Overview

overview

8

Static

static

1

phish_aler...02.eml

windows10-2004-x64

1

phish_aler...02.eml

windows11-21h2-x64

8

AFGRI.pdf

windows10-2004-x64

3

AFGRI.pdf

windows11-21h2-x64

3

email-html-2.html

windows10-2004-x64

4

email-html-2.html

windows11-21h2-x64

8

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    856s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/05/2026, 14:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    phish_alert_sp2_2.0.0.0-202.eml
  • Size 590KB
  • Sample260527-sbb5daay3y
  • SHA256 96ac9dd741ac47fd954cc438566930ffc39398bc1a8c37f3da8fec77537c44c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0-202.eml"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.afgri.co.za/termsofuse
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ff9085dc188,0x7ff9085dc194,0x7ff9085dc1a0
        3⤵
          PID:4780
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,3242802349389504376,3365341163705281308,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
          3⤵
          • System Time Discovery
          PID:3444
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,2191656624597087898,8051688342362093108,262144 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
          3⤵
            PID:4660
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,1889900697619674463,9543235740459331005,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
            3⤵
              PID:1832
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,15255654382938371996,4605532101433197251,2097152 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
              3⤵
                PID:588
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,6100736932884754540,11460062933925155040,2097152 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                3⤵
                  PID:2408
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,10461304311013691182,3114337286594304396,2097152 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
                  3⤵
                    PID:920
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,16627922421813493959,17520517343247660272,2097152 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
                    3⤵
                      PID:1236
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4316,i,14567514458953425653,1810988284002235156,2097152 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
                      3⤵
                        PID:4248
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4344,i,17053926065040913245,14757973457231800510,2097152 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
                        3⤵
                          PID:3624
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16744200709891375972,3382223376958619998,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
                          3⤵
                            PID:4544
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,1749225042900813422,780193172780922004,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
                            3⤵
                              PID:864
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,16078881227283127100,18313278953815813375,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
                              3⤵
                                PID:2336
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,15870571385651125616,6559989030318728392,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
                                3⤵
                                  PID:1628
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,974426090743058066,11378612481953128922,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                  3⤵
                                    PID:4952
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,974426090743058066,11378612481953128922,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                    3⤵
                                      PID:3068
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,4333216292585751417,4401623151716330297,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1184
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                        cookie_exporter.exe --cookie-json=1128
                                        4⤵
                                          PID:3616
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,3490339296671993345,8493248103513381851,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
                                        3⤵
                                          PID:3608
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,6470617039278715320,2219164495020756569,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
                                          3⤵
                                            PID:1564
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,5536900443913845089,7049792498455376244,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
                                            3⤵
                                              PID:3408
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,10641592698252972075,2608561858848365921,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
                                              3⤵
                                                PID:1764
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,8609729678559711212,13045145060063126701,524288 --field-trial-handle=2128,i,1496636680973444275,1231346670677540969,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
                                                3⤵
                                                  PID:428
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                                PID:2400
                                              • C:\Windows\system32\sihost.exe
                                                sihost.exe
                                                1⤵
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:920
                                                • C:\Windows\explorer.exe
                                                  explorer.exe /LOADSAVEDWINDOWS
                                                  2⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2948
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies data under HKEY_USERS
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2352
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                • Modifies registry class
                                                PID:3996

