Overview

overview

8

Static

static

1

Tidehouse Agency.xlsx

windows10-2004-x64

3

Tidehouse Agency.xlsx

windows11-ltsc_2024-x64

8

Resubmissions

13/08/2026, 16:15

260813-tp8wyack5z1

09/07/2026, 15:43

260709-s52bcscy6j8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 15:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Tidehouse Agency.xlsx
  • Size 171KB
  • Sample260709-s52bcscy6j
  • SHA256 aeb2b6a4871a5cfcf28d8912fd4fc41aef7621772cb22bf6e1e87d0a1dc81fb4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 39 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Tidehouse Agency.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vkcargomoversind.com/kill/sharep-redirect.html
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb0b43c188,0x7ffb0b43c194,0x7ffb0b43c1a0
        3⤵
          PID:4676
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,6139370897588434233,9896911582708616023,262144 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:2
          3⤵
            PID:5080
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,10369955327993192271,13377530111562948802,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:11
            3⤵
            • System Time Discovery
            PID:2108
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,11560757251534421773,12375709561872988528,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:13
            3⤵
              PID:4908
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,11580671285052182117,16605349876952820656,2097152 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
              3⤵
                PID:4844
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,666553235584875648,6390276314230903954,2097152 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
                3⤵
                  PID:4124
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,7705792071134132870,1841938582305762354,2097152 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                  3⤵
                    PID:4872
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,3443619525231195774,11296610379505749445,2097152 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:9
                    3⤵
                      PID:3424
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,18031514982777592383,9207375905999365424,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
                      3⤵
                        PID:4524
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,249861777185200894,298559115751945086,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
                        3⤵
                          PID:4604
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9184945533561177082,8512951558019519143,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                          3⤵
                            PID:4584
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13768731511312045472,11976225645801923424,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                            3⤵
                              PID:2980
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13768731511312045472,11976225645801923424,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                              3⤵
                                PID:1412
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,4276749184273438741,15443768284901934513,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                3⤵
                                  PID:3464
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,9490766767075327003,5354771198180683593,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
                                  3⤵
                                    PID:3912
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,2794544604312262919,14080455074259646363,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
                                    3⤵
                                      PID:3216
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,13559232535016340082,6003439855404408078,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
                                      3⤵
                                        PID:4288
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,10976338999658089719,1659532080093271818,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
                                        3⤵
                                          PID:4232
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,10003638014101089956,954876714158553044,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
                                          3⤵
                                            PID:1432
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,16997178936922904481,4191888664812939047,524288 --field-trial-handle=3204,i,16088638754076321527,17063469682186920056,262144 --variations-seed-version --mojo-platform-channel-handle=320 /prefetch:14
                                            3⤵
                                              PID:248
                                        • C:\Windows\system32\sihost.exe
                                          sihost.exe
                                          1⤵
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of WriteProcessMemory
                                          PID:1496
                                          • C:\Windows\explorer.exe
                                            explorer.exe /LOADSAVEDWINDOWS
                                            2⤵
                                            • Boot or Logon Autostart Execution: Active Setup
                                            • Enumerates connected drives
                                            • Checks SCSI registry key(s)
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2940
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2024
                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                          1⤵
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3676
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:5912
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                            1⤵
                                              PID:1544

