hxxps://helpdesk[.]raveis[.]com/packages/hd_attachments/Re_%20Sally%20Sells%20Westchester%20Newsletter[.]eml[.]76c691596cc549e45fa5f3fe154f504c

Analysis

user interaction
yes
max time kernel
0s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://helpdesk.raveis.com/packages/hd_attachments/Re_%20Sally%20Sells%20Westchester%20Newsletter.eml.76c691596cc549e45fa5f3fe154f504c
Sample260925-rqrypstyfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3672	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 4552	3712	msedge.exe	87
PID 3712 wrote to memory of 3672	3712	msedge.exe	89
PID 3712 wrote to memory of 4408	3712	msedge.exe	90
PID 3712 wrote to memory of 4408	3712	msedge.exe	90
PID 3712 wrote to memory of 4408	3712	msedge.exe	90
PID 3712 wrote to memory of 2196	3712	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://helpdesk.raveis.com/packages/hd_attachments/Re_%20Sally%20Sells%20Westchester%20Newsletter.eml.76c691596cc549e45fa5f3fe154f504c
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd5092c188,0x7ffd5092c194,0x7ffd5092c1a0
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,15817211307319073601,9935857277965389103,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,11273202176217750560,11400274831015577290,262144 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,13790930359713573645,15946955726951940875,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15833437071883858102,4777623390085059190,2097152 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,979514321141923240,17798123059594082480,2097152 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,15093771555896493719,2559788501272662100,2097152 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14774772090063591736,3321520503701943948,2097152 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,12251272904811551170,12333698073585733374,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,769820832467414490,8996169882438898290,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,10374651744646632222,2841262864847490605,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5476,i,8204006657588377530,7595221375374585147,2097152 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10969115674153916597,5294266539733011190,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,5057887158738557023,14464251894302381640,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,5057887158738557023,14464251894302381640,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\Downloads\Re_ Sally Sells Westchester Newsletter.eml"
  2⤵
  PID:4540
- C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\Downloads\Re_ Sally Sells Westchester Newsletter.eml"
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,648858956702459873,3172575427205582663,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,4036370247298168483,14126374978501102335,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,12226564768058508748,9737812335408223081,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,7573526805466612753,9515414804681651269,524288 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6672,i,10397382311970191406,201630973232819914,262144 --field-trial-handle=2300,i,4718147374211005887,2522631493908944309,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