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 40573910fab125adf4933fb84617c5cf7cc13848869d9d4fb8be4581f6087ade
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    BookmarkMergedSurfaceOrdering
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                    • Size 6B
                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 4KB
                                                    • SHA256 20bd4ab6b9babea3b370adcfad394a088195016ed6fe1b237a71386bd7d57211
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SiteList-Enterprise.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                    • Size 2B
                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Edge Profile.ico
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                    • Size 70KB
                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    HubApps
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                    • Size 106KB
                                                    • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                    • Size 3KB
                                                    • SHA256 4adee8c52ddc3cbbfbd8315a84f8c0c362670c26b794a41355708c6d70ecc2fd
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 0212c5766e7059bf0cbe39e62fa08b3430e0c7c5d3ca044b85c18010e5e759c3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                    • Size 36KB
                                                    • SHA256 c7be4c0c2d9ca7248543f34de89bbda3288ad24f360195151b78d6d4aa32c27d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sync_diagnostic.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                    • Size 4KB
                                                    • SHA256 6bf0cfb02497d3e63dacb77c5a11b6d914ff82e81d39db0d362d415042e836b7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 8KB
                                                    • SHA256 51cf3888df79114d3fcadd7f303538aeeee6b4e34b1afcf19198c8157b240022
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 25KB
                                                    • SHA256 d5aa92ea8339e851813266e5c742cdaa04f9dee4add09aa3a1a1b60e50f70250
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 8KB
                                                    • SHA256 bfdc2fd1f07641b6d1e32cd4b0919b9170ef66cff199091baa537d5b661d1b76
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data_1
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                    • Size 264KB
                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    10e1b2db-6e04-4f5f-abb7-31823cf4d986.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\10e1b2db-6e04-4f5f-abb7-31823cf4d986.tmp
                                                    • Size 13B
                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    microsoftwindows.client[1].xml
                                                    • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IMEQ2EM9\microsoftwindows.client[1].xml
                                                    • Size 97B
                                                    • SHA256 4262c9ef2e9465953b4784daa182a62b8d76c1fed9598c5f604ff741f690e1d9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    microsoftwindows.client[1].xml
                                                    • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IMEQ2EM9\microsoftwindows.client[1].xml
                                                    • Size 5KB
                                                    • SHA256 580d60b201e80c534ca999c0aa1da776b42e2956be9af8f826c98610314040d2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    1d09a774-118f-4e3a-88cf-42ddc6f5a6cc.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\1d09a774-118f-4e3a-88cf-42ddc6f5a6cc.tmp
                                                    • Size 147KB
                                                    • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    c3b1b0e5-bb6d-430c-9af9-cd2105bfcfb4.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\c3b1b0e5-bb6d-430c-9af9-cd2105bfcfb4.tmp
                                                    • Size 1B
                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    cf2738c3-04a5-4d7c-b5e1-f2ac86a79968.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\cf2738c3-04a5-4d7c-b5e1-f2ac86a79968.tmp
                                                    • Size 10KB
                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    content_new.js
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2028_53149602\CRX_INSTALL\content_new.js
                                                    • Size 10KB
                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/1292-11-0x00007FF8F3010000-0x00007FF8F3020000-memory.dmp
                                                    Download

                                                    memory/1292-10-0x00007FF9351A0000-0x00007FF9353A9000-memory.dmp
                                                    Download

                                                    memory/1292-5-0x00007FF9351A0000-0x00007FF9353A9000-memory.dmp
                                                    Download

                                                    memory/1292-6-0x00007FF9351A0000-0x00007FF9353A9000-memory.dmp
                                                    Download

                                                    memory/1292-2-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
                                                    Download

                                                    memory/1292-7-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
                                                    Download

                                                    memory/1292-4-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
                                                    Download

                                                    memory/1292-33-0x00007FF9351A0000-0x00007FF9353A9000-memory.dmp
                                                    Download

                                                    memory/1292-12-0x00007FF8F3010000-0x00007FF8F3020000-memory.dmp
                                                    Download

                                                    memory/1292-8-0x00007FF9351A0000-0x00007FF9353A9000-memory.dmp
                                                    Download

                                                    memory/1292-1-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
                                                    Download

                                                    memory/1292-0-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
                                                    Download

                                                    memory/1292-3-0x00007FF935244000-0x00007FF935245000-memory.dmp
                                                    Download

                                                    memory/1292-9-0x00007FF9351A0000-0x00007FF9353A9000-memory.dmp
                                                    Download

                                                    memory/2352-706-0x000001DCE3000000-0x000001DCE3100000-memory.dmp
                                                    Download

                                                    memory/2352-717-0x000001DCF6590000-0x000001DCF65B0000-memory.dmp
                                                    Download

                                                    memory/2352-727-0x000001DCF6810000-0x000001DCF6830000-memory.dmp
                                                    Download

                                                    memory/2352-755-0x000001DCF6650000-0x000001DCF6670000-memory.dmp
                                                    Download

                                                    memory/2352-708-0x000001DCE3000000-0x000001DCE3100000-memory.dmp
                                                    Download

                                                    memory/2352-756-0x000001DCF6650000-0x000001DCF6670000-memory.dmp
                                                    Download

                                                    memory/2352-817-0x000001DCFB300000-0x000001DCFB400000-memory.dmp
                                                    Download

                                                    memory/2352-694-0x000001DCE3A10000-0x000001DCE3B10000-memory.dmp
                                                    Download