e38c53aedf49017c47725e4912fc7560e1c8ece2633c05057b22fd4a8ed28eb3

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEPlus.docm
Size 17KB
Sample260522-pc1ycaav6k
SHA256 e38c53aedf49017c47725e4912fc7560e1c8ece2633c05057b22fd4a8ed28eb3
MD5 c16df0bfc6fda86dbfa8948a566d32c1
SHA1 610921e6f95843045fec4393c088dd1f896a6571
SHA512 461ae0e01189f0abcd2b3ecc9b80743e023e726eec7ea8ac95778ba97d0166965fe724d38e6f19ce4e1787a93982de100934b41a2972b886e5f8c29c7f4f0f65
SSDEEP 384:Xsz8ND9/dxdG5BEQjNxt/ZtNN+n222UhfFN1NKeVQ11NXHEHre8RK:XDVEBRZxllNGZfFN1NF0HOhRK
TLSH
T138729E3DD1487430EA93A67C500F26F1F261D183E4527D5F3926FBAE9BA47CB071A488
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1856	5108	powershell.exe	79

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_384133580\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2880	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239255247296688"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{AB669E1E-064E-4645-9A3C-A07B8F69D055}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5108	WINWORD.EXE
5108	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1856	powershell.exe
1856	powershell.exe
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE
5108	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1856	5108	WINWORD.EXE	81
PID 1856 wrote to memory of 1140	1856	powershell.exe	84
PID 1140 wrote to memory of 3400	1140	msedge.exe	85
PID 1140 wrote to memory of 2880	1140	msedge.exe	86
PID 1140 wrote to memory of 4748	1140	msedge.exe	87
PID 1140 wrote to memory of 4748	1140	msedge.exe	87
PID 1140 wrote to memory of 4748	1140	msedge.exe	87
PID 1140 wrote to memory of 2844	1140	msedge.exe	88
PID 1140 wrote to memory of 2844	1140	msedge.exe	88
PID 1140 wrote to memory of 1880	1140	msedge.exe	89
PID 1140 wrote to memory of 1880	1140	msedge.exe	89
PID 1140 wrote to memory of 1880	1140	msedge.exe	89
PID 1140 wrote to memory of 996	1140	msedge.exe	90
PID 1140 wrote to memory of 996	1140	msedge.exe	90
PID 1140 wrote to memory of 996	1140	msedge.exe	90
PID 1140 wrote to memory of 4828	1140	msedge.exe	92
PID 1140 wrote to memory of 4828	1140	msedge.exe	92
PID 1140 wrote to memory of 4828	1140	msedge.exe	92
PID 1140 wrote to memory of 1436	1140	msedge.exe	93
PID 1140 wrote to memory of 3260	1140	msedge.exe	94
PID 1140 wrote to memory of 1436	1140	msedge.exe	93
PID 1140 wrote to memory of 1436	1140	msedge.exe	93
PID 1140 wrote to memory of 3260	1140	msedge.exe	94
PID 1140 wrote to memory of 3260	1140	msedge.exe	94
PID 1140 wrote to memory of 1784	1140	msedge.exe	95
PID 1140 wrote to memory of 1784	1140	msedge.exe	95
PID 1140 wrote to memory of 1784	1140	msedge.exe	95
PID 1140 wrote to memory of 4240	1140	msedge.exe	96
PID 1140 wrote to memory of 4240	1140	msedge.exe	96
PID 1140 wrote to memory of 396	1140	msedge.exe	98
PID 1140 wrote to memory of 396	1140	msedge.exe	98
PID 1140 wrote to memory of 4604	1140	msedge.exe	99
PID 1140 wrote to memory of 4604	1140	msedge.exe	99
PID 1140 wrote to memory of 4604	1140	msedge.exe	99
PID 1140 wrote to memory of 3152	1140	msedge.exe	100
PID 1140 wrote to memory of 3152	1140	msedge.exe	100
PID 1140 wrote to memory of 3152	1140	msedge.exe	100
PID 1140 wrote to memory of 3052	1140	msedge.exe	101
PID 1140 wrote to memory of 3052	1140	msedge.exe	101
PID 1140 wrote to memory of 2516	1140	msedge.exe	102
PID 1140 wrote to memory of 2516	1140	msedge.exe	102
PID 1140 wrote to memory of 3408	1140	msedge.exe	103
PID 3408 wrote to memory of 4576	3408	msedge.exe	108
PID 1140 wrote to memory of 3584	1140	msedge.exe	106
PID 1140 wrote to memory of 3412	1140	msedge.exe	107
PID 1140 wrote to memory of 3412	1140	msedge.exe	107
PID 1140 wrote to memory of 4576	1140	msedge.exe	108
PID 1140 wrote to memory of 4576	1140	msedge.exe	108
PID 1140 wrote to memory of 4540	1140	msedge.exe	109
PID 1140 wrote to memory of 4540	1140	msedge.exe	109
PID 1140 wrote to memory of 2588	1140	msedge.exe	110
PID 1140 wrote to memory of 2588	1140	msedge.exe	110
PID 1140 wrote to memory of 5276	1140	msedge.exe	111
PID 1140 wrote to memory of 5276	1140	msedge.exe	111
PID 1140 wrote to memory of 6136	1140	msedge.exe	114
PID 1140 wrote to memory of 6136	1140	msedge.exe	114
PID 1140 wrote to memory of 6136	1140	msedge.exe	114
PID 1140 wrote to memory of 5640	1140	msedge.exe	115
PID 1140 wrote to memory of 5652	1140	msedge.exe	116
PID 1140 wrote to memory of 5668	1140	msedge.exe	117
PID 1140 wrote to memory of 5980	1140	msedge.exe	118
PID 1140 wrote to memory of 5980	1140	msedge.exe	118
PID 1140 wrote to memory of 5980	1140	msedge.exe	118
PID 1140 wrote to memory of 4052	1140	msedge.exe	119

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CEPlus.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe start https://plus.cyberessentials.live/macro.php
  2⤵
  - Process spawned unexpected child process
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://plus.cyberessentials.live/macro.php
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffadb37c188,0x7ffadb37c194,0x7ffadb37c1a0
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15216267044023270707,9551493826912244854,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
      4⤵
      System Time Discovery
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11591656460590210486,2813915366294390597,262144 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,6399034619426535762,16974934372462851800,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5597873743698133732,968174277046401983,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,15620416169080403352,7394236882107514354,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,16564245090764860277,2308016042893189668,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,11929120069766005981,14769730549105031961,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4388,i,18027805142102872613,14718156044176593949,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4400,i,11672787109794641998,3330849815807336333,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,12071229130100240641,3617954885987686984,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11245505139826815861,16632293722256124414,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5460,i,1964004772574360293,17907825115949939662,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3952,i,11268702134236112399,8874369322597823777,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,2338215659124695252,5336016961014322095,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,6854931169587077860,3208248246204399900,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8778955709357007039,6946205003625988976,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16304172130534564863,4137049681545500106,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16304172130534564863,4137049681545500106,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11560687675662157209,15142346481755805496,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,3670208607765940218,6045859930127503575,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,8457059784363431461,15174619255968409966,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4011003067900316728,58067761099215252,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,13482592125702849554,13893020404821553725,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7040,i,15008663098049113531,11952684438179801085,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,14163102752838976668,11331448595092091586,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,712345040737064745,3401441166530387707,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,13385814551995321035,3737238560221567359,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3128,i,3190854925202249489,4176526900559590924,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,17120244721873418436,14430814353486024979,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=904,i,1453642801831409000,17029746719529509024,2097152 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,9296300695681886014,13833791880428740517,524288 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7048,i,7728973928089111228,8098074928832647175,262144 --field-trial-handle=2212,i,12585003694408842700,572386405860560977,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f1e7f5c4c953bda3471939c2cfa05ea0d7c12163035878232bd98602034f540f
MD5 ec2f367136389ae85f2d764412d98f95
SHA1 af17dcb73cfbee095f25bac9944946ba7f596b32
SHA512 6bcf2fd1682af5ce3aa0bc873e26873f3532db19a77e484131c1f9ae92817b6fc116a1d9c802f54bddfc13538e47e93f83f18adf51476c422644c8b86e1eda97
TLSH
T190611FD8C99E88B7E3302AFFD8D1720AF572456D0AD7BD463CC058BC7206B65431D465
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e96eb9611a522364f4f67e03dedbb5021c40edf7fbeae4d19909cb10492bd71b
MD5 6570c07345d6f14bebbb9e3b2a8e8241
SHA1 72e70ff60a8dbfd230da42e1583523492ec6397d
SHA512 eb0d84092f102e402f735c14e5029fb934678c61f35ebc56f1ccc5fb197a21156def7bc9af3b8031de735e4a40f8bd94d6c624dd2cbc32a24e40b0de2bc0a3db
TLSH
T1E9418BF7C3E8856E890156F0BA187E2BCE2D0A14532C3D5AC5E4EF5BA3E2871E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7ea1eaf5a34cd02880db371a0e656df2d24b42ccc1680253cc6f093d748cba73
MD5 a8675752f161c5f94de016753848d74d
SHA1 72b1a4271503476c059578a6d89b113c2d5bda91
SHA512 d2510de765c6be70b76803fbcea44b3f25d7ef22387b7c974e579ffd1fb1361ca3ef48a3e467e8114a9da4f447de7afae2ef07d70d98a467112037deee456fc8
SSDEEP 192:sxZcRfyM/jK1Ml8Mck/fpsOG+LxXFnIdpCS/W6+WNGY0ae6NQfkIg4J:sxZcr0k/fpsOG+LI9/bG5Uc
TLSH
