUyHFLjGfb7oodhLCiMTKy4iT9YA6WHy/7Ig1W:xF63IzhdvwgJOoRTh4iRYAN
TLSH
T1B3C23932E8A4CAB7ECE64AD5A30A7657EEF001A3998C9ED4D6DC5D1D00CB1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ac7cf8d2c16253085fc4132d2c020ee49a14f4fd30fd5963ddb780f4454a7f0a
MD5 192fc9ce202e32d98152007112544f3e
SHA1 29a3d2df7e68a59127debb7e700ab49032fca85d
SHA512 ad54090645d20b591f67473cf720167ce3ceb0d6f70a17daeb0f48acbf34bd192d1e9967663b7f90bf0cb1d6a9b015ab47009b6882969d3a0156b0618af518e6
SSDEEP 384:neiF63yFaeO8pS8N88TUNTUlIRUyLuMLjGfb7oodhLCiQzKy4iT9YA6WHy/7Ig1W:1F63IzhMvwg/bOoLzh4iRYAN
TLSH
T1A8E2C5F298E789B7E89E4B93933D3D029ABCC153B5485A94B7D84D1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a28967bca013d5cfbb506f99e0bbfbc780132b5b10b80bd7fa0562130282887d
MD5 838fd0740a402445258d33146733b11f
SHA1 c610aed3c608301bfea817743a3197f98546d9eb
SHA512 b5668e7aef00606e26f25be66f01e7ba5132dfe5f093d76189ca1894a4161d30a5edeb304c4352fdd1f0917bca9daaf3241212be52dc0d70800d1ff81d7770bb
SSDEEP 384:n5HiF9CcmyWCs38N28TUNTUlIxBydvOolajGfb7oodhL4mhkP+lFYS/VNHy/7IgS:cFccps3Vwgjaxo/mhkoFYS/P
TLSH
T1FEB24B32ECA8DAB7FCE64F99E74E7A07DEE01163859859D4DAC80D5D00DB19D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4028-303-0x0000022D138E0000-0x0000022D148E0000-memory.dmp

Download