hxxp://email[.]corebts[.]com/trk?t=1&mid=NDYyLVpLRC0wNjQAAAGkc5FDDBAir_iWK59yAUB1mCko9GPwYQu-heRzr2H2vH4NQ9IUcmiDCw4b0pyZXhmkyrl2-ShUdwajU2YcHnvpyXmpbqptImVgDL2XNZk3ymENGU7CnZpxn96EzwxMtwzzCzXKshkBtLOw4Q

Analysis

user interaction
yes
max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://email.corebts.com/trk?t=1&mid=NDYyLVpLRC0wNjQAAAGkc5FDDBAir_iWK59yAUB1mCko9GPwYQu-heRzr2H2vH4NQ9IUcmiDCw4b0pyZXhmkyrl2-ShUdwajU2YcHnvpyXmpbqptImVgDL2XNZk3ymENGU7CnZpxn96EzwxMtwzzCzXKshkBtLOw4Q
Sample260925-mkmdtavy3k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348058991126496"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{BDCFF837-A700-4EB0-8369-F700F64322C8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3676	4576	msedge.exe	87
PID 4576 wrote to memory of 3764	4576	msedge.exe	88
PID 4576 wrote to memory of 4440	4576	msedge.exe	89
PID 4576 wrote to memory of 4440	4576	msedge.exe	89
PID 4576 wrote to memory of 4440	4576	msedge.exe	89
PID 4576 wrote to memory of 3772	4576	msedge.exe	90
PID 4576 wrote to memory of 3772	4576	msedge.exe	90
PID 4576 wrote to memory of 4320	4576	msedge.exe	91
PID 4576 wrote to memory of 4320	4576	msedge.exe	91
PID 4576 wrote to memory of 4320	4576	msedge.exe	91
PID 4576 wrote to memory of 1060	4576	msedge.exe	92
PID 4576 wrote to memory of 1060	4576	msedge.exe	92
PID 4576 wrote to memory of 1060	4576	msedge.exe	92
PID 4576 wrote to memory of 4552	4576	msedge.exe	94
PID 4576 wrote to memory of 3948	4576	msedge.exe	95
PID 4576 wrote to memory of 4552	4576	msedge.exe	94
PID 4576 wrote to memory of 4552	4576	msedge.exe	94
PID 4576 wrote to memory of 3948	4576	msedge.exe	95
PID 4576 wrote to memory of 3948	4576	msedge.exe	95
PID 4576 wrote to memory of 4572	4576	msedge.exe	99
PID 4576 wrote to memory of 4572	4576	msedge.exe	99
PID 4576 wrote to memory of 4572	4576	msedge.exe	99
PID 4576 wrote to memory of 1876	4576	msedge.exe	101
PID 4576 wrote to memory of 540	4576	msedge.exe	102
PID 4576 wrote to memory of 1876	4576	msedge.exe	101
PID 4576 wrote to memory of 540	4576	msedge.exe	102
PID 4576 wrote to memory of 2464	4576	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://email.corebts.com/trk?t=1&mid=NDYyLVpLRC0wNjQAAAGkc5FDDBAir_iWK59yAUB1mCko9GPwYQu-heRzr2H2vH4NQ9IUcmiDCw4b0pyZXhmkyrl2-ShUdwajU2YcHnvpyXmpbqptImVgDL2XNZk3ymENGU7CnZpxn96EzwxMtwzzCzXKshkBtLOw4Q
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9c411c188,0x7ff9c411c194,0x7ff9c411c1a0
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16624969154524982162,12712631813177435496,524288 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,7750497101702833986,12610303397433276352,262144 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,8640796893749380286,3531798291100298166,524288 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11265185023630509372,16329904833230711618,2097152 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13245263774911603676,3601264398959063830,2097152 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,10758334249953616371,3980430003344888568,2097152 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,4576752100415553609,3602296177623647002,2097152 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,8005705761384836158,7151265101332583405,2097152 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,11025232930685259493,17061241183649663395,524288 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,4735217849963434722,4946560047675938417,524288 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5006934711668533888,13081790143209797432,524288 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5006934711668533888,13081790143209797432,524288 --field-trial-handle=2924,i,17282629812001051683,12745606525314018099,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 56762bab2743539c78535c86c522331616a06a9d106eb96663f8613bdf33f63c
MD5 593fc8a0cffa5d81410f5b4179fecf06
SHA1 a33ab737208a3572aa72cba787495a689c82dee3
SHA512 13272fce41338c1155466110d6574cedabbd97938dc6cb3783b37d1512b1d58a7a08045fe169c65e31e71ea138f47a9dd2b6909de8e4571cca645186f9834d9a
SSDEEP 192:sxZoR5WM/fZslnIdpKhHW6+WNzYA/YYBgH+UIgrJ:sxZoeM/fZsloGHbv/fsd9
TLSH
T15D22A6556E38A57B8CCBE20DBA15BF13E6FD503251D01E98AAFC861C05E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8099127323757921835efdaa5ab0d2a5053fa5dc941b673f6820234f020dc59a
MD5 3be48f205df2f9bebbeddaac0885a813
SHA1 296b42c91ac842b0218569e4fa21e1b3e8c72e31
SHA512 0d1ce02a3acf156c87a300e229efa5e6660977ef07302464dd23fe643985648c67ae9c745b9b9b0ed21358dd6644ebd29d1719f2a3430a5070cc3d8127a69368
SSDEEP 768:cByYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXzropwS2r:cByYR7jWv3NpBu1ja/CL8OXAi
TLSH
T1DDC2E92F640DCB7E4FC01A9DDC5A6F9B2EA802C7A6548D4047FA944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 12b84897e9379776b55e7845d9e8020181ea32bb9d654af95062d3c1f0d1e4f4
MD5 1915f7354103e58dbf7e626721c1ac70
SHA1 651456b1be99564884445fd4b3d73e6752da4262
SHA512 679d896b39a9c3e48f4db49a28ccfcab1dad3d86835eaea57f3864f5a434defff43e244fb7f0ab89fb4416934181fc40477b20932e2b5487c1fca7930fae5aac
SSDEEP 48:KgjGnDtFVWbFIdISDWK9z1hWxrGYQxjHyLxgNBLPTsbfq3ISZsK95gEIvKFmMfyN:KoUYKxayaSwKrgEAKFmeOzyKJ
TLSH
T11391370172BF0211397F2498C1B49B1E574531B73198EB6BBF7801A25E2BE186DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 58bff6d5223c5e24a3f5c634d68bb9f379ace5ac76121142c2754f6fe92f4138
MD5 40c1245b12b4fd0abb26b43267857aa5
SHA1 1dd4de81f1b800770c085c8cef1b6b2484399e29
SHA512 15c654cc0a66876a2b8e3e36f5a9aa8b08bead0cdb6c05b23fca7a2db8821dd59e3d50cf0c969af9ad032d389df350bebe0da744b7fe7c03e3e199b1156ca1ea
SSDEEP 384:8ZcIhsNFUzJRi3CZQX5+Dtv8XLFXPJrvQhtgOIwZOyPoN:qhvRXekDuRPhvQhXsmy
TLSH
T1DB828E3699B8AD7B5DFBA141B48632134FB85027D6C8ABC0D5FD5B1D00D95A8130BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55b5e857e296f0ad14973848bd48c2e637acf38b49c2575088a5e012ef439a4c
MD5 e00d296a61384f0ce99bdeef4139580b
SHA1 57b2e8c373ee31a8de00f2106fccdc96bda5b8e5
SHA512 8f7896637fb7db85342cf5b58de7817ef88f5976c9f1631f6d4b047e1eab5e9f5a5526c38adff810735be3d692a7270668dea4589cba5bc70066abe4ede29dd6
SSDEEP 192:EONw6nnHGQmiUyjVQYcX5hQDP1HjzorMoLCMcazU6:EONw6nCmQNX5+Dtv8XL6sU6
TLSH
T13302D935BCB87CBB8EF3AD46B48627139F95212BE5956B80DAF81E1C00D765C2306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 84a3a064e6da9170ff7147ef294f61b6e8bb4336c3c7237f9680f71b63860464
MD5 67097085f5edeb8a23901b6347c0ba9b
SHA1 35429870bb7a62c9baacac00781385d0b20770f2
SHA512 3e0b286615273453e1bc410abd324960447267d197033d2e75854daebe338923228125e571cdf5e8393ebb500d48941c83c7a4ca907da8702248badf15f4db55
SSDEEP 192:EON/6nnHhQmiUynVbYcX5hQDP1HjzorMoLFX4SJrQg3ur/5hU6:EON/6nfgbNX5+Dtv8XLFXPJrLQhU6
TLSH
T17B12EA35A9B4AC7B5EE3A595B08731239EA45117D6897BC0D6FC1F2C01DFA6C630A833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35379c94957030e15c686b30ee8574ddac3df7550ba18ad73aab449aeeab7f0c
MD5 0e3f635a4246a575c56388b13fc32c30
SHA1 276046d37654afc6475b5b85edfb62a487c6fb42
SHA512 c1dab95d99fb8ee9edcf9cdd5fae753c9f0449af45aa36bc8fc6a507058403979754c5b4b8f3064e6aeb57e021496e449ec0a9906e145338584d3bb85638b581
TLSH
T13741479CA6FD1148B3B76E5A9FF6A46D447FB8372E06C45E00110D4F0A62F40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads