hxxps://www[.]dropbox[.]com/scl/fi/8x4c9jq1i5cnya9n6fbzz/You-have-obtained-a-new-file[.]paper?rlkey=7hjlo5ao7227dxo9q07sa5otx&st=lhy10njg&dl=0?6A17AC3E587lwHvkMNQMKA17AC3E587

Analysis

user interaction
yes
max time kernel
96s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fi/8x4c9jq1i5cnya9n6fbzz/You-have-obtained-a-new-file.paper?rlkey=7hjlo5ao7227dxo9q07sa5otx&st=lhy10njg&dl=0?6A17AC3E587lwHvkMNQMKA17AC3E587
Sample260909-p4v66seq41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2180	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334320192510105"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4395649C-B603-4468-AE24-8CF3DC6C67E8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2796	4924	msedge.exe	87
PID 4924 wrote to memory of 2180	4924	msedge.exe	88
PID 4924 wrote to memory of 1572	4924	msedge.exe	89
PID 4924 wrote to memory of 1572	4924	msedge.exe	89
PID 4924 wrote to memory of 1572	4924	msedge.exe	89
PID 4924 wrote to memory of 2536	4924	msedge.exe	90
PID 4924 wrote to memory of 2536	4924	msedge.exe	90
PID 4924 wrote to memory of 4492	4924	msedge.exe	91
PID 4924 wrote to memory of 4492	4924	msedge.exe	91
PID 4924 wrote to memory of 704	4924	msedge.exe	92
PID 4924 wrote to memory of 4492	4924	msedge.exe	91
PID 4924 wrote to memory of 704	4924	msedge.exe	92
PID 4924 wrote to memory of 704	4924	msedge.exe	92
PID 4924 wrote to memory of 4172	4924	msedge.exe	94
PID 4924 wrote to memory of 4172	4924	msedge.exe	94
PID 4924 wrote to memory of 4172	4924	msedge.exe	94
PID 4924 wrote to memory of 1340	4924	msedge.exe	95
PID 4924 wrote to memory of 1340	4924	msedge.exe	95
PID 4924 wrote to memory of 1340	4924	msedge.exe	95
PID 4924 wrote to memory of 3432	4924	msedge.exe	98
PID 4924 wrote to memory of 3432	4924	msedge.exe	98
PID 4924 wrote to memory of 3432	4924	msedge.exe	98
PID 4924 wrote to memory of 412	4924	msedge.exe	101
PID 4924 wrote to memory of 2668	4924	msedge.exe	102
PID 4924 wrote to memory of 412	4924	msedge.exe	101
PID 4924 wrote to memory of 2668	4924	msedge.exe	102
PID 4924 wrote to memory of 3536	4924	msedge.exe	104
PID 4924 wrote to memory of 1200	4924	msedge.exe	110
PID 4924 wrote to memory of 1200	4924	msedge.exe	110
PID 4924 wrote to memory of 1200	4924	msedge.exe	110
PID 4924 wrote to memory of 3260	4924	msedge.exe	111
PID 4924 wrote to memory of 3260	4924	msedge.exe	111
PID 4924 wrote to memory of 3260	4924	msedge.exe	111
PID 4924 wrote to memory of 116	4924	msedge.exe	116
PID 4924 wrote to memory of 116	4924	msedge.exe	116
PID 4924 wrote to memory of 116	4924	msedge.exe	116
PID 4924 wrote to memory of 1500	4924	msedge.exe	119
PID 4924 wrote to memory of 4316	4924	msedge.exe	120
PID 4924 wrote to memory of 2972	4924	msedge.exe	121
PID 4924 wrote to memory of 3004	4924	msedge.exe	124
PID 4924 wrote to memory of 3004	4924	msedge.exe	124
PID 4924 wrote to memory of 5064	4924	msedge.exe	125
PID 4924 wrote to memory of 5064	4924	msedge.exe	125
PID 4924 wrote to memory of 5064	4924	msedge.exe	125
PID 4924 wrote to memory of 812	4924	msedge.exe	126
PID 4924 wrote to memory of 812	4924	msedge.exe	126
PID 4924 wrote to memory of 812	4924	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/8x4c9jq1i5cnya9n6fbzz/You-have-obtained-a-new-file.paper?rlkey=7hjlo5ao7227dxo9q07sa5otx&st=lhy10njg&dl=0?6A17AC3E587lwHvkMNQMKA17AC3E587
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ffdbabec188,0x7ffdbabec194,0x7ffdbabec1a0
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,11823854716058126598,5938976190856285991,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8151122256849913483,17372008924309496784,262144 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,1880362800706640727,7738011551232820605,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,4921908386425711352,1901530665072684397,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11990067297259123789,3489308081216951797,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,7717732193451020763,7483806171899639161,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,14693937428869616995,13533273971453917150,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3480,i,3074170127240190356,3302466799512479827,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,17059919669787537564,9987438359245040468,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,11248755919102862090,15212949924706998266,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17302523228530994326,16321909046938266890,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17302523228530994326,16321909046938266890,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6460,i,1399360190301212007,7448138262235054656,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6184,i,17676974786675445413,10843618977422580971,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3660,i,16401727134816272044,15089031507965972712,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1124416776904920769,2014666026174640444,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1387784064455808594,9332899834784062496,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,4034281522493960589,8055612702277015068,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3358225863146995177,6258637539557693715,524288 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3468,i,488292872284028409,13579818464955556129,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6328,i,18109527724056568790,12603252979359623829,2097152 --field-trial-handle=2324,i,10376653011094724798,8518007111755179050,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3c5134b794391d61af88908e1941e43faa7ccd005657a59839f2a950d64fb844
MD5 36d36c7ed44e3a9ede83a12045be6afe
SHA1 2b72f93e8f38b91ac3c8de428470ced5d878ea36
SHA512 6fbc7554944bc4b228911a77ed44fabdc31e30261e6c87adb14b7b17422b66eaec477d6ca7cbe37436c5006cdae1cce672237259ddff3bbad92ad047d6f46d99
SSDEEP 96:ZAGDX+QuVNJOGc/zwtfvH3ni5CYaeytVobIk1Ky/y2:1YCQPni52mj/y2
