hxxps://xwdbbbd[.]clicks[.]mlsend[.]com/tl/c/eyJ2Ijoie1wiYVwiOjI2MTUyNjAsXCJsXCI6MTk3Njg2MDA1NDgxODY2NDcyLFwiclwiOjE5NzY4NjAxNzAwODg2MjI3OX0iLCJzIjoiYjQwODE0Zjg4ZmU1NDIyMiJ9

Analysis

user interaction
yes
max time kernel
46s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xwdbbbd.clicks.mlsend.com/tl/c/eyJ2Ijoie1wiYVwiOjI2MTUyNjAsXCJsXCI6MTk3Njg2MDA1NDgxODY2NDcyLFwiclwiOjE5NzY4NjAxNzAwODg2MjI3OX0iLCJzIjoiYjQwODE0Zjg4ZmU1NDIyMiJ9
Sample260916-ypeejsde36

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340622543618884"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{5A753B1D-30F6-4318-943B-22E457B387BC}	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2836	3276	msedge.exe	87
PID 3276 wrote to memory of 1392	3276	msedge.exe	88
PID 3276 wrote to memory of 4740	3276	msedge.exe	89
PID 3276 wrote to memory of 4740	3276	msedge.exe	89
PID 3276 wrote to memory of 4740	3276	msedge.exe	89
PID 3276 wrote to memory of 1880	3276	msedge.exe	91
PID 3276 wrote to memory of 1880	3276	msedge.exe	91
PID 3276 wrote to memory of 1864	3276	msedge.exe	92
PID 3276 wrote to memory of 1864	3276	msedge.exe	92
PID 3276 wrote to memory of 1864	3276	msedge.exe	92
PID 3276 wrote to memory of 3728	3276	msedge.exe	93
PID 3276 wrote to memory of 3728	3276	msedge.exe	93
PID 3276 wrote to memory of 3728	3276	msedge.exe	93
PID 3276 wrote to memory of 4756	3276	msedge.exe	94
PID 3276 wrote to memory of 2260	3276	msedge.exe	95
PID 3276 wrote to memory of 4756	3276	msedge.exe	94
PID 3276 wrote to memory of 4756	3276	msedge.exe	94
PID 3276 wrote to memory of 2260	3276	msedge.exe	95
PID 3276 wrote to memory of 2260	3276	msedge.exe	95
PID 3276 wrote to memory of 4484	3276	msedge.exe	99
PID 3276 wrote to memory of 2736	3276	msedge.exe	100
PID 3276 wrote to memory of 4484	3276	msedge.exe	99
PID 3276 wrote to memory of 2736	3276	msedge.exe	100
PID 3276 wrote to memory of 1848	3276	msedge.exe	101
PID 3276 wrote to memory of 1848	3276	msedge.exe	101
PID 3276 wrote to memory of 1848	3276	msedge.exe	101
PID 3276 wrote to memory of 2820	3276	msedge.exe	103
PID 3276 wrote to memory of 4272	3276	msedge.exe	108
PID 3276 wrote to memory of 4272	3276	msedge.exe	108
PID 3276 wrote to memory of 4272	3276	msedge.exe	108
PID 3276 wrote to memory of 3172	3276	msedge.exe	109
PID 3276 wrote to memory of 3172	3276	msedge.exe	109
PID 3276 wrote to memory of 3172	3276	msedge.exe	109
PID 3276 wrote to memory of 2216	3276	msedge.exe	110
PID 3276 wrote to memory of 2216	3276	msedge.exe	110
PID 3276 wrote to memory of 2216	3276	msedge.exe	110
PID 3276 wrote to memory of 1412	3276	msedge.exe	111
PID 3276 wrote to memory of 1412	3276	msedge.exe	111
PID 3276 wrote to memory of 1412	3276	msedge.exe	111
PID 3276 wrote to memory of 1252	3276	msedge.exe	112
PID 3276 wrote to memory of 1252	3276	msedge.exe	112
PID 3276 wrote to memory of 1252	3276	msedge.exe	112
PID 3276 wrote to memory of 3116	3276	msedge.exe	113
PID 3276 wrote to memory of 3116	3276	msedge.exe	113
PID 3276 wrote to memory of 3116	3276	msedge.exe	113
PID 3276 wrote to memory of 4688	3276	msedge.exe	114
PID 3276 wrote to memory of 4688	3276	msedge.exe	114
PID 3276 wrote to memory of 4688	3276	msedge.exe	114
PID 3276 wrote to memory of 1180	3276	msedge.exe	115
PID 3276 wrote to memory of 1180	3276	msedge.exe	115
PID 3276 wrote to memory of 1180	3276	msedge.exe	115
PID 3276 wrote to memory of 760	3276	msedge.exe	118
PID 3276 wrote to memory of 4624	3276	msedge.exe	119
PID 3276 wrote to memory of 864	3276	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xwdbbbd.clicks.mlsend.com/tl/c/eyJ2Ijoie1wiYVwiOjI2MTUyNjAsXCJsXCI6MTk3Njg2MDA1NDgxODY2NDcyLFwiclwiOjE5NzY4NjAxNzAwODg2MjI3OX0iLCJzIjoiYjQwODE0Zjg4ZmU1NDIyMiJ9
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc8a49c188,0x7ffc8a49c194,0x7ffc8a49c1a0
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,18417766746148289971,1110672701475243265,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1441862748602586191,15487130053536525074,262144 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,7129548892443322945,2642504902195070750,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4226731839179025929,6535570012393477503,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8177276905668560825,27571377995348694,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,12464805687691805111,9880463694171913121,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17287825782937343736,17192892776748834826,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17112213810269407431,13792009310279587578,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1525656788102953309,3417567453750475161,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5688,i,4718984126120444397,2648821007929100440,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7299943739689662610,15363334675409207298,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7299943739689662610,15363334675409207298,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6364,i,16808957975136603308,17081529058636099903,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3588,i,945718579543446783,8783366041168962063,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4292,i,10203230967302324332,9045663087673599854,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3876,i,3450696094582120087,8526678755301599832,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6776,i,2682818101539622318,11483391996592565984,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7228,i,3585949839861340514,970744645778363332,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7140,i,18148350458189212982,17482968801318662903,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4748,i,570537231802030728,15014519449560957085,2097152 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,3360183593015532520,10403622688425915872,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,14452135631634986368,15362077388901742184,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,15944663340795802246,9839181028110503664,524288 --field-trial-handle=2340,i,3343846438470425340,2775784542186936719,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f0c7cf73daa055a84a96dd8173fa0135162c24981790886f5b5413e15da4349b
MD5 354c9d7f729a66e46970327dd1acf74e
SHA1 4ed52255aeb656b23c011aab09c0ea1ae2a7a5fb
SHA512 03c544bbb0044ba9435af8f4a2196f0cfaeddbe05e7478f6eff582f5ae549ed68e186e0114d9ffbd978764c31a2dd92360187b06e5aec1126eb278b7125830a1
SSDEEP 192:sxZ8lWp/fus7VuIdpcfQHW6+WNaFcK/Y368TSQZIgrJ:sxZ8Mp/fusZ/xHbS/X839
TLSH
T1D022C8566E38697B8CC7E209BA25BF13D6F9503261D11E48EAFC971C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b8b2e0dfba6c332f597e453f07b7127a7dc94f16a85eaed3061f009aac531fc9