9c46dec8-1449-4e79-bfb1-b2c6bfa52562.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c46dec8-1449-4e79-bfb1-b2c6bfa52562.tmp
Size 9KB
SHA256 9205da02a9656b7a2f7966813aedf7dd5a4a8f42b97ef8362838e14b67285fe2
MD5 a891f5aa37b57cc7528b670d1bba95ee
SHA1 01ab8b692bfb5c94918ec70d0bc6185ed6a8086d
SHA512 2d51ed29d1922c524fd0df17cab4eec1d3f3883ee01d4324778ae6af5beb399c732ba5d6fd18fe22543c3364b708e89b5e0fd67f7966d465774f5255f982b8e2
SSDEEP 192:sxZyMRxnw/fosyOoIdpJHW6+WNGY36r3NIg5QJ:sxZyMDw/fosyOZJHbGXlG
TLSH
T16822D8156E28A53B8CCBE20DBA25BF13E6FD103251D41E58A6FC9A1C05E66DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8f7b47d8e697ee88e8cdd3b1627a6a0e05937e9b184f7d402278ae2bc00f2882
MD5 531d6d616896cfd3dd1cf6bef3d6e43a
SHA1 7e10a0115ad810b1c2cc04b5731b625dc9fcebe5
SHA512 c2bb62968b459ac86618bcced9a2f39dbc1fb7dd1b2cc3bc593785332f77c7adf34eabab88d447cabc38b272342d2e809f88993e0f495133e4b0015267998d6c
TLSH
T1AF515070DE6080A8FF9941BA95D01DBB363677A024739F3B1EBCCAF859367D949C8046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590a37.TMP
Size 2KB
SHA256 ae4f3c73d8aa3e8b9f1043eff06a9d8b4105147cc6ce08f0702295e53ca29398
MD5 dd3884c8dbc4b71d09c676958128706f
SHA1 0c0d0994d4a7dc920f9e89e1098d12764e31af2d
SHA512 a935af8feb00eb03e1a5dcff70eb238cf66f5f3bd79749eefca6e8324a133d89f1147e56b9e6be57404602a41e08aa9e5d28bf1581a211083214ea912b1a2549
TLSH
T1BA515170DE6080A8FF9941BA99D01DBB363677A024739F3B1EBCCAF859367D549C8046
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 69ad5a6385e8b357eb061550b6d45417abbc58f97db74dbc8cd15fa39fb08862
MD5 95863ba127fe04090597961cf4306efc
SHA1 14affd54b47d0efd90fa17d7c9ea5a0d401ada44
SHA512 9113654a26e3c094dcdd01447e77f8718739ce34996aa2015d0e2302ec86555b6322f9c2a590195d7b8a5aa1e9fd6bf1f874384f804d0e1444bc4534388b30d3
TLSH
T164019CB7C3E4996E8A1056F06A18AF2BCE2D0646831C7C1AC5D4AF2BD3E3475E00189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b732994ff17742e3788667cd41af4f84aedbecf8ca77ba3ad5686c09fa8a2575
MD5 316aaedd8d01e0c5fe8cd99c6bf3d811
SHA1 897b5f6b7de116459cd2188693f13f2f9a2ebf48
SHA512 acb404756c78e85d54fb3b94a74a7a7cdf3c48e6725daeb576d239b6522df984efa95318198c5f0ae41868b4ad01ee5200c8ea93ef282b50fe8e98c44ce20aa2
SSDEEP 192:sxZyMRxnw/fosWOoIdpJHW6+WNGY3643NIgrJ:sxZyMDw/fosWOZJHbGXA9
TLSH
T10B12C8566E28A53B8CCBE20DBA25BF53D5FD503291D41E58FAFC961C04E66DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 85613de23737f5a75e6b56441ee43e494a421687ec90baf0a27a4569bde7c3d2
MD5 24af4357483b4282db10ce70cd6ccefb
SHA1 e6a57e9e9eae0862c301b31f2aa2b22ee0e70c1e
SHA512 048d615217e2e8d3302b4824194700a20de7fd1011dc67c034cb65f13a8abf5d20a7c1dd5d0ee692978f71375639fa2989c2b95d9b5e4a755f3c3280c4b5564a
SSDEEP 192:sxZyMRxnw/fosy/oIdpLHW6+WNGY36hx3NIg5CJ:sxZyMDw/fosy/ZLHbGXhjE
TLSH
T16122D8566E28653B8CCBE20DBA25BF13E6FD503251D41E58A6FCDA1C05E7ADD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 46ae946689e5553c031f4a28a7e6d9b6cbd9324117eedce2bff1faf90f109941
MD5 e309450eb6d3fc748c1f59467078914a
SHA1 03a6ad926815a238a168980b82621e3d25c6995e
SHA512 43471e208574957926844dc8d70ea5b3e480a09e7ba287cadfe124c0d279b5ad1cd1d20d6ec40bfc8cf5b1440785df0cb9a4192371bf59c32b52fb588438c125
SSDEEP 192:sxZyMRxnw/fosy/oIdpJHW6+WNGY3693NIg5CJ:sxZyMDw/fosy/ZJHbGX/E
TLSH
T1FF22C7566E28653B8CCBE20DBA25BF13E6FD503251D41E58A6FCDB1C05E6ACD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bd26fd478e0cc91b7532db7fbb4492470df35104148c2adc8c77e3eba7675ba8
MD5 45175347ad8d57a81c9779e14f24e1ae
SHA1 ffee9625bb9599b25ed64226cf1730b906c49696
SHA512 7b7950b52a5bd0c5265a44c8a5c98cd1b276977a7347b2dbf1d06d40d2621a83bcb27bc62a732f87c6d9b63e1f4596756053b7a627f183fce029506a90d0c661
SSDEEP 768:8uKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/Aro/o2:8uKlm7QWvUYe0u1ja8/L/E/L/P
TLSH
T1F0C2FB3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ce43783b030cef34cc627794a62c9dedd3ade831d0453aee3d058deb1e6e4bd5
MD5 beac2c225efc9bfdfe1e422f4b814be0
SHA1 00168b6e8dfda91bfd28c878d7b2f5a96ecf5ecf
SHA512 3d135076be80fd8d6108b70cb23a9d54c92489f6ae3cbb07695d0b515afa43d6761f54964a4daf5905c5fb073ece88e116ed26f25394e7f5c54216cbb2c58c29
SSDEEP 48:K0HqTnpJZybRcBIS3yK931dyx3iYUFn7yLAPGKQ6uvbG9mISivK9+1Evx4/YF2e3:K8Y4KBm++HiKocL/2KQwGicgKZ+F
TLSH