TLSH
T160A1F9B920935F78FB21A07298EE498C373042F5F4025FCE0C64E57025E23A9DDDAB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8728457bb2758291935b8ffb945df29f4a7bc5585c29eb95513d0e82667c5db5
MD5 bc45cd8b993bb2db7243f32e3ff6fb09
SHA1 9560b58105ed2e3b7f908a143a7c672b492eb569
SHA512 dba9b82dbf5aba524c27a8f08bea63e3b35d75c2d018940f3621fd4517078dc5d1ab038f12e8c00f4b6e643539b63dd32bff8ce38c01500cb2c154de761cb75a
SSDEEP 96:bDGDXjQuVNJOGc/zwtfvH3ni5CYaeytVobIk1Ky/yqB:9YCQPni52mj/yI
TLSH
T18AA1F9B920A35F78FB21A17298EE498D373042F5F4125ECE0C64D53026E23A9DDD9B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5920ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5920ad.TMP
Size 3KB
SHA256 4dd7d7cadc497a7cc6200d29b62b8e074645690c4c802f685b7985ac79e6ac1b
MD5 65e99b1d8d3e2cbefe08d50f3fa77653
SHA1 cd1cda1a13bfa3534f55331cc7d1a250475243bc
SHA512 3cbe4426b420c1820a916c5eeed5319368c87110af6ba6f307b6794103143fe191f3fba8decdb7a3faf90b0a2a70913f82fa33df50804853a35c39153b1ec5cc
TLSH
T129715F3820474FB9EB22A17388DE209D7B3082F5F4125ECD5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c8620c7069ab030f8b2ea21b207295de66049ddf727b3cd527b2a9a561685217
MD5 67657bca4d2a58a072cc3c9d6192b67c
SHA1 03045dd6202fca8cf6ce9f829e22fb552a22f684
SHA512 af0c405e15fee89a3350b809370f11537b6f81544a77ab1e7d879e275575fa0583d1a4049d4d2f5311468f4bfe10d0b7a35b4020081a832a42557654fa9224c8
SSDEEP 96:DcOueuB92QqzHGuiuPuau/2Virn1cuoJngwyuE3:DXhi92Qq7G5CHJVirn1c7Jng7b3
TLSH
T1FFB1EFF2C7E4862ED82267F5A6147E1BCE2C0924572C3D26C9D5AF1B93E24B2E14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f2722abe49e18b4974b96586ed28d5cef75b66b360a476f05944f91eed1ae791
MD5 93e9b3b418893d40b979d7120138f617
SHA1 ef6bf7e6ca90e0dd9435cb49a2fa89b0bce0967d
SHA512 1f27b7cf940a327f84eca3a192c232957715699f648519f417ca3bf49b3779ae9ddcb99c2ee3f5501acddc1369ead471da4ee5befe7a9f3fa7a40614596a353c
SSDEEP 192:sxZLCRRWOR/fu5sXJvTIdpWvLtHW6+WN8ppX/Yzbhh4IgrJ:sxZ+Ce/fgsXuiJHbU/R9
TLSH
T10322C8566E34A93B8CC7D20DBA15BF53E6F95032A5911E48B6FC861C05E77DE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b790f0133ff9bd40a483c72c6f0a821b36cc137879d64ecc21629ba38159fff4
MD5 9d5581881cc084693752f8b419ad7d6f
SHA1 2b9ceab12588fd2206075e9d14de4d741d9bc38f
SHA512 444925de57b8a514631f794a36ea41069252f1374efd3a5ca23bd53590487f2962fe5236ce21279da7ddb5d2eafa185fa1e59e7a2429ece2340a6d40cc253a77
SSDEEP 192:sxZLCRRWDOR/fu5sJ0vTIdp2svL1IsHW6+WNsZPknppX/YzDo/M4Ig57J:sxZ+ae/fgsJnZbHb3P/SiX
TLSH
T15D32B7566E34697B8CC7D20DFA15BF53E2F9503295D01E44AAFD8A2C05E7BDE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 037667101856c46f14c678b005d7b618c5beffa42404c11c081e09932e9c5988
MD5 cda36be89da84d6244f2f72bf30457be
SHA1 39b3bf838623698c4fa7efdcde73520c71deeb22
SHA512 6ee9b76bdad0a23fb04437e6f7d7ff641ce83bc83bc1288d661d6da59ee688f992a601983e0200efb0316e290c77dfcdc35831fbc47f37293dd2c6c49c74721e
SSDEEP 192:sxZLCRRWOR/fu5sN0vTIdpWvLisHW6+WNsdppX/Yzbhh4Ig5BJ:sxZ+Ce/fgsNniXHbS/Rx
TLSH