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 fff4f5462f00db2197bad3d5dba44e0ed82332400e95ccd8e5aacbd03ea21ee9
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 5373dba236158f8b47a5d7b664d171a8c47fe1fccd7b9ce0e1bd4afa2951d836
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 3KB
                                                  • SHA256 904bfb3dfdee8518a6360d8df7f59f8a1b2a0b666bef9b10cc65cd517ff11b5d
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe5ab6ce.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ab6ce.TMP
                                                  • Size 3KB
                                                  • SHA256 586cd99e527e948215320f055cfeb6d8433682335fbd4069c17054f3d3b05645
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  SiteList-Enterprise.json
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                  • Size 2B
                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Edge Profile.ico
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                  • Size 70KB
                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Network Persistent State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                  • Size 3KB
                                                  • SHA256 22b1d9f94761b4e924a471ad6f3685d9ee42e814f9f5587a228e26730dd61db9
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  SCT Auditing Pending Reports
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                  • Size 2B
                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Sdch Dictionaries
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                  • Size 40B
                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                  • Size 14KB
                                                  • SHA256 73c20ae51c6d4b2945e42c1f73d4a4400f5a23aef992c53c4f494bc87cf91b90
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                  • Size 14KB
                                                  • SHA256 ef01aadf0ade63b3e8338191bf5d23d440ed3d51c0ca6524710196cb674cce19
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                  • Size 32KB
                                                  • SHA256 c8792184e532b7034b1492b821181a6f73489cf91506343b8f719418f574803e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  OperationConfig
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                  • Size 22KB
                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  OperationConfig~RFe5b4ce4.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b4ce4.TMP
                                                  • Size 3KB
                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 35KB
                                                  • SHA256 620d7ea2dbd11629976a36088116c9f1a912355238fccc6291510f99cecf4e28
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 39KB
                                                  • SHA256 f447d21e0d047cecafcb86cf4905bac532b042d17f1016f0dfd1770e5c9508ed
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 44KB
                                                  • SHA256 434584354715b54ad6d10193d9c4fae5b0d97ed66eea529acf5e76e4d72b8b8b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 35KB
                                                  • SHA256 11e1907427f7380f209b1fd1b12392be5b1cd96fee2e388f32f9d905741d7395
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  metadata.json
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                  • Size 132B
                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  449effd5-2186-4d01-81f5-6176875f6f99.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\449effd5-2186-4d01-81f5-6176875f6f99.tmp
                                                  • Size 13B
                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  prep_Activatable Class_Hermes_perf.cache
                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                  • Size 599B
                                                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  content_new.js
                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3236_1382132679\CRX_INSTALL\content_new.js
                                                  • Size 10KB
                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  b8ab77100df80ab2.customDestinations-ms
                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                  • Size 1KB
                                                  • SHA256 a15193ae04a959217bb09311de64c983805b979f872d318b0c1fa16d293794eb
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  memory/2440-13-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-12-0x00007FFAE7950000-0x00007FFAE7960000-memory.dmp
                                                  Download

                                                  memory/2440-3-0x00007FFAEA680000-0x00007FFAEA690000-memory.dmp
                                                  Download

                                                  memory/2440-4-0x00007FFB2A69F000-0x00007FFB2A6A0000-memory.dmp
                                                  Download

                                                  memory/2440-2-0x00007FFAEA680000-0x00007FFAEA690000-memory.dmp
                                                  Download

                                                  memory/2440-5-0x00007FFAEA680000-0x00007FFAEA690000-memory.dmp
                                                  Download

                                                  memory/2440-18-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-16-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-15-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-14-0x00007FFAE7950000-0x00007FFAE7960000-memory.dmp
                                                  Download

                                                  memory/2440-11-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-1-0x00007FFAEA680000-0x00007FFAEA690000-memory.dmp
                                                  Download

                                                  memory/2440-0-0x00007FFAEA680000-0x00007FFAEA690000-memory.dmp
                                                  Download

                                                  memory/2440-10-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-7-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-9-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-8-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/2440-6-0x00007FFB2A540000-0x00007FFB2A7A3000-memory.dmp
                                                  Download

                                                  memory/3676-54-0x000001E081A10000-0x000001E081A30000-memory.dmp
                                                  Download

                                                  memory/3676-42-0x000001E0801E0000-0x000001E0802E0000-memory.dmp
                                                  Download

                                                  memory/3676-74-0x000001E081DF0000-0x000001E081E10000-memory.dmp
                                                  Download

                                                  memory/3676-55-0x000001E081E70000-0x000001E081F70000-memory.dmp
                                                  Download

                                                  memory/3676-88-0x000001E094270000-0x000001E094290000-memory.dmp
                                                  Download