T184B1ED4130BB024439BE258890B1975E52423173355CFABBFFBE00A68A6BE545DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a57d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a57d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a349ab81ab38fb349d5b2ed328053962ba0a45e232fce221394d35fc316b07a3
MD5 2c980f94d0cd759db0b796221f127430
SHA1 2d6708887c007351bc2481571d44f54743dec112
SHA512 3b154f3d2b26ea009f8d00aa8a2d7aefc4cc531a7939fe024890c066bace0e5d747b3e6c84cbb274275bd9f5ec087943a65f1b043a1c0e0b3bfe93f7afc788d5
SSDEEP 384:yZcIhsN+WebmCNXh//kXxYoDBtgOIwZOyp2oK:Ah5NR/cbBXs5l
TLSH
T111828D36AC389C762CFBA241F5873B034E788467D6D95F80D5EEBB1D01DA1A8031BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 1fa160ee382c4b4246256388aa20e71add831f8c2cdfd9c51d4a016773d9bb4c
MD5 ca85e8b1ab583352d073a5bfcd764f51
SHA1 54b48be0f846ad23ff8fa07dacb28e8d3c73ad84
SHA512 d2b79bfdd46b57e7d9a6d4fb8fccc8b9ebdaef96cbf331a9d239ac05bf8764d2c7e9921be815a27da571ab84a5207646cf4cd8142406216b0471729ed09e6007
SSDEEP 384:WiFYZcIANsNO8TUNTUlIlxebzCNXh//kXxYoxBtgOIwZOyp2oK:9Fm6fwgFNR/cJBXs5l
TLSH
T150A26D379C64D97A7DFB9B84F58637038EB440A7C6D5AA90E6DDAB0D01DA0D8030BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5950b3ba68a68c16c8e528d72856c8886c4a1ff9e7b6a285ffaae2c5b82cf1a8
MD5 96f875d71ed975716a22469d7fbf3e7d
SHA1 2d7cd0493c8158480bcbeef709d1cf82eb66d071
SHA512 5f71e311e4552c049f1c11b37e87ac6bfca7d885361d1bcd3f6413d0816aea1c84d6d826a6d28fb6f8fd37da054a28dca4873935624e36482998ae44eab993e4
SSDEEP 96:KqONkvQsjpfbUmjH5ih/cIPURHl8h4otop50aDaBKP4v+Y1xf//ojdpxBY6ywMdF:BOND6JUm0QmiUy1Kso//gyweBCn4U6
TLSH
T18702C739BC6878778EE3AE45F0877B239FA4107BA6951F44DAD92E1D01D755C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9460a01afcfbb1aac5a9aa0bb03e393b21becf66f4e15598e3233f7e32bb0d69
MD5 8879f48f338693e0e0a29bc594e31317
SHA1 139a344ebccc176eb31c4bc5939f00bbd8b2199a
SHA512 9b42abf5e106c5abf7d92095ceef4086eb58b13909c41e0d92ec83eced5147af6030533e15565026ee55c366472e8fbb98cead6fe39d6aa075e5a94f1c61032f
SSDEEP 384:oZcIXsN+yebzCNXh//kXxYoDBtgOIwZOyp2oK:WXYNR/cbBXs5l
TLSH
T1A4827D36AC389C762CFB9281F5873B034E788467D6C95F80D5EEBB1D01DA1A8031BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 25283c41898c1cf822c375c69c581ebb10d810a8a5cdc96918e29233283b358f
MD5 7eea55ca4c1f54836875f85be0a71a87
SHA1 2a08bab3020cc049f9e73254d202e6f5538d8807
SHA512 36f3e34f958b95037a01fe72cdd373e51af7c100a81e0104bf317ab4f0d60c5f2ec6f2a6f607ee3bcb9d0e75717e8ce00ceb0f93cd88011262ef018f2b520a9e
SSDEEP 384:LZcIXsN+xebzCNXh//kXxYoDBtgOIwZOyp2oK:TXFNR/cbBXs5l
TLSH
T19C827D35AC389C762CFBA285F5873B034E788467D6C95F80D5EDBB1D01DA5A8031BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e64951bb7b11dc67024c932389218873b6e3e36cfd84c29ca1e0522edeb9ac08
MD5 b85bd554483bcfed9fe55c7e89802e86
SHA1 907450b230d4427d507173c0165e77f2ab73c4ae
SHA512 9bb9f0ea43c81e4dd533b16dd90656e21481aba3f542c6024918854b07b1f1468a0d5549b6954b1a4c05c28c7fcd95841427391f9986b2b4e7cabea8762e2be6
SSDEEP 192:BONn6JU+QmiUyYWKlo//gywXFnPwotNxz/NU6:BONn6+6F7lo//kXxYoVBU6
TLSH
T11012F835B868AC7B5DE3A594F08336139E644167EA856F80DADC3F1C02DF5AC530BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c15eda8b-d0c8-408d-b95c-95d05d3658be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c15eda8b-d0c8-408d-b95c-95d05d3658be.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 266b5399263c652b117d9862f0f33c7e876dd1b0cf6693c6ee9e727b1ebda8a3
MD5 d42040111c9127afb0358792ff2bbb2b
SHA1 3e0f7e02a8639b032929ac0af4d28188add4d4fa
SHA512 ecbeed1c90e27b714a5ba680f4112ae7312b8997559e0553011668757f06cd969bc306efd0e9fb11a0bdb743a150d14251c9b1b12d8ec209260e2cde003cab64
TLSH
T187411858B6EA1148B3B77F5AABF6696E487F78772E06C45D00100E4F0A23B40DD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 89e39986f6e0bb54d7aba4a8b6cd44b7e7fcc790470ae407d4e0492f96a447de
MD5 3a96e388472058b6cebe7feb507ea7cb
SHA1 e141802bf2c60120dcfe7f0be5ff7ccd0c43db86
SHA512 6c6eaf971f5fad91b9f3cb5ab691bee226a3396e6cce2f36053fbb22a37ab3527603878a869319bc0d4cf16e86924f5ebdc37999d9f69df55826dd81feb3304f
TLSH
T1C8513B5866E91048B3B76F5AAFF6B86E487FBD372A07D49E10110E4F4A23B40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Re_ Sally Sells Westchester Newsletter.eml