T10532B8566E34A97B8CC7D20DBA15BF53E2F9503295D01E44AAFD861C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b1fe1cf75a3c0156681bdca903c0ccbce1ecc36be4dbaabc6094c9ad12182e92
MD5 47a829a84a94f971b26e3fbfc2df37ba
SHA1 c2b8de5ca6a000be20c95854e4eb94a0d74da5e9
SHA512 07690b22432697b1349db2b2470d21d97f08917679346070707b782c2742009c30143fe166eb5b49a9728850eebac61ff6c46a32252e290dfbf43f1a569792ac
SSDEEP 192:sxZLCRRWOR/fu5sJ0vTIdpWvLisHW6+WNsdppX/Yzqobh4Ig57J:sxZ+Ce/fgsJniXHbS/j7X
TLSH
T19832B7566E34697B8CC7D20DBA15BF53E3F9503295911E48AAFC862C05E7BDE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fc1ebd065d2d09f7fd0d5960f562868c428c6c28eda90a34df47b98271465657
MD5 2c7996dbca7681c5a7455665c9dbf49b
SHA1 fffa1fa25af4e7a6c3d8262fe8a685562e8ae7e5
SHA512 081451e4308fb72fc343e7dda42ab7cceb018070280a83b2a5dc6a9aa77b4e724d154ca4fd2db2464af9ad395ea5ee9156917f456d9a34b806e9fa82a825ad8d
SSDEEP 768:J1k7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBWroywYz:J1k7u70WvqiEau1jai5LA3Btqz
TLSH
T167C2E93B740CCB7E4F801E9DED566F973E9802C7A6988D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 25fafa42e3de8d619c3335b694200db20966e53539149447f0dc3c01d1b62e19
MD5 f68af92f47d8d67be04e60aa1ec0820e
SHA1 dda17d85f7c791e9a02ee46ec9047441913d28a7
SHA512 681b299f1b6e1ab670e2035c9f0719a5dd40a55606efbb3d259b055d8042e3f337f1b649b1f8bf5af45d1cb2588a4d9d3767734eb3ae2e5dd65244131edc9c18
SSDEEP 96:KIbCKcfJiKiQamvGKYIX/CbPdBlMNRIXDnMKrZDlMl:sSJFHu
TLSH
T1DF915652733B0601387E7908A7A99A3B4E4336537418A5AF7BB801A11F27F211EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597c79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597c79.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1d9344758d13d40a6bebf2f9cbb0a2f2d5f6865f9fe339127cc52b899fb14e30
MD5 82e1b387dacbe05d40840f4e82981620
SHA1 114676b0b64937725c62a2def4192af582244389
SHA512 db31095f1d6f6b1f24c5cbf3e7e8f7784befdfd2580fc459e882b6d7a6d4f711a7b35f62d0f04be48463d01ca5cddafd976f82450a7c38127607b61daecd0dbb
SSDEEP 384:WZcIhsNZcfxyiybw1Q2OdWGim1G7O6R2FeoNl7o1:EhR5ny4Q9oGiwG7TRMS
TLSH
T1F7828D721C78AD3A5EB6A246F4463A035FF89177A7C42B80E5FDEB1D01DA6A81307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0c757afd989d9c6b0fc26d3d5a77e9886c9b635b1df7d8a376ce96784f1c0f1a
MD5 818e88c0d0ee97a4f7706a805753b468
SHA1 f141d5bd2cd9503040167a89ad97321cec53e72b
SHA512 c3b28260d2ec4f2569cbc4d83c85d4df5336a6170d2ad32825bc57e36f1909b87142124b6975b0583a5259cfdfac5a3ee8ef232479b786d2af0a635ed8ef5f9e
SSDEEP 384:BiFiZcI+usN78TUNTUlIlefxyiybREBQ+OdWGimMG7O6R2FeoNl7o1:oFQ+uSwgk5nyeBQloGiXG7TRMS
TLSH
T1ABC22AF208E7993AD96E9747E73D2E034EBCC167B5846A50B3D89A1CCC961BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2baf3fa3351cb6de8c97a92d3b90231836ea8c7f2955f366fab4e10aa01ab0f5
MD5 1d97056b44d11824e8d9fa4eff447be4
SHA1 fedd81f52bbb360c904e1b5f54e0faf4ec8faf4e
SHA512 7e47359493bdc71288f5a7cf5cbf2d60bd3e17fe110b6b63e533ed519fcff1eada99d58d8fce22da7be4dd700090a271a5edd08ce2d66ddaf03f58b21a387a2f