T19052F906AB34597BCCCBD209F655BF53D6F8547292900E44AAFCCA1C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4ef726704dfa210271762a1f84f2673d68d1bb81e9be3f734c02f4f7cee725f9
MD5 5a2d8bc404ddcf3462a971b0c9e032d4
SHA1 5b9125ba1e8613fd77fda74a9f0837e130fc3805
SHA512 61309cac2384ab2c717f160ff8d246e5a836159d662e6cdc15f0ef228d1f7e11caed20e93fac77dd2b7c4992c989670fda70a76da4f8aac44792f7c1eb2acdc6
SSDEEP 192:sxZcRfyM/jK1Ml8UQwck/fps3G+4xXFnIdpgS/W6+WNGY0aemNQfkIg57J:sxZcrqPk/fps3G+4Ij/bG5wj
TLSH
T1B2520916AA38597BCCCBD209F651BF53D6F4547292900E44AAFCCB1C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 a03e2058178072d980b4a46abf39cf65a1d49245205cc26aa7861eb195310637
MD5 2e0ec2e3636a4d6cfe452a79ec6fd55e
SHA1 aad80ac4249994a27adc44a8a0f3a7ff65c104d2
SHA512 0e526233a4fe9a86ac6078d9c2bad990af524780e57812f43025f4c5e7007f882c6497e4fe135da04eb5d93b390c2cd9d9a84965784930ed352b8548797b4da9
SSDEEP 768:yZ/zh8dF2Y57pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eQ0jLl3:yZ/zh8dF2YPEXEkWRmEcQXwu1jaKeQ0B
TLSH
T1D4031B3F280CCB7E4F844E9CEC2A7E9B6EE8018B5698895447FA884C03C66DF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 713439619d721a4ece3aa7cdfecf1626f8a09e379d9e83ee9f76469158548dfd
MD5 141490b103f3d5831239de7dc26fdf6c
SHA1 86ad9858b0d84dabbff30953a5744ff39eab29fb
SHA512 ea2f79f3d23feffc4604dc5c9909e101989ca985b8b066ecbaab7324f1948037e928cf28bcda83619f7b820185f416ede76352b59ba614a505b63ec1160b0a95
SSDEEP 48:KEWIHKvLyI/K7SszyalIH7lX3xqbasIVDxKY4AFx0Nh/CD3Sy9lIxKGk8d:KEWgKvLyYK7SaqOkKfKa2l6KGkK
TLSH
T16EB1F14771BB13423C7E6548A3558B260B4179733029A52B7BBD44B20E2BE385EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d810a17-ea4a-4b0b-aace-4beb3ac9e656.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7d810a17-ea4a-4b0b-aace-4beb3ac9e656.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 62540d8b2f846e8a1abe1f680cc3b8d9e1256b3409c8272c15d11768e8793f8b
MD5 b5cb9c0e0a4bc502ce49c8a25c8c4117
SHA1 e3eba83a640fec6a971c92c717a58a2f23128282
SHA512 0cb6f2759f6f8be2113b5b625d11e962da523c021e8d8ec86b8cc57294d10f71fbbcf984268dfc3e0226e16a6264ff1fb09ef1f8ff1284c7c5ae42cbbdb36ebe
SSDEEP 768:cFMjZbMewg83cacNnGJ8uA1fsxO0IFW2lPJS4:NYRFkax2jS4
TLSH
T16DD2F8F198D78977D96E8783A73E7E425EBCD0A3B8841980B7C85A0DCC471BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dd18a37b082d28fde7b59809a9f031e68f3fb78e4d2c44c138ee2de860ec417b
MD5 e780e74951da1a06230507086771f1e0
SHA1 905c447a4ee0a82fdef347e05e506b2a74275a49
SHA512 5161ea138b4784c26c0d63be5d0f05598e4ee0e376de64bd07d169522afd8e7f82c49ee22eff868dbe8fa8c5bc8c7791ddd60050e73a22f50438b3ce2efdb9f5
SSDEEP 192:BGNy6P2UOcQmiUyYIUfqGv0qofO/sKwS+iU6:BGNy6eXsbIYqGsxO/bJU6
TLSH
T16802D939AC786C7B4EA2AD45B98777175FE8107BEA962F80D6D41F0C00DB64C2347936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 65222e9711cfa550e410702be493d591e0235779250a0433a451009e9e96a821
MD5 93b70ae7188ae8cf569325229f6af0d5
SHA1 11ffe9cdc148531ce8966b93a06fe3eb6b06ce6f
SHA512 5fc92d69d34fc9a704de2c460c1bd6d5eeb61f9e0640cc9c743b5ac87054e22dfbe8937735b862a053d6424a813c124686bf1049ecae14bd3fd852854c80dc40
SSDEEP 384:nltNnNnb9e8Np+UW3caupzeGnsxO/MKVXkWhg2GlP7VS4:ljZbM/3caPasxO0IkW2lPJS4
TLSH
T1C9926B756C399DB79DA79446F41773536FB860F3D9842E81E9C89F0E009B68C330B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f2b7880306dd939e8b8fd3b9971f5ca580db2070b8e9f2879f50a5be851f2685
MD5 38f16ce6770d9007da8df11775c49433
SHA1 f8fc40ae569baa7e1c2197b4d16f23aa0e789bee
SHA512 d78c35b9708372d926ebaf813d2d0d526c6d5888009c96f95710d04b53bbccec130afef8b3b5c5e220f5293ea68ee06857b27ce346562dc4dd753bdb3a1b6818
SSDEEP 384:nXtNnNnb9e8NphUW3caupzeGnsxO/MKVXkWhg2GlP7VS4:XjZbMi3caPasxO0IkW2lPJS4
TLSH
T12F927B356C399D779DA79446F41773536FB860F3D9842E81E9C89F0E009B68C330B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e01080917c54341fde768e152510cf5c000094d57bf2108d1c1af6accf664a4e
MD5 9989f4646e08b04d1f4b1f1b3c425685
SHA1 2d1b02f5465f905669f18543cd24c85e6474db7d
SHA512 d869de9b81decaaeee628ae318f778f9a2014bb0eee9c2266b6d2a8fb2f459386afd373f3f9bb8f6643589faa523e79d2d8c4434fbbf7ca90162674a9ffcd7a2
SSDEEP 192:BGNM6P2UUQmiUyWEfSGv0qofO/skoBL+VXF0Bn/raU6:BGNM6eD3ISGsxO/MKVXaWU6
TLSH
T1CC12F779A8689C771EA2A445F88733579FE820B7ED866F80E5D45F0C00DB64C374B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 49fc6636a313e357f5f28c1bfb469dfd76990d759095518d5414982fda13e58e
MD5 b23080689648bd83ab2c07b909f3e26d
SHA1 710abf0b249307ae2a1e9d1ad4d16bf7f3a00f47
SHA512 fde49c5d680ae6f3bc947c5bb5655f91cee5ddbeac9226944038753fcc9db8bbb996ac29281d24e5ed63ed25ee7bb088db9dfef3c2e2452dfd39a5f7fc29c496
SSDEEP 384:nEtNnNnb958NpdUW3cauPzeGnsxO/MKVXkWhg2GlP7VS4:EjZb/C3caLasxO0IkW2lPJS4
TLSH
T1D7927B356C389D779DA79446F45777936FB860F3D9842E81E9C89F0E009B68C330B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ba44789a-276c-417a-86c1-04eff5ef2418.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba44789a-276c-417a-86c1-04eff5ef2418.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0037c21f-ac55-44dc-9441-463c09521c8b.tmp

Path C:\Users\Admin\AppData\Local\Temp\0037c21f-ac55-44dc-9441-463c09521c8b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD9F14.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ccisjicg.oj1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ccisjicg.oj1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bf55f822-ce18-41d1-80d0-69b789cd7467.tmp

Path C:\Users\Admin\AppData\Local\Temp\bf55f822-ce18-41d1-80d0-69b789cd7467.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1140_1506972036\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3dae08a2-16e4-4d4c-9824-a9ca08a427c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1140_2000428702\3dae08a2-16e4-4d4c-9824-a9ca08a427c7.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_384133580\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1856-36-0x0000021286210000-0x0000021286232000-memory.dmp

Download

memory/5108-6-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-9-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-4-0x00007FFB0F9C4000-0x00007FFB0F9C5000-memory.dmp

Download

memory/5108-480-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-2-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-12-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-1-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-11-0x00007FFACD2D0000-0x00007FFACD2E0000-memory.dmp

Download

memory/5108-0-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-13-0x00007FFACD2D0000-0x00007FFACD2E0000-memory.dmp

Download

memory/5108-7-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-212-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-10-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-8-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-5-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-1041-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-1044-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-1043-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-1042-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download

memory/5108-1045-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-28-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-27-0x00007FFB0F920000-0x00007FFB0FB29000-memory.dmp

Download

memory/5108-3-0x00007FFACF9B0000-0x00007FFACF9C0000-memory.dmp

Download