Path C:\Users\Admin\Downloads\Re_ Sally Sells Westchester Newsletter.eml
Size 4KB
SHA256 e57a0afc8639b213b8b29cb96467375c781baa575cf916062db32171801e146d
MD5 76c691596cc549e45fa5f3fe154f504c
SHA1 07c22e25da8eca479bce11df2e162c84f3cbc988
SHA512 5f5a6c41b17edfc8a8881fae2733431c536b6cd5a1b40aef792a0d9026b8f6d7db2b461c79dd20d6bcb01583f49acc9cd762d5e08389d14c0729a8deda20397c
SSDEEP 96:G4wlyIH4/Y2JuKHEn4Kx4fTFxLTP4unUhEikdAzlpvH667naFp6:Gxvg9BfPc5YwnD+Y
TLSH
T1D2A14C50D1AC0C1427C5ABEC7CA27C6508863CF2EFE6F1F988F76178258975E836E568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3396-209-0x00007FFD2A1E0000-0x00007FFD2A1F0000-memory.dmp

Download

memory/3396-208-0x00007FFD2A1E0000-0x00007FFD2A1F0000-memory.dmp

Download

memory/4540-193-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-231-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-233-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-234-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-232-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-194-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-195-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-196-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

memory/4540-192-0x00007FFD2C7B0000-0x00007FFD2C7C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads