hxxps://www[.]thankbox[.]com/app/thankbox/Asan6qeS/open?signature=f51b2326a7446b77bef80ddacecebffe8229a29567ab50fab1becc59aac780f9

Analysis

user interaction
yes
max time kernel
209s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.thankbox.com/app/thankbox/Asan6qeS/open?signature=f51b2326a7446b77bef80ddacecebffe8229a29567ab50fab1becc59aac780f9
Sample260924-lfemqsae32

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347157060604528"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9BAA0F6A-6174-4E15-9349-652E7E86DDA7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe
5564	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 1696	5564	msedge.exe	87
PID 5564 wrote to memory of 5916	5564	msedge.exe	88
PID 5564 wrote to memory of 2772	5564	msedge.exe	89
PID 5564 wrote to memory of 2772	5564	msedge.exe	89
PID 5564 wrote to memory of 2772	5564	msedge.exe	89
PID 5564 wrote to memory of 1132	5564	msedge.exe	91
PID 5564 wrote to memory of 1132	5564	msedge.exe	91
PID 5564 wrote to memory of 392	5564	msedge.exe	92
PID 5564 wrote to memory of 392	5564	msedge.exe	92
PID 5564 wrote to memory of 392	5564	msedge.exe	92
PID 5564 wrote to memory of 5192	5564	msedge.exe	93
PID 5564 wrote to memory of 5192	5564	msedge.exe	93
PID 5564 wrote to memory of 5192	5564	msedge.exe	93
PID 5564 wrote to memory of 3740	5564	msedge.exe	98
PID 5564 wrote to memory of 3740	5564	msedge.exe	98
PID 5564 wrote to memory of 3740	5564	msedge.exe	98
PID 5564 wrote to memory of 5712	5564	msedge.exe	101
PID 5564 wrote to memory of 5712	5564	msedge.exe	101
PID 5564 wrote to memory of 5712	5564	msedge.exe	101
PID 5564 wrote to memory of 3860	5564	msedge.exe	102
PID 5564 wrote to memory of 3860	5564	msedge.exe	102
PID 5564 wrote to memory of 3860	5564	msedge.exe	102
PID 5564 wrote to memory of 3524	5564	msedge.exe	103
PID 5564 wrote to memory of 3524	5564	msedge.exe	103
PID 5564 wrote to memory of 5036	5564	msedge.exe	104
PID 5564 wrote to memory of 5036	5564	msedge.exe	104
PID 5564 wrote to memory of 4900	5564	msedge.exe	108
PID 5564 wrote to memory of 1768	5564	msedge.exe	113
PID 5564 wrote to memory of 1768	5564	msedge.exe	113
PID 5564 wrote to memory of 1768	5564	msedge.exe	113
PID 5564 wrote to memory of 5240	5564	msedge.exe	118
PID 5564 wrote to memory of 5240	5564	msedge.exe	118
PID 5564 wrote to memory of 5240	5564	msedge.exe	118
PID 5564 wrote to memory of 3240	5564	msedge.exe	119
PID 5564 wrote to memory of 2860	5564	msedge.exe	120
PID 5564 wrote to memory of 3240	5564	msedge.exe	119
PID 5564 wrote to memory of 2860	5564	msedge.exe	120
PID 5564 wrote to memory of 2860	5564	msedge.exe	120
PID 5564 wrote to memory of 2480	5564	msedge.exe	121
PID 5564 wrote to memory of 1192	5564	msedge.exe	124
PID 5564 wrote to memory of 3264	5564	msedge.exe	125
PID 5564 wrote to memory of 5280	5564	msedge.exe	126
PID 5564 wrote to memory of 4764	5564	msedge.exe	128
PID 5564 wrote to memory of 4764	5564	msedge.exe	128
PID 5564 wrote to memory of 4764	5564	msedge.exe	128
PID 5564 wrote to memory of 2312	5564	msedge.exe	129
PID 5564 wrote to memory of 2312	5564	msedge.exe	129
PID 5564 wrote to memory of 2312	5564	msedge.exe	129
PID 5564 wrote to memory of 2352	5564	msedge.exe	130
PID 5564 wrote to memory of 2352	5564	msedge.exe	130
PID 5564 wrote to memory of 2352	5564	msedge.exe	130
PID 5564 wrote to memory of 2024	5564	msedge.exe	132
PID 5564 wrote to memory of 2024	5564	msedge.exe	132
PID 5564 wrote to memory of 392	5564	msedge.exe	133
PID 5564 wrote to memory of 392	5564	msedge.exe	133
PID 5564 wrote to memory of 3820	5564	msedge.exe	135
PID 5564 wrote to memory of 5396	5564	msedge.exe	136
PID 5564 wrote to memory of 5396	5564	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.thankbox.com/app/thankbox/Asan6qeS/open?signature=f51b2326a7446b77bef80ddacecebffe8229a29567ab50fab1becc59aac780f9
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffee708c188,0x7ffee708c194,0x7ffee708c1a0
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,13772456827855268238,7268425536739155168,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,1060310140056722040,7867148946084760251,262144 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16125995105688101551,1813797916571758787,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13130916372628170374,8404485510619720112,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,4696610170861464912,4066938690338389730,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4772,i,3536192516379879202,4518695460238335232,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4128268946816920339,9942281549643262696,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5296,i,3821167031511755003,2288570506646044103,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3570621196825795282,5871436336053955353,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7030275681504998884,1719585154756773016,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,9646211388705018455,3486351592278722577,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,9646211388705018455,3486351592278722577,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4836,i,5162863322923094212,9941099669193154118,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5244,i,16027484190896370533,10075517192171133897,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,1310924924992193722,11697044453388824118,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6744,i,4158601922380099966,4588110237841658199,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,1516913925437551228,10568608057929498467,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,7357168291841758699,7898958037656663933,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,6494247383150347843,4008505766012601810,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,15950188220528938264,16802873049501078023,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6984,i,13009149071010619657,13478432043844513278,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3424,i,8802614988621349849,4957570028192220748,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7300,i,10854032997106573708,10834853474230293215,2097152 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,9848909958112477241,13684426107151873392,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17912029601764839397,12459741419777516007,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,16443805009185208132,9077656692328172456,262144 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,15665710197011694044,539829991566281019,524288 --field-trial-handle=2280,i,5984009161594840378,17844927532904100735,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d9a618a7a046c535fe3ab332bb412451c6715b6cd133a7759c01eda313204cb0
MD5 a0325e7a28577620cf56063b904af92e
SHA1 8a165b9e588c945b5215129bb7009bfa6771865f
SHA512 8dde35d13ea5bf70d83bd4ff4e0308cdba19e2ebaec7086a30373250d624b8e6e4deafa4fec4e080c8ec98e0fab0e7eafda7a68b2e1e15c531eb161947f970b1
TLSH