SSDEEP 192:MON364BAQmiUya1VW5GBPKmx+FdG+Po5Z4aDhZ6U6:MON36eAxnWldWFX6U6
TLSH
T15002D835AC796C7B9EB26E45F4863B175FD8113BE6812F44EAE85B1C019735C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67699190f1e7fcec88f0cd38c8681db6c1965642177a1543d8c2471ce8b7b5af
MD5 27318db974ed671e450cdb704ef8299d
SHA1 772f1c0a648034ebbeec77b0e0e05531fc1c1f76
SHA512 c219f05fc1e4623dd1b7720d454b9f2100b8917b75959a9cac438ad9fb6a6a69ca90691edea263c69eb73147534ed6385d848879aef5ba325c26c3c1d418c46f
SSDEEP 192:RONU64BuQmiUyEVN5GBPKmx+FdG+Po5Z7pEimMzWwPrqRU6:RONU6eqTNldWGimgGU6
TLSH
T12C120A356878AC6B5EA16541F48736435FA8522BEBC46F84E6EC6B1C01EF3AC2307416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3b10d125c1fda0237e4fe95be83c55385c09a123b7400952eeae6a699431fde1
MD5 bcd6e2a95c776341826c361642b4e3d4
SHA1 3784a22c1f0b51d0a1fc6e3f2935953b0d2a48d9
SHA512 dd5c901080ecb89f83f5247f23da0efa85f649e913022ee75b15aaf28e0c7edddd3b257b1e93bd8453aacf89e56d249c00b661f5027264a407d8a6eba5c05908
SSDEEP 384:MZcIhsNZdfxyiybw1Q2OdWGim1G7O6R2FeoNl7o1:ahS5ny4Q9oGiwG7TRMS
TLSH
T183828D721C78AD3A5EB6A246F4463A035FF89177A7C52F80E5FDEB1D01DA6A81307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b6a30b23f6ac4c58b659c498e5990a39e930a8a16998145d5ac5ff4533939031
MD5 33e8f90f6a27470b6a43fe5e869de3f9
SHA1 0d766b609f81e5cc2f7e2e148fb370a6570f27ab
SHA512 e87eff6e82913f795a0377c6cdbf539edbc9069598d7b9ddc736a2f8d5cb3958772edc37b4131e2a8b5cee3276cf47ca9b52de514a6c6e955b198c4fea26afb1
TLSH
T1FAE00203B34008FBC02D573015C3161073F2C13463D343475C044274AC453140D30DD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2284747c96586d715e9f15fe3b076c7118e4e25f68a73fbdc57e12123be1cdfc
MD5 ad3b22e9368f9e471412416381705ccf
SHA1 f5a788b30c2a8b524d767ef1015c8a91a1e787d2
SHA512 ac3ccd9159ddd66fbded7a8752d8f9a9e572a94d6359d4315b99274b4930854aef212f9c6b55236a84568e8160adc86a8de83a34b107a82ea6c71c1912cf9c96
TLSH
T1D2E00202B34008D7C01457301183151062F2C124126302465804026068063100D20991
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e877.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e877.TMP
Size 392B
SHA256 3926dcffffdbb184f29a4a89d194ba3c1c2c1a5b1d1e06bb170ca01ca401ce06
MD5 c37ce2d7a81faf1f5dbb5dcade3a4dea
SHA1 88a2060a5dcabaf561b80886778545fbd64cd787
SHA512 97f9a3a47ad694bfe8c644fd1d2f66240c0b6686c6479017f22367bab761d2e73fba27da4ab344efdc8e90bdb3896e0fee1c44a8b237f89289a06cf704080e90
MD5 SHA1 SHA512

Submit Download

a1cd964e-586d-435b-8959-60350660920a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1cd964e-586d-435b-8959-60350660920a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d13beb9c09efc9f819ff2d0d94346d4b9cc375cfbd2e9aa23d6040e5f51de6d4
MD5 75180c28f4ecfef2b42f352576b2bff8
SHA1 09dae5ba97060e7adc1cd7d00b90659f58021e7a
SHA512 82b50e1b3814846e8debbc7afc38568e33a5543ba348b322c0e35929a889aba121a44cbb8dc27ee07bb2ce40e4a5d5552ac26c7020d55def99dca6e437ee417a
TLSH
T11A410948B6F91148B3B77E5AABF6A96D487FB8772E46D46D10010E4F0A63B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads