75f002ca014190288d5bb517d0664e1ca38cbd66ba9db3db915ee6a9d4bd2dd0

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NCH-MCE-SWF015786 - WorkFlow has been completed - Clarification on__ Protection Requirements for CT.eml
Size 65KB
Sample260729-pxq9msgf52
SHA256 75f002ca014190288d5bb517d0664e1ca38cbd66ba9db3db915ee6a9d4bd2dd0
MD5 7be5a8ffe517c0ea0ce4c16f571b389b
SHA1 f36ecaee122a4550d7657a38eca72cf642a6ee58
SHA512 d6650d6a8ca1d77782d985c1d0f922fc1322a68ced6b627aa31c160cd048f19791700750dafb981cc4955a7930624bf76d1bdbc4cead8667b0b577265c3655ee
SSDEEP 768:3EFW76OQRjmAg2/lN5b8pDjvOWNlouQStOg:0weOQRjmAg2/lN5b8pDjvOWNlouQ+
TLSH
T1F8633D2992C0A2475C760829F6033FA6EFE18CAF424205B4BC9F6A578FACC76571735D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3632	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298025975161380"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{CB4EAA96-2D6B-4B81-AC2C-FEFC305EACFA}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2740	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE
2740	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1348	2740	OUTLOOK.EXE	89
PID 1348 wrote to memory of 3792	1348	msedge.exe	90
PID 1348 wrote to memory of 2900	1348	msedge.exe	93
PID 1348 wrote to memory of 3632	1348	msedge.exe	92
PID 1348 wrote to memory of 2900	1348	msedge.exe	93
PID 1348 wrote to memory of 2900	1348	msedge.exe	93
PID 1348 wrote to memory of 1476	1348	msedge.exe	94
PID 1348 wrote to memory of 1476	1348	msedge.exe	94
PID 1348 wrote to memory of 400	1348	msedge.exe	95
PID 1348 wrote to memory of 400	1348	msedge.exe	95
PID 1348 wrote to memory of 3616	1348	msedge.exe	113
PID 1348 wrote to memory of 400	1348	msedge.exe	95
PID 1348 wrote to memory of 3616	1348	msedge.exe	113
PID 1348 wrote to memory of 3616	1348	msedge.exe	113
PID 1348 wrote to memory of 3640	1348	msedge.exe	97
PID 1348 wrote to memory of 3640	1348	msedge.exe	97
PID 1348 wrote to memory of 3640	1348	msedge.exe	97
PID 1348 wrote to memory of 1324	1348	msedge.exe	98
PID 1348 wrote to memory of 1324	1348	msedge.exe	98
PID 1348 wrote to memory of 1324	1348	msedge.exe	98
PID 1348 wrote to memory of 3156	1348	msedge.exe	102
PID 1348 wrote to memory of 3156	1348	msedge.exe	102
PID 1348 wrote to memory of 3744	1348	msedge.exe	104
PID 1348 wrote to memory of 3744	1348	msedge.exe	104
PID 1348 wrote to memory of 3744	1348	msedge.exe	104
PID 1348 wrote to memory of 2336	1348	msedge.exe	105
PID 1348 wrote to memory of 2336	1348	msedge.exe	105
PID 1348 wrote to memory of 2340	1348	msedge.exe	107
PID 1348 wrote to memory of 2340	1348	msedge.exe	107
PID 1348 wrote to memory of 4412	1348	msedge.exe	108
PID 1348 wrote to memory of 4412	1348	msedge.exe	108
PID 1348 wrote to memory of 312	1348	msedge.exe	111
PID 1348 wrote to memory of 800	1348	msedge.exe	112
PID 1348 wrote to memory of 800	1348	msedge.exe	112
PID 1348 wrote to memory of 3616	1348	msedge.exe	113
PID 1348 wrote to memory of 3616	1348	msedge.exe	113
PID 1348 wrote to memory of 2416	1348	msedge.exe	114
PID 1348 wrote to memory of 2416	1348	msedge.exe	114
PID 1348 wrote to memory of 4552	1348	msedge.exe	115
PID 1348 wrote to memory of 4552	1348	msedge.exe	115
PID 1348 wrote to memory of 3824	1348	msedge.exe	116
PID 1348 wrote to memory of 3824	1348	msedge.exe	116
PID 1348 wrote to memory of 5488	1348	msedge.exe	121
PID 1348 wrote to memory of 5488	1348	msedge.exe	121
PID 1348 wrote to memory of 5488	1348	msedge.exe	121
PID 1348 wrote to memory of 5700	1348	msedge.exe	126
PID 1348 wrote to memory of 5716	1348	msedge.exe	127
PID 1348 wrote to memory of 5720	1348	msedge.exe	128

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\NCH-MCE-SWF015786 - WorkFlow has been completed - Clarification on__ Protection Requirements for CT.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url6685.inaxus.net/ls/click?upn=u001.0AZvZc1P41IzHcb6FajSytBEa6EJUE4vVUCW1GDvDQ8gDh1u-2Bz4FYMU3JSWx5b9KGMkg0mj-2BFhSBPxj9y0UNNg-3D-3DfYWl_e0MrJ-2FC39I8FEYWUMjMSo8101S2RNIL99Oi4l-2FcdGB3DGrMoQgDkcFBmYljHPYRihNPQdNt4P4uMXo-2BifI6hMnMQ8C9vQjgKcw97zDNO0XZe8okZm-2FFt63-2FYKGVXlqatKX-2FA4xNt6u6Zc9vYIXTzlqxLEjMAsFBSHu6xTd28LA7QWsxoF3WtzxdLG-2FNsGZAcU8TZe8BaAGA6nK2yKKDhaw-3D-3D
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa7fe0c188,0x7ffa7fe0c194,0x7ffa7fe0c1a0
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1771037091387943968,5640611450731921431,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,13369070818030780430,7483369546479407039,262144 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,17798012020522061753,14238581474289927367,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,364093071761150107,9886576958478434585,2097152 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,72982868975481500,2268517636815897896,2097152 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,10391982882124278576,5030437202865231048,2097152 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8290552957988836608,11902576273366869754,2097152 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12178484330742339708,13260614595666820843,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5112,i,16564827826082955789,10709061617156573654,2097152 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2024585824173360024,13704916703103880724,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,10303437452440100469,2214622540482018063,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,13384997796161031618,9976699246447069876,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,9303083594893765127,13315483082598553187,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,9303083594893765127,13315483082598553187,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2100791752053533642,1600648303327023617,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3517254405202363194,3505385413880271024,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,4617088693225991087,4124900846379549598,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,9434980376691694735,11944589583487365768,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,3758711983126977427,3091998611196793675,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6120,i,10785907392262817682,11376495802858241984,2097152 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,15104049986428025683,9235216439002805118,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,8011393994957137912,2403749593276503832,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3151573625485838797,785907389781624724,524288 --field-trial-handle=2304,i,2783546596603818912,5039980145631334938,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
    3⤵
    PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c6f6dbfac4af94c94c915841ab3b25c901e88a7b1b28cd8491522ed4b7d67c64
MD5 3b90cf452e69f70433d34335f71641cc
SHA1 632107012ae0624b2d681f90570566b98c551a00
SHA512 d8bb5729680591ad3193116589be611283f7862bda4a1fa0f4cbaa7a9b0fe559859dc7ebbc67cab4fd46913ec91701a7a37ec27648437ab02a27ec6fbca89036
TLSH
T1B0D02370B5A9ADA0C82C0030803002016E66867530DB9B032045880D98B02C0F2DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0da2990730bb3a55302f9acfd7740dbc473012363433f85f085642116bf353cb
MD5 fd9efb5be677fbf379d884c5a383ecba
SHA1 893b1e573d35a014d5a30fb44819f2b26ec4b513
SHA512 3d512967f02081ac7a0fd706cdc1567f398a82b7ac012a0f43da2a209a7d77c1442e4eff39939cb29da4b3f620c81125ba6d462ee4dce609c81af8a0e9203b0e
TLSH
T1B5715E1682596003DB9E1271E0DE0B1270B2B5FD595B7FAA0680B63F6937BE1D7AD40C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 ce3e657264c8893721211518475408484d7178c08026eee720a436104bfbd7d4
MD5 05f856afe257dbfffc6dc8d1035a20ec
SHA1 5e0a160cc1b0e3d645e3ed882255402d43c50f91
SHA512 5be89c935ec6f088d1ef54b1df1fc14c592203ab0fa4ea62b0958fd480227df6af8b3d0dad8aaf212130ec981f8bc0cd90578cf2169cfe2b1fbc8e562f021475
SSDEEP 3:MsEllllkEthXllkl2zEklNq:/M/xT02znN
TLSH
T1874404147FC00415C50014307011C3501374F4100515F74334D14513DCCD5404D00410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f2c30923648eef5dae08bd00028106018b2ebf7be1730287def7fa09ea3d3c6e
MD5 478f27ad89c87874c62729806977c785
SHA1 31a4a4f2091b1f31d0945ee47dabbe0d5d6c8fc2
SHA512 bf136e7f4cbaa4a15ced529c726279dc3c8388f879fb84156930f8965de7599f9b9156eb739a7bb9fbd121ac3e181082f542f984884d57b541efc356a4d70daa
SSDEEP 192:DKd5md7feC8cjRByVDa51K/uriaUeTIUfVJO7g6JdqD6JVR8p7XZ:DKd5md7feC8cjRByVDa51K/uriaUeTIk
TLSH
T175128BE783D9826D891256F0FB147E1BCE2D1664472C3D2A8AE4AF4FD3E2471D20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3fb18b638f62447ba2d340d93e59fd8679b5312e4a10b36d43ff3c6e3eeb3d2a
MD5 aae2cfdb434590c3ddbaa29fb3d2cfa2
SHA1 72ac65cd4e0b04e47aa55c1f76e7e659bcb706a3
SHA512 6a3b2bad96635ae8a4f98903db290ce472bdaab9a9fa0bf5607a1b203c39b8de4498c2581cc0a074e03be1fbb7f8fc1660ba3dd58c617f7b5f7882ea786dd829
SSDEEP 192:sxZZRQyM/jK1Ml8Mi7/fwsJtqbCrXIdpa4HW6+WN+pd/rIFgDEyun7wFz50Ig4J:sxZZqq7/fwsJtgY4fHbO/rCtc
TLSH
T17F52D816AB34597B8CDBD219F555BB63D6F50563D2804E44AAFCCA0C00E6EED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5a1287edafc4528f24ca664ce36eeba6d8e67916bd57a871db152e8a6adaa150
MD5 b9bf898997a01e04808992480d0e2f6e
SHA1 7c86525ea3ec2c30a90ec3ff3f996f865205268e
SHA512 1094cef86a608fa769a1f966847151969279cc103b161ac7007e4622cbbf166116e2dd5668911a5a511b9ac5d53ad76cb8c1826b0f088a23e66c2a973bb790ec
SSDEEP 192:sxZZRQyM/jK1Ml8ij7/fwsRWpVeWqbCrBIdpa4HW6+WNX4UcXrIFgDEkv3BVIiOL:sxZZC77/fwsRWveWgYqfHbsXrCuV/r4
TLSH
T1CD72C716A634497B8DDBD219F555BB23D6F50523D6904E84AAFCCA0C01E6EED6303C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a1233f7aa456e47eb5cb6fe80904f4e08b861aaa546cddbe03d17317cd9f78b3
MD5 0a7ac967e0a837930bd1dd833186ba66
SHA1 86e390904c3cb77583818e0523cdf4bd249b3e08
SHA512 0257d66b1ad48d7cd03ea28605ee684d8ca1037c0a88b0e7fb14120bc287f2586d80f0d3a4bcceadf44357adef85173975a3bb625a4cd562f394cff928c83edd
SSDEEP 192:sxZZRQyM/jK1Ml8Mi7/fws9tqbCrXIdpa4HW6+WN+UcXrIFgDEkv3BVIiOJ1gaw2:sxZZCq7/fws9tgY4fHbWXrCuV/lw
TLSH
T1C362D856AB34597B8CDBD219F554BB27D6F50563D2904E84AAFCCA0C00E6EED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e741fbf6cd46b97441c18b25d229c966f167de7e64b2a999871e5231166f8f05
MD5 324d13212dc53dc80326ed3475e0762c
SHA1 4e3a5bf157fe68c42dd61d818ad3ee7e8a6eff73
SHA512 9d56c58a1598e28cd9b0818a34828b479d00f677dc186e467e31d71f2df5380cc049662014e070f67e6c37c56624b4adec58fae12e6a92e49cc2438b7a020fc9
SSDEEP 768:in4jex+7pLuLfmmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqwcPLlrZ+d1roa:in4jex+EfmmWvmKLEu1janwcPLZQdOna
TLSH
T11FF20B3B680CCF7E4F844E9CED2ABE9B6DE801CB5A98895447FA444C03C66EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4618406c494b6ac3506ac0c149fbf00be3c5404560c5f3a828dafd38e3edc7fa
MD5 f0293492d0cf0142bb2f9985a72d3160
SHA1 b44fd0d3500826c5fd988dcb223c7205b8780be3
SHA512 6fd0368788d4bab4d84f888c38e341e7f709535e4630eaba689c65e64fe45410aa747cca50dbb30d73be22b892b4b7217d670851f9e20492f9c9dee1f4b63637
SSDEEP 24:KdWf5qra4dsYU4M4+fIjuUKiXhaYU1E2ESmKMb8WJyXYafNWHacdwMI44k+bIjy4:K4TINKEkY7yFTI1KQE48GIHKnqELyw
TLSH
T1AD91814670BB06153D7D2A2CA2E496578E81B6677055E42B7FAC01B20F2BE210CFDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7561e8ab36b9af3e676c87462540b26b403611d252b07204abf48a4c7baa4d64
MD5 d4de40dfefb49eb85a5a5a97d6f3f6c2
SHA1 e1e1e2ba62aa1da1a6a806078640a7f3c5abf962
SHA512 207480164f60e6bc3c75624ac4d55da29e80af88b5ac2719099302bb8cec28062d234dde6779cb84c55ee272b9fa012efbe13297976c5fefa39fa0aa27a0daeb
SSDEEP 384:nu3ZcIhsNjuLWonWf+uOdKc+27FhScjmwE:u/hVzGjOAclph1jQ
TLSH
T111927D71AD79DC3699E6A105F48737538EF820B3D9D05F88E5E89F1D04C6AAC230B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 957a6f72bfea79648eac818a4e1161cecaec46db1974ce86b54700026c573c96
MD5 f804796258e445524731c25c9f479871
SHA1 e9ccd17fb41da212699cbcfd6fb683739f298ae0
SHA512 2b4d4d0135fd24d184683031145ae09ab89e444509c5db2b08d6e02c13237d06bb832fdc1840e9367172cecf8d068cf59f53ff1656c16ef53f40931205f9b267
SSDEEP 192:EONo6hZ0QmiUyeApc/+jVQO1L75wOZGx1WU6:EONo6oypu+uOdC2mWU6
TLSH
T1EC02E93568786C778EE2AE45F48737235FE5117BE9916F84D6E85B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c76ff5645bfcc3bdf2340422a7aba1615670d65e2815e709b007f7671771d804
MD5 bfb529e318afe86392ff98cce4e95146
SHA1 0cb3dbd92840b809d8c94adce2087a2a45bf6c82
SHA512 2fb012425e83f82c4997db6e07465e96c6d23015a76a72eed8a6118521305bc5a9c736ffeb1bee29508b980c2c3bf88351622c0b4c8269c35590a20490323df9
SSDEEP 192:FON+6hZbQmiUyjACc/+jVQO1LKc+2B95cOqiqOIU6:FON+6hhCu+uOdKc+2O9hU6
TLSH
T13712F735A969EC764DD2A541F48733A38EE52177ED82AF84E1E85B1C00C7B9C270F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 879c14e4a636c85292e6cd6848be34b67e8921a1ee52bc60631d6cdbdadd2611
MD5 3ac5f5ef3c77674c3a16836ad71f2760
SHA1 4772d2f281c4b4f477031105bd33e5c15dff3660
SHA512 97a7d6c6a1f9663195a338f6a51cbe257e0207d686304f257424ca5f8e94401aa6ec46d341556eea1314515934c28dc7313e925ae6bd0939b35e03a65d85161d
SSDEEP 384:nACZcIhsNhHLWoEWf+uOdKc+27FbUrStiX/sw9YkBxScjmwE:AwhsAGjOAclpQSpw9/x1jQ
TLSH
T189C28DB1D9A58CE784E5E5C9B046E6121EB80133C9999E4CE1F8BB3D308F9BC1717C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d5d405a3f51a6ed747d82154e2be589935f3ca6ac510d6d5d28391a37777ffd6
MD5 d31891922b4c6c6844d1185c63ca2631
SHA1 9ecb6aa4dc42c0ac278f010cbc77384bafc7d275
SHA512 bde0359168f228cd8ecdf02cb5341861a7fb319d566b97033b260265bbe095a4cdb215ac5625fc2613161b71eea43c72de83076ed6c41057f616b9699d03c2e0
TLSH
T170413B5CA6F91148B3B37E5AAFF3986D487BB8672E06D49D00110D4E0A27B40DCB1B33
MD5 SHA1 SHA512 TLSH

Submit Download

1e9e8442-78b6-490e-8cd3-e521e4f66f44.tmp

Path C:\Users\Admin\AppData\Local\Temp\1e9e8442-78b6-490e-8cd3-e521e4f66f44.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

36217085-4c99-4d76-8526-3b1ebd9d690d.tmp

Path C:\Users\Admin\AppData\Local\Temp\36217085-4c99-4d76-8526-3b1ebd9d690d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_1341155649\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

279e50e0-e326-469b-9e84-261d3720df09.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_730127309\279e50e0-e326-469b-9e84-261d3720df09.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2740-12-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-8-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-0-0x00007FFA6C030000-0x00007FFA6C040000-memory.dmp

Download

memory/2740-9-0x00007FFA69E10000-0x00007FFA69E20000-memory.dmp

Download

memory/2740-10-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-13-0x00007FFA69E10000-0x00007FFA69E20000-memory.dmp

Download

memory/2740-6-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-11-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-7-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-4-0x00007FFA6C030000-0x00007FFA6C040000-memory.dmp

Download

memory/2740-5-0x00007FFA6C030000-0x00007FFA6C040000-memory.dmp

Download

memory/2740-1-0x00007FFA6C030000-0x00007FFA6C040000-memory.dmp

Download

memory/2740-48-0x00007FFAABFB0000-0x00007FFAAC1A5000-memory.dmp

Download

memory/2740-2-0x00007FFA6C030000-0x00007FFA6C040000-memory.dmp

Download

memory/2740-3-0x00007FFAAC04D000-0x00007FFAAC04E000-memory.dmp

Download