T151E026CD06D8C3BEB34466C743BCB74C9280370F96CCBA8A1704C58CB4014A0A28BEE1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 2e02fcf38f2a77a6294b9b717f56cd16f508ad53a1627d59739ea4673d178768
MD5 9a3df9e610fa1ca53a77367adfd79031
SHA1 008b9154c76e1b4702fb1ad3286bc7f85b33d0b0
SHA512 02188035bad5a3fe9a850e952fb0099e42bb0d504a140de35c9c5afe9c498f52508a753e4b528a63bae8448c558609f01aeea3bab1bf1cae58a1fad5c716bd64
TLSH
T138F02D75C825EC3F08FD0B3960D40B46F75023672641985B3B3E420C4FF0537468691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9a51157e38ec079d85af61854d02254ff0287a4459ec65f102e52dcfc95ba4b8
MD5 a100b36034699e106efd41242ed303ca
SHA1 103519bf36b5dcd28c191cda391561c002172448
SHA512 4a585f291fdf6b5fe2bfdcee47f8bb4597706a7a8b300090905edfe00e77f63a581b289b5e7ee8a24d87d6d5d0b63292e2f4a2fdee1c73c1ee03ae3de0c53c4c
SSDEEP 48:W5Ju7EzxlulHBIWoNPCU4qAIlDQ0/AHhN7yNVK0brFxemx3WwaEUZNOSFxjoSeIT:I6E4uiUAw+NGNbFTtWBEUbOSHjo0HRz
TLSH
T1C2A14E4926606745FB47F3B4C9CE08423A34A46CDC631F436896D4B55F363AFA3DB806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6ef2cadb45db88bc4bfba2fb06ca52715500a8d858bd5bb626d06d04f7221312
MD5 e341fa3383dee6a928e53430cc5c2656
SHA1 0bf833e9727f03bf3e19df858625b595cb4dbbe5
SHA512 4a820a42eb0965cfb0f2af4f3fdd504ba735182874da5c1b03bd1f02109b231d3e82130eeb04aece5704c77aa6ca474b0fc2a8d0182dbaf0916a03edaf57e3c2
SSDEEP 96:lZ6E4ui2Aw1NGNMFTtWBEUbOSHjo04VG6:nDizwHGOayUbOSD/g
TLSH
T1B9A15F4926606741FB57F374CACE08423A34A4ACCC671F03699BD4B55F323AFA3DA816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f332686621e033a9cd40c02657de23e9a9e760adf3fe3506d878ef85e15e2909
MD5 a42a54cf3ee7f9657418444157fd7610
SHA1 d3df88dc4f3f8a0ba5a103229216a9f62eba8e4c
SHA512 732b3165a03f6b30f29381a560738233acb1d97bfa80f46011ee668dbb41627dddf648f30aaecaa156054e33bd6c40b429864e46b69f4cd9c6f537327685555d
SSDEEP 192:D1FKpW3mK6FaiUoKAvhXRDUUX95iHhWwSA0v4mj:D1FKpW3mK6FaiUoKAvhXRDUUX9QHhWwy
TLSH
T1E6E1DFABC3E8AA2C8D3151F1A6196D2FDE6D0915532C3C1FC9D4AF1B5FE1471D202A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3df0f93b6f0cbc342df37488eae7aa67c10e96de413d3e1f07febbc27db1e89e
MD5 e06ce52de982f5287841d70d3433a204
SHA1 90bdc0dcd1026e521a0ceccc1d785545a0ed6cf6
SHA512 a0819fa8ecfb08bf4efd9c6b1aa7a4f02f8f5445a5fd91b8e1d045849cedab23a0e798c1a828a579663267a6cb0cfda126c0790c9dda816b3002dd82bd804b3b
SSDEEP 192:sxZeRRkS/f/sfaQZLV84zodp7+HW6+WNJYu/Yoo2Sm6IgjtEJ:sxZesS/f/syO2LCHb5/LSfjtI
TLSH
T14B42D8156E28A93B8CC7D219FB15BF63E7F9103391950E48AAFD8A2C14E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d8674e3e2b7213746f8af5e271f2c6108b1dfe20e79cb52903f3e16a8497c230
MD5 9b3501f45de4248538311a2f2553e132
SHA1 574d1923f6586e7bcd2e5f89278eef8a46279029
SHA512 21d62fa5539d2a1ee84c72bc8a68193d6460f5048a727f17229abc321093fcede8e2654bf3862f6745abafc89ec21bc21e603c8b727ac0656cb4302a2cc22b81
SSDEEP 192:sxZeRR9S/f/slQZLV84zodpHU+HW6+WNJcyXYo32Sm6Ig5utEJ:sxZeVS/f/slO2LbHb3XUSfAtI
TLSH
T18D42D8556E28A93B8CCBD219FB56BF53E7F9103391910E48AAFD8A1C14E76DD620340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 786fed55e3d756b446cdd9d4e96054ba2fec34f859c66ef1a54990c50d153568
MD5 819997e38d1a0f0fc9e91a1cbeebdff5
SHA1 31f22699b6a45b2c0a58aff0985fc4c4de39f227
SHA512 45549dce85001e9157d73afa23badb80008e108e237625b3aab3717152f1eca3355715f047540408353c523663782395ab1cee3cd899cc4948cca68ac88fad74
SSDEEP 192:sxZeRRkS/f/sfaQZLV84zodp7+HW6+WNJYu/Yoo2Sm6Ig5utEJ:sxZesS/f/syO2LCHb5/LSfAtI
TLSH
T10742E9156E28A93B8CCBD219FB55BF63E3F9103391910E48AAFC8A1C14E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 137d96e65d4651b7697f6162c0a8c1c78e71e779a46d6b1ecb4bac40c4961539
MD5 3a7a040312e59d271b976ff9392bdbde
SHA1 66f3e1346e8132e00fd967ee39659b5f549a2dfb
SHA512 4de6c4f50dea74f03856e22c9e6bd2ac72dbd24fb3374528e995f354c6f9de2def07bf08ff68b6ab5f3ea57d4a17a1785e176f6542dedfc680fc8675f42bfebc
SSDEEP 384:SL29ObJffppdNlrtEYFdFyFJFtF3FrFPFYFrFsFRFFFxFBpFvFIFNFtFMF3FY:SL29ObJffppdNlrtEoHWL31R9oRkj/DY
TLSH
T1DEB2101571BB421039FE291891B6972E068231B33119E66F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ad6a501cde3269e16652bd25c52ee8b5271e88d486181bb07d6f7e3d433ee313
MD5 27315aaa4cc1f6850a75e8256f9a739d
SHA1 f249417d32c54d022ae8a5fd18b51ce5e93bde8b
SHA512 cd1e2a54bd2a3f196b0404658eba1136043f4b59039cb010924907755e969dfcd8d41b5b2e456fe9882f99d6fb5db04f0958199f1f09b2671ac5ab04696cec88
SSDEEP 768:eFQOXwgPiXjBCUwVAgto7i00Sa7dLKk9QhkS:7Oduwxm90/QhH
TLSH
T15DC25B32EC58DEBBEDEA4BD5A74A7A03DEF04163858C9AC8D9E91D1E00D749D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7e68ed2514c29343610e0577755ad8866b20545fd3e3b736e297fdc020701054
MD5 34aa70ce7bf83f0e6b82eed146e82c4f
SHA1 3f79a579c5f97f9b961ad8b8f7c80c2a673cffee
SHA512 e5574339233cb0e61b73e3f8b1a905651aecf7a5d2c652fcb05ff97b16b6e7682279f959df8c15b3bb775b911c2babf032044134473252728173d43f33e93f7e
SSDEEP 768:xFQ+XwgPYDBCUwVAgto7i00Sa7dLKk9QhkS:g+dUwxm90/QhH
TLSH
T1D3C25B32EC98DABBEDFA4BD5A74A7A03DEF04163858C9AC8D9E91D1D00D749D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9446b392e8804b7fddae0b79d6d1ec09cf2f03d83e1baf6dd04f97d5e5034c9e
MD5 f22ee2605b7bb29423ca50f0e6ddfca4
SHA1 dcdb5bea76061576c37082533d944baee11c4296
SHA512 575ce770bc4d1c217e16c84832f74d2cff4d0f4cf89fff75aa98210f626920567c1d3062c0be3e434793d2252ad3b1932877369ed2a5733f969f783a03185732
SSDEEP 768:8FQ7XwgPKXjBCUwVAgtoOm00Sa7dLKk9QhkS:F7dGwxpp0/QhH
TLSH
T11FE290F298D78976E9EE0B87673E2D0299FCC163B4485984B7D91D1DCC864BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 eecfd153afa387739268d3be6622ccdbfc4c13a22df5f35bd46702b54dc47b58
MD5 56bca76200f2ab5a6dd05e1316ccead2
SHA1 f7f38a8802891b138ebdadbcf6ffe95751686dc2
SHA512 a2cf3b521341403f68687b1842977baba14d9b5b0544555f3573e17dc0ea09043ac297907c7ef5e84ed5e6918a2b3b1153928509abdf6665e3034644177109f0
SSDEEP 384:nCiFiZcI63sNK8TUNTUlIm2aKMif4w2f0BCUvPAVG9g7FD7O6R2FeoSqgL/7Iz7Q:JFQ63DwgcEZBCUwVAg7FD7TRXyQ
TLSH
T1D8C25B36EC99DAABEDFA4FDAA74A7A03DEF00167958C89C4D9D81D1D00835AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eb9fe03be1d175b2302bdbb460eb0b88fae1a17e1b56dcb8c49efc9ba686240a
MD5 07e3db61c778a3bdf180d3e18e1b2245
SHA1 2fd8e589c9a2cc1f3a73c4192015dddf861e3cce
SHA512 2770ab93aa25c23c390255dc0fe1e7262375746baf9cf09d49c11561a92ea5b1cd33f3e2fc14b40405412ad2e0581d3b13a10523dbe86332df4d1685dd2e44f6
TLSH
T1AB410958ABEE1148B3B76E5A9BF6A46D487E7D372E0690AE00110D4F4667A00CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

Thankbox from ESRC.pdf

Path C:\Users\Admin\Downloads\Thankbox from ESRC.pdf
Size 5.3MB
SHA256 daf6ad45b6b02042e95be43c08f090596020d256e553be02f1a70906d1f952e7
MD5 8a4349c5162feb422c5434b0911509da
SHA1 9836bbba8254ea72e3c49754705537634391d5a9
SHA512 1bfd200f194337cf0a88879eb96ead3f3794c7507c04828d3184ae3b5a2d64ff84ee11254731826d8a69eff6079e7d6bd04856f3f72b9586e678e06292b4d425
SSDEEP 98304:s9+571cJ9aNe3qDnhGWIm3rUAqHUcYPCl:nRO87NIlDYKl
TLSH
T19C46D026BD2AD10CF2197575988D3069271E75F2FB6E10CB5E9D87CDB4C2A02DC1BC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4900-343-0x000001A330D00000-0x000001A331D00000-memory.dmp

Download