ec191a52c8f3ce358a05faf9c1b9166016694b15f9c03d041e28927088955d05

Resubmissions

10/07/2026, 11:33

260710-npbcsaaw4l4

10/07/2026, 11:28

260710-nlgemaav4p7

Analysis

user interaction
yes
max time kernel
465s
max time network
466s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8298bceb-ef4d-d03f-6fe9-fff1e15da249.eml
Size 87KB
Sample260710-npbcsaaw4l
SHA256 ec191a52c8f3ce358a05faf9c1b9166016694b15f9c03d041e28927088955d05
MD5 74a04f62aba18b544fed907e79febadd
SHA1 996babefa0bb65449b4f7505538225ca1514efe1
SHA512 419a677528d967b05d6fff99e991575f4e70bba135fccbbf1bbbf4e1f84f5dc417e865c40cc8b1e372237ca7c830646c62c3cdf9ef972803fe7be1a860662684
SSDEEP 1536:H5eTAnMVEEETZ2x72eFDTbNl1bo5TW2LiPz94kRYJ05s+bGME/e:H5uVv2eFDVfc5IaPIsNe
TLSH
T1AE93BF10920211ABC96293C914057E1560417E0A937FBA90FEAF39BE58CFE7D3F697C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_712248880\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1965622421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1965622421\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_351562570\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_926836268\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_712248880\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1338729940\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_351562570\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_984492601\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_926836268\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_984492601\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1965622421\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_351562570\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1365552826\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_620496745\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_620496745\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_926836268\deny_etld1_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1338729940\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1965622421\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_351562570\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_984492601\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_926836268\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1365552826\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1338729940\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1338729940\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_351562570\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_351562570\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_1910147949\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_984492601\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{EA43CAF9-9C7B-4FCA-AF1E-FB23F0F8254E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f483accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000003ca843adad0fdd01c75114ecbb0fdd01dcd914ecbb0fdd0114000000	OUTLOOK.EXE

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7WLSVD2B\BL_MAEU3454206O- Bergevessel (002).html\:Zone.Identifier:$DATA	OUTLOOK.EXE
File created	C:\Users\Admin\Desktop\BL_MAEU3454206O- Bergevessel.html\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\Desktop\BL_MAEU3454206O- Bergevessel.html:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7WLSVD2B\BL_MAEU3454206O- Bergevessel.html:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1284	msedge.exe
1284	msedge.exe
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
2684	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1288	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE
1288	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2684	1288	OUTLOOK.EXE	90
PID 2684 wrote to memory of 3532	2684	msedge.exe	91
PID 2684 wrote to memory of 2756	2684	msedge.exe	92
PID 2684 wrote to memory of 1320	2684	msedge.exe	94
PID 2684 wrote to memory of 2756	2684	msedge.exe	92
PID 2684 wrote to memory of 2756	2684	msedge.exe	92
PID 2684 wrote to memory of 3016	2684	msedge.exe	95
PID 2684 wrote to memory of 3016	2684	msedge.exe	95
PID 2684 wrote to memory of 3700	2684	msedge.exe	96
PID 2684 wrote to memory of 5724	2684	msedge.exe	97
PID 2684 wrote to memory of 3700	2684	msedge.exe	96
PID 2684 wrote to memory of 3700	2684	msedge.exe	96
PID 2684 wrote to memory of 5724	2684	msedge.exe	97
PID 2684 wrote to memory of 5724	2684	msedge.exe	97
PID 2684 wrote to memory of 4696	2684	msedge.exe	98
PID 2684 wrote to memory of 4696	2684	msedge.exe	98
PID 2684 wrote to memory of 4696	2684	msedge.exe	98
PID 2684 wrote to memory of 5024	2684	msedge.exe	99
PID 2684 wrote to memory of 5024	2684	msedge.exe	99
PID 2684 wrote to memory of 5024	2684	msedge.exe	99
PID 2684 wrote to memory of 3428	2684	msedge.exe	100
PID 2684 wrote to memory of 3428	2684	msedge.exe	100
PID 2684 wrote to memory of 3428	2684	msedge.exe	100
PID 2684 wrote to memory of 3996	2684	msedge.exe	102
PID 2684 wrote to memory of 3996	2684	msedge.exe	102
PID 2684 wrote to memory of 4388	2684	msedge.exe	103
PID 2684 wrote to memory of 5892	2684	msedge.exe	104
PID 2684 wrote to memory of 4388	2684	msedge.exe	103
PID 2684 wrote to memory of 5892	2684	msedge.exe	104
PID 2684 wrote to memory of 956	2684	msedge.exe	106
PID 2684 wrote to memory of 4360	2684	msedge.exe	107
PID 2684 wrote to memory of 4360	2684	msedge.exe	107
PID 2684 wrote to memory of 3880	2684	msedge.exe	108
PID 2684 wrote to memory of 3880	2684	msedge.exe	108
PID 2684 wrote to memory of 5792	2684	msedge.exe	111
PID 2684 wrote to memory of 5792	2684	msedge.exe	111
PID 2684 wrote to memory of 5792	2684	msedge.exe	111
PID 2684 wrote to memory of 3012	2684	msedge.exe	112
PID 2684 wrote to memory of 3012	2684	msedge.exe	112
PID 2684 wrote to memory of 3012	2684	msedge.exe	112
PID 2684 wrote to memory of 4772	2684	msedge.exe	113
PID 2684 wrote to memory of 4772	2684	msedge.exe	113
PID 2684 wrote to memory of 4772	2684	msedge.exe	113
PID 2684 wrote to memory of 5164	2684	msedge.exe	114
PID 2684 wrote to memory of 5164	2684	msedge.exe	114
PID 2684 wrote to memory of 964	2684	msedge.exe	115
PID 2684 wrote to memory of 964	2684	msedge.exe	115
PID 2684 wrote to memory of 964	2684	msedge.exe	115
PID 2684 wrote to memory of 5332	2684	msedge.exe	116
PID 2684 wrote to memory of 4996	2684	msedge.exe	117
PID 2684 wrote to memory of 836	2684	msedge.exe	118
PID 2684 wrote to memory of 3268	2684	msedge.exe	119
PID 2684 wrote to memory of 3268	2684	msedge.exe	119
PID 2684 wrote to memory of 3268	2684	msedge.exe	119
PID 2684 wrote to memory of 4908	2684	msedge.exe	120
PID 2684 wrote to memory of 4908	2684	msedge.exe	120
PID 2684 wrote to memory of 4908	2684	msedge.exe	120
PID 2684 wrote to memory of 3160	2684	msedge.exe	121
PID 2684 wrote to memory of 3160	2684	msedge.exe	121
PID 2684 wrote to memory of 4408	2684	msedge.exe	125
PID 2684 wrote to memory of 4408	2684	msedge.exe	125
PID 2684 wrote to memory of 1748	2684	msedge.exe	126
PID 2684 wrote to memory of 1748	2684	msedge.exe	126
PID 2684 wrote to memory of 2560	2684	msedge.exe	127

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\8298bceb-ef4d-d03f-6fe9-fff1e15da249.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7WLSVD2B\BL_MAEU3454206O- Bergevessel.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8a5b9c188,0x7ff8a5b9c194,0x7ff8a5b9c1a0
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,5515281934484581043,8520837153260589145,262144 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,9479351314304248563,14046605262350808199,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16160658065882144390,1295379484585851455,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,2972589437255673615,4676578852356470300,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,4192742902841981437,8139535023706148711,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,4444059112263183144,11475897876488430188,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,2214074099417611380,18014819987842994631,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5316,i,14343969622644376314,2068793797492663058,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16009375453027361361,10515684839524897111,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17720533544553317827,9123301719540541206,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,16821083339005596698,15059920743800539424,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,3308980779123626328,13472642987397427794,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,3308980779123626328,13472642987397427794,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,3037462103176201201,6911315376796204600,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,12888985653866359118,6323594020917744258,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5308,i,12160877959875054223,9144049224058507356,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6272,i,16288946658020294390,11178506798579965286,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6656,i,9238675689066069547,7306991823284040380,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,6966856069025168545,3162793480481377920,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7008,i,11345924843810151792,3594069797030337626,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,5933088561348248092,1357832061742041521,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,10051741610250077421,4585003980076469654,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,14067504364203427016,282598687237894900,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6360,i,11726241752312327211,14940529948326038902,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7036,i,14008466994862050674,3561059525822044042,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,4289931033945954348,1098470092587164825,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17384017202301673885,15910045721944490044,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,8894024670856118706,12334569076906005077,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6272,i,6553189587982587322,2251021904560210461,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,15112381567313949811,10942776050186935103,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7108,i,16115448301551157505,9461735038435309076,262144 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5976,i,14276931392023559235,2645777829681303015,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,5423957618338584456,2028381832862727073,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,17693277363952743539,3200346259586870510,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,17491755949127957710,10944891242142698800,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,11988386932849642068,5315143856846766331,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,12762604855879819228,2227606294279636339,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,11528437964644365410,8142795465068513534,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,7270359821051346904,6997838087593455446,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10668427791264114892,15633327185352918931,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,11315518705737932175,5230944563644946949,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,17316375932756255777,5847040987240881921,524288 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=1256,i,15781329247516319954,14891954907940008917,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6136,i,3056233593091899832,17167806173293915884,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4308,i,4500304713311190660,15097411300476906165,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5760,i,7893538151134555105,16903166334136513687,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5364,i,1427352877131509239,4931319871540437786,2097152 --field-trial-handle=2732,i,12903507151535868337,4353228323499359146,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
    3⤵
    PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\BL_MAEU3454206O- Bergevessel.html
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0543a1e1c8a6176d8ba2f27801c1fa36923ea3c6a285ba25d73f7ffa8984f190
MD5 1f757f67f9213039e18eef1dc023f95a
SHA1 9c6c09e741786ef28b7030856882ba826e8cb41a
SHA512 8c4a3f8219f0f6f21cbbb43ab9fca3e792408f6f3de4243bfc26184541f838fe9f0f09193354f4f417bacae7f26a23f878e943106959186de3b236ad3fa89525
TLSH
T10BE020D856C8C6BDD1407BC782F4630D86C0360B96C4BA05174084547047750FF8755C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5cf34e0af2d0f3c76fb7f2ca5aef3b6576f82f7a644502c216c7892e4cef0dc9
MD5 3a884fd1274d71e992252265b31540e7
SHA1 fe6c60101900e3b265f806bbc3032040cb3b96e2
SHA512 42b6412e1c0951ad4e631cd14bfd66e8e680cc19c80d33fba3df958382d340f5fbb93f72fa1504bf2bf511aea1d361d4d5d0fc9ed9579480f0db85f671bb1fb3
TLSH
T1B121C05403A77DCFDB94CDF315E1D2993E34A87D4A437E915445717DED06754B010460
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba7f6ab3acc1cc3bcbe43603c464e972dbd80f01fbad94a44621cc7a65c51611
MD5 b93ee62b35d5aadb60df43150b961062
SHA1 94fd723a2eb8762118c303bf77787b5f748c3521
SHA512 213cd232debfe732e04a4fdac5d2c9f4d16cbaa81f6b8d3ddbf9e0ad6978f094541aa4da9a866ee1fa6fe01a342d88437047ff0dbc7cfb1f000b6c75d701701b
TLSH
T11F71C8978FE11D1ACF6C9CF1EB918C7B1FF44539C12A2BD358816A1E682B3D26482130
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b10b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b10b6.TMP
Size 1KB
SHA256 e260b2e4d6e573da826614c6c35dd1bcb9a055d16107ee9ace12bfbd9c6a2ae8
MD5 1912cd35feab6f173156f0e3364a5884
SHA1 1bab17e10c0495ffa14f84424966a1793e2af5f0
SHA512 15b5cf2c5d8b9d3645891396478c1a6586fe99f2de4f385421e06280dd65e11b302bf320be18cb0ffb5e1e5b839c832d7a16e0cdea60ff3b3211f9ab97e15fe7
TLSH
T17D21CB5403AB6ECEDBA8CCF329E1C39D3E30A87E4A437E915809317EED12754B0600A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9c36a61a29caf3da442de36f568fa7d4b7eb5ff7abcad72b93ab497b76717eb5
MD5 e9e96245a12a9ffd9aa9028744a77f5c
SHA1 e9ac741a530770cdd6ce73af89dce71cf060c4ee
SHA512 3e4f5022f0744aa75d9ea96ac95fcda41a0f65a893e3d236f6fe28e6621a5aa5e5e14cf434eda885b6aab205d37b97f2220bd894dd84c123ef22a0c3db8bc1c4
SSDEEP 96:DkeOOoJ9+YVaZSgWzBwBj6NS8z5GOcROcJGH+d/jk:Dke9oJ9+YVaZSgW1kj6NS8z57cgcJGea
TLSH
T1CAB1FCF7C7E5862DC91152F0AA187F2BCE1C0952436C3D5A89E4AF4BA3F2471E141A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1c582bfdf06c7901236501dfb76e1ee7dccf243a0ce1ea9bed39097e03bf6831
MD5 828e5ee15399f1780f63ec214ea278ef
SHA1 d1ff4269bfbd48ca6681e47ae5c4b4bfe60f0fd9
SHA512 14aa8bf2c417e23c7c88ec5b5f1a5bce5be7d522591a3fceac9cc0e15bf61fe57507d3388b3e2bf91df7c49712176dc620ea87ee4fe7c36d2d0270f0353e9ee4
SSDEEP 192:sxRwRcyM/jK1Ml8wCl/f7sfPriZe8HxfzoA8pjIGk/g6+WNIYbtZ6KGLIgtJ:sxRwO8l/f7s3rke8Hx2j6/5IK6B3
TLSH
T10852EA166A24597BCCDBD21DFA517F93D6F81533E2901E44AAFCC60C00E6AED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4f1af06567bfe2fc5cfdabc3a89ce070c620ce16e85eced8c69f095202ee18f7
MD5 0d0ae47d98fcce11722bec913a8370b3
SHA1 b03bb18718a46a3503caec998107c52f08c66bb2
SHA512 a5f78d0711f975299a4b33b16ecf60141b9393ab835096e0af12fb36fba3f0291a91fe4c86497ab10ab33a56f54a819ff765766d9cdbf01b05105de17ebc0d5d
SSDEEP 192:sxRjRcyM/jK1Ml8wCl/f7sZPriZe8HxfzoA8pjIGPA/g6+WNIYbtZ6KGLIgDCJ:sxRjO8l/f7sdrke8Hx2jK/5IK6Bq
TLSH
T14762DA16AA24597BCCDBD219FA51BF53D6F81573E2901E44AAFCC60C00E6AED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 77e63559e3b5e3e3627cbb5233b7fccbc5523999aa6c85584757e490d15e0209
MD5 70af3d172932a0aea0a5fa9a7f5623a2
SHA1 ab9b921d18116d8ae55480d1b0704ffbf25612be
SHA512 f61a0a9db2a2867b73d7351ddbd0f7cafc8a75cfb1be831a852a770e0221da9db6b9320fb974110e5b3faf5fc6ddb327dfdc084c4d80913db4fd8605454cb69d
SSDEEP 384:sxRj2nl/f7sdrke8Hxn2jv/5l/R6BBsRA:snCl/fsrD8RK/5ZR6PsG
TLSH
T17082E816A5248977CCC6D519FE31BF92D6F80563D9911E4C6AFCCA0C04EA6FD161382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 69a45bb37667835b1cca9368bc5b89dd28db056af737e0b326063be617165d9a
MD5 4eefff4f3ac9e5893dcea6e330c21210
SHA1 89f2b61eb0a0e99315ce02e2063ff9994bb6f536
SHA512 81d786974bb99249015217ac7997dbe5838fe42b417fc3d04fe821ed240f11c63e7b571513ee83f4f674282a910ee21b080fae2f28c7093d6046967a3f72c075
SSDEEP 384:sxRj28l/f7sdrke8Hxn2j3/5l/R6BBsRA:sn7l/fsrD8Ry/5ZR6PsG
TLSH
T19382E816A5248977CCC6D519FE31BF92D6F80563DA911E4C6AFCCA0C04EA6FD161382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 44e17cd4ab466ed2e3c62aec52a9ec41cb0ad18b52218485eba9fc1de092f97e
MD5 ac2a3f4c3049b9bb2dd00fa3af075947
SHA1 300108ee9d41d1f4829f9fb9b4d3b4faadd23bb9
SHA512 d3434602521b25800b386be47847cc5d6d8739cd2a92d764a0d23a82bc1a1703d9484ae1e8b900f62cd887d2ab24d49ec95be0ad764d8885dd91f836f59453bf
SSDEEP 384:sxRj2qxl/f7sdrke8Hxn2B3/5l/R6BBsRA:snZxl/fsrD8Rw/5ZR6PsG
TLSH
T1EB92E71695248977CCD6D619FE31BF92D6F80563D9911E4C6AECCA0C00EA6FD161382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 b90bba45a9bad977cdfa05e7c3a4359f1afb4fe781a95e1aec01a78a0dbfb55a
MD5 f7e6c4ffb8c034b216d4ea1cda551c81
SHA1 1d19bdbc9531da96535c9fbbbd88cc0cf1dad35f
SHA512 0e1a39ac9e3c30a229c39490fc6f210b6a50bdae674147c6fc536b49106891893c951d9d0a277891b658e380a8ee058e275e824d721b3bdad4953a5a678360ec
SSDEEP 384:sxRjRqnl/f7sdrke8Hxn2B3/5l/s6BBsRA:sn4nl/fsrD8Rw/5Zs6PsG
TLSH
T12392E706A6248977CDD6D619FE31BF92D6F80563D9901E4C6BFCCA0C04EA6FD161382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7e0da3db11e736806d86909543347d5a41501b3b633200f8434a12629287a5be
MD5 c4b9bef1d46a5431d8ebb348fddd1e88
SHA1 95e5bdd9bdc039bae48df921c251d30547189a92
SHA512 5089271fdaff54c7bc6a5c92c974317dec5a7c6ef10fec3088c027b1d8056aec7cb31a9f9da8004a3442bfe210572c721338e52e0f94914734683ef8bae89cd4
SSDEEP 384:sxRj2qnl/f7sdrke8Hxn2B3/5l/s6BBsRA:snZnl/fsrD8Rw/5Zs6PsG
TLSH
T14F92E716A5248977CCC7D619FE31BFA2D6F80563DD900E4C6AECCA0C00EA6FD161382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6fc1114a99880f1978c46f7c1d516f299c925d0dd51494788f061f49011c1b6d
MD5 bcaa25e6ad98d8136675c26020a69a64
SHA1 cc8142bd4c36a72ab1fef5deab2502c07b5a9c92
SHA512 9f92aaf884946e63bd7a796aee809ad34e81b9cb30b6ad0491e21c6b4022f63608de5168e1cf652bd08abc23cf87c59099953ef7eb9b073be0e4a81a82d676c8
SSDEEP 768:FW7pFD7pLuL70tWgikfn48F1+UoAYDCx9Tuqh0VfUC9xbog/OVo+BJ8WdrogZdVm:FW7pF1E70tWgikfn4u1jaT+ByWW6bm
TLSH
T1D9E2DB7B680CCB7E4F804E9CEC29BDDA6DA801CF96D88D9447EA480C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85b95be9-5698-467b-b067-7fe193b3a874\index-dir\the-real-index
Size 72B
SHA256 681e625610fb1d42258cd53a8ab8f581a954950a58aa9107186f96f45ab24a6a
MD5 199bac07b8f7dacd7d3f20c41147517a
SHA1 85efe8c90568ad247719f247866696bd0ca44746
SHA512 40ba1a4c0276917c0c9541daf4f9282aaa771e561c2d81014f6fac0a6bca0ca1ac09e53aff280a17f98d9c6cb276e1f3957a862f4e90b5cd9df13d94e8c95139
TLSH
T10CA0022607C54107C05726F175D6316233D04964E201270941D06385DC54966A55B11E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b8a4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85b95be9-5698-467b-b067-7fe193b3a874\index-dir\the-real-index~RFe5b8a4b.TMP
Size 48B
SHA256 5746ee6a03ccf3678d51fb570a2b034ae65c808e52464af02f0fcbe8af16b12e
MD5 a0217a55f13036b9f3c0bfb9bc43f60e
SHA1 1fe18b679628c169bf9885587c1f019cbffdf95c
SHA512 32f6b2ced04ccb82d278d0ae0790f903d3b3bb61334cd351f69f8b139596768d23837026e520891da9725d69bf405ded270275e514c056db6652e417df21014b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b21a4de5-25f9-43d2-8975-76edfe55ffdd\index-dir\the-real-index
Size 2KB
SHA256 70380db32796cdd5f130b33ff844f9305024a3975f5a63c780372563ccef1374
MD5 85d2c2ea0c6a2dc280b36258e1b104ec
SHA1 27f551d2319c0ca1bd62d36bd39e24cf0127290e
SHA512 1e7f8835574d241f6bb6d3437f7d70efb97181da481822f71ddb4d23a1ac1626d12be156d9221bdfe6a3ef43f2f9e501427989359311d1f1e620461b86abd456
TLSH
T16851B84E9C8B7F97CC6C30F274B71887373528FD9A858F0B446C9D3478832341969A58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bba05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b21a4de5-25f9-43d2-8975-76edfe55ffdd\index-dir\the-real-index~RFe5bba05.TMP
Size 48B
SHA256 8797aa5f133241bf5e37875335e41b874d8f000836b5e8e40af74d9be4ffdae2
MD5 5dfea4986893d2e2acf3fe371a5c96b6
SHA1 7caa0d2a62e8c3f7e7dea930dddc5f61133a1697
SHA512 66724422aa26c83391e2352cfa292997fbb55277f88209d9395ca4c0d03eca08e5b6f64773bea64654db90f8c7422347f04f0409f8b785f6f82320b80eb9cec9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 032eed49b544c3b9623290e1477b9c813790c520798b56e34a0a18a1914b4ffa
MD5 fa15a56f6b6fc09bb7601d3f5ccd5494
SHA1 6cb7cec679727ccb3358088d067273dbccb0974e
SHA512 c8ccd89c5f873570eca1a4b0dff7c9f026609adde868458054c42e03183a9c23f5432a04ae0b77ad38b30d1094d901e9a83516e15474da90697be5b2ccf31478
TLSH
T1B8D02BFB2EA508609EAF87F2203104A104527C658B44EC4D501EB18728B22213507C62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 7c43a63057e5bf8bc1b3da0d48a5442b3a960cd38d469e66ae743b4cdcfdf3d6
MD5 5131e23d6ae0307c525a00dfb83bf5dc
SHA1 4588c8b28eddc6408172eb402ba20adedbd623ef
SHA512 deb4b5fc77566587a97f4fe9ea9e8a3f6640899938675d4f52f5db3d0261644f9e8ae24f47b04f58e8a3cd6acede0d583fbd2f63b5dad32ec7ceada7cea77e69
TLSH
T176E068FB2DE61424AD5F93EA253104A005053C958600AD8E101F71DB20F32542406C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b712a59329ccfb5ab46559693077964410fc30bc812c3503f85754194dbc5ff4
MD5 ca4c5ff5fd218029669e08dc2ca91be1
SHA1 cf055bbc1805cfc1d57ea339a9ed766c0a9b0633
SHA512 753f65717ed6cf53beabfed4dcedeb279da982a713ef4d43c1a7d1b2cdd72967bcc34a1aaeaa379ecdfcb3967f1b54de773517c0814a64dd3343772705cc475a
TLSH
T199E0C0FB3DE71824AD6F93FE2431146004413C658204ED8E141F91DB20F33683406C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b392d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5b392d.TMP
Size 153B
SHA256 891159e7d863abca7b725781d607f823503f47c4dca6d3dc271ad914421ac792
MD5 b5b88a890b9c3e549eba710f6dd24158
SHA1 66af5c3ad9be59c47df49a91714258c7b516cb7c
SHA512 fdbdf266d9d5ad6046a9d03747e190212e554f3bd65bcba483951b59cee255293fbf7b14e34aab3fedcafe34ec980cb2e928c193c06a8d3146b4d732bac094b7
TLSH
T114C02BF72F980A10CF5A53E600311CE241227C948A84BC5D001FF0C330721323017C32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7c85c3b3f9a0bacbdc59fada6030619ad2187001840c9d7215f9a3f2b6a7b979
MD5 8f00606ce187d3a20e26c613ca81fc7b
SHA1 e817d47b5784d4f54eb3019e369a98550b85feae
SHA512 14f384dcb7c3a233e7b9cf68e8d154f328dbe895280d4f62fbfe32b0f8ebe8d1eb75a3ddd15e44f6e1d22e02dceade0c8b49a1925d84585115aa8c22af85164c
TLSH
T179A00262A9408139C0540AF8506742A932D56DFDC1062311639943CE8CD019151D26F1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b8847.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b8847.TMP
Size 48B
SHA256 fbf6e35854080ad23d502e4a264e9b07b80b40acd2988c9806270b29e23a44c2
MD5 84d4b8cad29ab9f7696d57761c010c93
SHA1 a7284060fe7ab1e25615900a43c9736a61195549
SHA512 e62e98cdb2df5be79a22e4b94cbe9b714f8f2d94a42f40e46e6090a8a4af8f55cd62434d9f28705a8ce27c5e4049a51af5f68d0cbe6445c045b14fdc91b9e9ce
MD5 SHA1 SHA512

Submit Download

2767cbc1-87e0-44ec-b169-7751ed4ad8d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2767cbc1-87e0-44ec-b169-7751ed4ad8d3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6cbbcc4eab996e39145e2d03b16360e0cfcbc290c98cf343dd7d176724c820c0
MD5 9460eddb1c2121efcce8e0c455473c9e
SHA1 1151b89e8818b4eb12fcb6b10cf218a4bae6c099
SHA512 dc42058fc48e7fa9e5326ea298b143505132ab9c282b0d0372a464b8d464e14fd0901055cdfd21a12a82c31fe57369f06448c95b2d181e0341ef71506236a9e5
SSDEEP 768:xFKj+9o38wgzPcygB+vLs05Zu4aWADIidy8LuVb9Mz:59o3wPG05ZzaNsuVLab+z
TLSH
T196037C36EC46CEBBA8E65B94B3863A4AEEF452A389CC5DD4D9D85E4D00C71ED0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a08dd31d9c74fc3c52dbc0b751d92d1b8e35221997d9e76567d2724b0471d61c
MD5 77f0b922a25cc9462f97f2d064ce3add
SHA1 68994defe34f05c14028f27412b28aea60c9f728
SHA512 7e51e480da97da68b30923168dcf7eeb493b0bf3e6bb5a9cd4ea898451dae56a9411f06452283e45c73eda2e9412f804be657a0e237c79ee3c57ef96dc84afab
SSDEEP 768:9rv+4UNbdC35LIBqobGWpZu4aWADIidy8LqZeVH1S1C:9bsbw3+pZzaNsuVLqEH1d
TLSH
T1D203BF36A859DA779CF79284B187760B7EF89263C6880AD088DD1B4E42DB4ED1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 adae6bc4ae9c9c2ec23d34ef049dd7fad14c3013b558996a7aa5782032d112da
MD5 2e967e39d8cbf2da81afa5e24eeebc75
SHA1 9dfaa06e29fcaf7e6af421661c4dfa32fca1bfd5
SHA512 f60ca2425c71e102e4073452d442db8eab25430c0fea9c83a0f255cc6c94dac13e4c24b7cd7f5eff25cae2061be22e5c3a293b5257950c061fb1357add0fc51a
SSDEEP 768:Ij+903BPcyLOBqobGLytZu4aWADIidy8LuVb9Mz:X903BPgtZzaNsuVLab+z
TLSH
T146F2BF35BC578EB788B79254F2873B5AAEF462B389C90E94D9DC5B4E00C35BC0352C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5e2eef5db54a468e1064660028cb0655f038ec719df5f5be7b9adcf9182c972f
MD5 8e4eccdbd0d8b9b5175e59face43b621
SHA1 405bd3789441bf6c926454e5f55867ff7215813e
SHA512 553c587a431a1e7a6a9d3efb16c22da1d4cc57494c199767daef205c7f20c1afa5208afb8db76710a7f99802d8fc37c553e730413cddbc795f7286fc7f75d14d
SSDEEP 768:xFQj+9o3Pwg0PcyKKMovLsO5Zu4aWADIidy8LuVb9Mz:/9o3OPKO5ZzaNsuVLab+z
TLSH
T1EE037B3AEC56CE7BA8E75B84B3463A4AEEF452A389C85DD4DAD85F4D00C71ED0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6b1e7f47dd7b9cfcd04c2830b07dc3b115fc28aa00490027c4fcdacbc552444c
MD5 86570ddfcbbed0fa73a7292bb6006a14
SHA1 357cf237a6fa666191d1b45f27ead6bde2336e75
SHA512 0b7c1d3f9d896efc9ec981ca6fd7f167163abde8500c654ff94c13621cc110af6676222cc9354318dc404c240f8bbeed09edab6bfbcc39d50f08e1509f2c0e4a
SSDEEP 768:xF1j+903EwgEPcy2KM4vLktZu4aWADIidy8LuVb9Mz:Q9031PatZzaNsuVLab+z
TLSH
T12A037C3AE856CE7BA8E79784F3463A4AEEF452A389C95DD4DAD85F4D00C31ED0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 18e1a184915664070316a2cb7982ae14d351cb9cd80e881b887cc8627ca77f25
MD5 fa2b5c740931153af01e93a1bd494e9a
SHA1 87517f300d17bc5126eb2c6184d1e2eac0e3d84b
SHA512 5bf90838c8b626872ca86fee36bf2c3e5aa51b134ac27b54ec47e1c45c8b44910a5d56ee3f3a9d44a52aff1eb353d3d009330b0df0c5a8559faf8b33f22ec941
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2a11ab33f6c180cfc7c29a34e23e7904338b6f6843e7f0b12bffb2bf3cb0254f
MD5 73efd577b7087012ba51d4061fb9648a
SHA1 0ac2c9ff26d766da74400183bab52bf50d243570
SHA512 8cbacfa4323b7bed38531a0527ae35b50e664160285d10b19876ea4f02defe98611c1ee80cf5435b579a1cccaf5524efaccb204ffb9dd0ef5b1dfe93d1fd3966
TLSH
T106E00110920154AFC07803B400D31B343AB080040397020942A401782C213102B209D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5cc9df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5cc9df.TMP
Size 392B
SHA256 968511c380838eaff2be86092c7a411c8edfdeafb9d80bdf694078415e4caa48
MD5 f22ca0dfd21b05926b97d16d3e70ac6b
SHA1 39e61c68932e414ea5f08bbb2d095e6c52518452
SHA512 8f44f33a5493ce5588c92f39686e3d12e7d4cd726951e33ec9c448aab1eeb27619fb84f2c41e4f767401aaf1d9fb10c46698128221d956191fe4e133f3beb764
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

8e098a6a-2e7f-4dbe-b773-ed99a9ffc32a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8e098a6a-2e7f-4dbe-b773-ed99a9ffc32a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

BL_MAEU3454206O- Bergevessel.html

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7WLSVD2B\BL_MAEU3454206O- Bergevessel.html
Size 1KB
SHA256 cdde8dd12d42335e25d88556e6b538c5e74fdbea6d2b2b96ac008d0fd74f8444
MD5 1e57072696d25a76890daf92b3f2538b
SHA1 472a538d8afc7f53652fa679df6000c6804a4fb3
SHA512 66604366943ffe2dfa41f170f79da69102207ea3a70375154c832cc35313892b4878595211434d79513f649c70306dcf8d1b4eec1bfdfeeb13923b25d86c2c22
TLSH
T1AC2158757082B4040174E5649C4534054C8BD0750B7ED5787570931F8FB509DD7C3ACB
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2684_949867759\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 9KB
SHA256 8f2d9ed187fe1f5fe35b18c5eff7168c379c37e5b2121eca73b86086116455c4
MD5 7c2ac98e3ae761739c49a66bfabea1cc
SHA1 34d6965fbc6114365bc0859794608dee75991ede
SHA512 68433bafbcd2e0f6fdf893e2bc8971a1ba8f245cb8799d2bc6205f7063a9fe585ee1422a058fa4d4e839c9e32bb42ca319f5f423e7872a0401bdffb1ff7bd414
SSDEEP 96:d/8WJeuo/8WJmuo/8WJVuh/ZWJruG8+/iWJnIuh:dEW4BEWQBEWfYBW599aWBIQ
TLSH
T17522E1109FE64E57F2F7ADB1997367206F3BFD055A048A0D058A45080C72B4499AEFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2684_984492601\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-14-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-13-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-10-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-8-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-9-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-7-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-11-0x00007FF88ED10000-0x00007FF88ED20000-memory.dmp

Download

memory/1288-4-0x00007FF891A40000-0x00007FF891A50000-memory.dmp

Download

memory/1288-0-0x00007FF891A40000-0x00007FF891A50000-memory.dmp

Download

memory/1288-12-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-15-0x00007FF88ED10000-0x00007FF88ED20000-memory.dmp

Download

memory/1288-6-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-5-0x00007FF891A40000-0x00007FF891A50000-memory.dmp

Download

memory/1288-3-0x00007FF8D1A5F000-0x00007FF8D1A60000-memory.dmp

Download

memory/1288-1-0x00007FF891A40000-0x00007FF891A50000-memory.dmp

Download

memory/1288-43-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1288-2-0x00007FF891A40000-0x00007FF891A50000-memory.dmp

Download