MD5 17a165d89b294555646fa54bbd222e0d
SHA1 9f5b1460047120171b3a160f227ba2751babb071
SHA512 3b53db9b4103b946e7edc5af8018dc3dbb2daed20e8b13dead04af6919f87c2431fdb9d143acd29b9e02a4354e5b1e5f115e0e89282f3aeadbfdcd009c05b7c1
SSDEEP 192:sxZ8lWp/fuse/BIdpcGcHW6+WNfVYoC9q90TfY36rSQZIg5tJ:sxZ8Mp/fusmquHbfhWfXfR
TLSH
T1F732C8627D346A7B8CC7E209BA14BF53E2F9507255D11E44EAFC9B1C05E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3c8a3801d8c856ea8c3aee81e36e2536014f92b9369b42d49de0977713da42ea
MD5 8069671a22eecc2b0f1fad51a7c888e8
SHA1 232bda76a840d5ac98b0a6a712c5e555f511ab61
SHA512 f5ef2403bb235183892d8d6b5f17d505646f03e6bf81e287859c5b59fc04f522c5ec4135e293dd387a9c96bcd7c67e39e825446e4b44ce72f04e5bfb0195e1e3
SSDEEP 192:sxZ8lWp/fuse/lIdpcGcHW6+WNfV7C9q90TfY36rSQZIg5tJ:sxZ8Mp/fusmWuHbfjWfXfR
TLSH
T13832C8627D346A7B8CC7E209BA14BF53E2F9507255D11E48EAFC8B1C05E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 29978791a73521f465ed3abf6981ee68c83b72cef7cfd5a10a3cfee2ba0de019
MD5 7edada3f2d446c38c89f81a5db7031be
SHA1 b707f62f0ac00b64591ee236428aa7b24f2e37e7
SHA512 f347ac206983d79cbf34fda0bddcde17a1ecd546ebf53f21f3048ac015afb27fb4b0b29b326e20945127be490639d529dc177ef258ed6f726dec108c3a3e0b7e
SSDEEP 192:sxZ8lWp/fuseVuIdpcfQHW6+WNaFcK/Y368TSQZIg5PJ:sxZ8Mp/fusI/xHbS/X83P
TLSH
T14522C7666E38697B8CC7E209BA15BF13D6F9503251D01E48EAFC971C05E6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 703126119328d17b013c8f5dc4897712d311045add1e5812df267c3554a3066e
MD5 b6097de324856a96a639aa5723a562f0
SHA1 7ac29051552ff5be2cd6481fa7ceba993055a583
SHA512 c9fab9c694301597f30470e9a2ec862a7bbcc94e9fed41364adca4ae78d140ee8874b811da8401fed45aba68f99ecb71c8f411733cd9f6b4647c160441766e71
SSDEEP 768:SAKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/lroV8:SAKlm7QWvUYm0u1ja8/L/E/eV8
TLSH
T1B9C2FA3B740CCB7E4FC05A9DDC5A6F9B2EA802C796588D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8a95211fdf05949923918189750e10286bd29a066ae07a4f816f1366069a609
MD5 77dffa90d61203e27be412e18005223c
SHA1 fc9540c373ee555b10e9cc21ea507250204a6aca
SHA512 da653a50b8c6cfc2847fa859b13ef90760fdb89a1dbb58c0ed33663f599d72b31d4b8962affa123dd7a871b4381a81f7c4c9ace62d3fd7df28f48db5cc060d1c
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyLMb6G02aDbqpyIS+DK9azCIfKbSo/y6:KsIoKxiGGr+KwzCEKbSqGtaKA
TLSH
T1B491241132BB034478BE284881799B2F465271B33419EB6F7BAC55929E2BE480DFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b7f5c197c9615f11803fab5c0b0b67cdc0f0ba2018515c2bccc892a9dfa9ff31
MD5 31f307f0e03d2b6685cb7159961e41b6
SHA1 37de9436040ebf5a444baf7405b670ebb7910dbd
SHA512 450f7ef461657d2496e1aef78b77d22573e7fe816e88052312477923e58d62b998e75867050a29746d3abb67c1b3a1fcda1b0793aa5db49dc1d3fa20da9a34da
SSDEEP 96:KqONknQsjpfbUmjH5ih/cIPURHl8h4otop5IaDeBKP4v+Y1xf//ojdOx5YEqso0E:BONr6JUm0QmiUyBeso//aOBCT8aU6
TLSH
T11702D839BC68BCBB9EE2AE45F0477B239FA4106B96915F84DAD82B1D01D715C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9b8788eee05d30e7ac001ba675a61c7dccd5770a2afed0f99df5edd7e99e48f7
MD5 3d7e034a499438d302d60214426b8b29
SHA1 7e62de796f6953a48032e6ffc582dc4924a85825
SHA512 2d8226bd4e3743fc7c75732d26b12f94b142d4d8755b1a7b6e325f6f2aa9a719cee79d8c57e7d0d0feecf5a68c434e3f1c81d0eecd0c94e23dfd8f775b58da37
SSDEEP 192:uUA7sNrDfQLf40WeHUbdsdQmiU15bp4h//afVHaoTg/nw2U8:csNrDf4kLb+br2h//afVTTkfU8
TLSH
T1E94218357838AC775ED3A584F0473A239FB8406B9B846F94D6ED6B1C05DA1AC5307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 490360ee2c6b5f33cbee4f15141b9c854b58d7ce054d74ef1998a829e6c0484a
MD5 2da79910bb712bb95174118814561b86
SHA1 623af65afe4d0aa9605f67ef37dfd947bcff10c0
SHA512 17a7bf453a8dad530e7a4392a2a657d3bdba3ad4a9a38b8a161b1d457aad8bc2a7c8bec8c5e2a95725b96fe9281a6102a5e972ff35858a29c1abf5824acc57b6
SSDEEP 192:uUA7sNrDfQLf40WeHUbd6QmiU15bp4h//afVvaoTg/nw2U8:csNrDf4kLb4r2h//afV7TkfU8
TLSH
T1464217357838AC775ED3A584F0473A239FB8406B9A842FA4D6ED6B1C05DA1EC6307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7ef10cf85d3ea9bbf0e621a08419363a8eee3263ff774929e2589ab72d437cdd
MD5 b7c4f3325b088433afce08f1accf244d
SHA1 5ee592cf49db97c695c67ec5cbd1e96732492a4b
SHA512 5b911123e4fbb0cb2bbe2c9d2e5d3fad8920a133608ad108ee7ba4f46ba5969c4beb2b671ee9dfafe8d44bd6b356d8fca48e676920deca0ed08f7a0bcc5bad82
SSDEEP 384:ZZcIFsNrV4kLb4A32h//afV7Tkf7O6R2FeoDleToD:xFdE3G/CN7Tu7TRz0
TLSH
T1E3828B752878AC775DE3E185F4073A139FB880A797C55E90D5EDBB2E05C99E81307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c355ac4f307471e800d2279153059316a3326f9a4c48712737f6db858337c049
MD5 dd71b270bbd18e489c1955a551a94d39
SHA1 066e00ca78becb7c7060b2c15e826fd29b23316d
SHA512 5357a9fb48510d958a99202d75e6c7c0ad5993a56967ca84e53e5e11b6d2ec2e0bdcbf22cf310374f9fece2d0ca9c598df503683e7552d09c5ee0513a576a46d
SSDEEP 192:BON+6JU4QmiUyCeio//afVFNxTg/nw2U6:BON+6+YSio//afVtTkfU6
TLSH
T14112F835B868BC775ED3A884F0833A239F644067EB856F95D6DC3B2D06DA1AC5307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9520ac6a43f4d6fe960dd5f8d6534971e7245e407cc179477559c70b7c39d841
MD5 b8e6e90588dcca7399004f869a461d4a
SHA1 41f7b3c695b996b91611db7b506bc1a3146eae5c
SHA512 7eb800e9d99e6aa2758c244a9a7455abb2246c9d0d401ab3ed431c9d08bda199c215092ac7a9859c2f2072777765dd4330fc20aa456fee802f85197a73d8c7d4
TLSH
T16DE00246930140F9D01C23300043170467C2D01100D0478B6D1241442C125411C30A44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 12d1d3ef9c1a6569c888e57c212c211a2ea340eec9aff4b5c29df29a9cc8257f
MD5 576ebcdc7f47270ce3ff234e380541ce
SHA1 991d171f31bee0309e0250a04ab104f74b3d716f
SHA512 31a248f0bdde1386b933b3d345494d75476ff4190aff6c138b1e53c299b858cbbd237b0b25f024190cec1504164e621bab0612d797cfccf24d4c7be057780180
TLSH
T1F8E00247D30140F9D01C23300043170467C3D13101E0478B6D2241883C536411C30B44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591236.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591236.TMP
Size 392B
SHA256 0e8b709149134d9f763169fc2a2d3660d72ba6251012e1fc8476e12f1e60848e
MD5 76afc2e3c5ee449174a5538a7fba4595
SHA1 017069b90089bc0674f20acbc0528a2700304a92
SHA512 5ce41f4eb705b46595915a5df3cc964a3a25505814b7aafa241cbb50eacde1c29a7f4cead69503034b59f23d78b8471c6eb28cdf64be5f4fabc3bc208e7114ad
MD5 SHA1 SHA512

Submit Download

1094a643-8d50-4c8e-9f87-f93cdec0ee36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1094a643-8d50-4c8e-9f87-f93cdec0ee36.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 89392eea3ac0fdd9f835c15dd5dcede72b4b3b40338579d9343f892580ee9d2c
MD5 328851e5ce984b4985deecf46feb6903
SHA1 d5a315d7586f6393896cedd28b5f16675bc19222
SHA512 2f6c9b709ed19e0b0c71dc91e6531c5b5d71c38451f52af86260e1f40839c02fcbe3e9c5d3be20b480f7e54c6ba7970d1a2de8a2cff89d4ce0ecfcd9e3c5fe3e
TLSH
T16B412D9CB6E91148B3B37E565BF7A86E447FB8731E06D15D00110E8E0A66B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads