c7bfb09920a4b2a0aa94d0f48a95f17d910c6d90635a3e310d436d1e9c18e31b

Analysis

user interaction
yes
max time kernel
58s
max time network
58s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be62a4a6f4b22cfa07c2e34d8996162f.eml
Size 41KB
Sample260804-st87tsch47
SHA256 c7bfb09920a4b2a0aa94d0f48a95f17d910c6d90635a3e310d436d1e9c18e31b
MD5 5db73e1bdb9e5aff872b8507f14f5563
SHA1 83acf337155aee4a6a7cc6af29e4ec9364805256
SHA512 56c294caea75f5eeb2f835c7893e34482911942ed758010c74c7aee52a2925164ef21e1312f2ad3ce5270b775806bcdaf2236457b7ebebe8a585aae32485d77b
SSDEEP 768:bVIBJsbdNASzZmgYeFBu36Um47JUi+GW66miR+XlzKRERJScYaXD:bVIXKdNXVmgYmBpsr7P0RKZ+Qoc5z
TLSH
T140134B020C521705E7E181257837FE5E2420B2DE5DE9ECB5E7BF00DACB539B63A2256A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4300	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303307989805094"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{BF63B031-246A-4765-A1FC-DCA69F56DFB7}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5320	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE
5320	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 4056	5320	OUTLOOK.EXE	82
PID 4056 wrote to memory of 1592	4056	msedge.exe	83
PID 4056 wrote to memory of 4300	4056	msedge.exe	84
PID 4056 wrote to memory of 3940	4056	msedge.exe	85
PID 4056 wrote to memory of 3940	4056	msedge.exe	85
PID 4056 wrote to memory of 3940	4056	msedge.exe	85
PID 4056 wrote to memory of 1248	4056	msedge.exe	86
PID 4056 wrote to memory of 1248	4056	msedge.exe	86
PID 4056 wrote to memory of 72	4056	msedge.exe	88
PID 4056 wrote to memory of 72	4056	msedge.exe	88
PID 4056 wrote to memory of 72	4056	msedge.exe	88
PID 4056 wrote to memory of 5424	4056	msedge.exe	89
PID 4056 wrote to memory of 5424	4056	msedge.exe	89
PID 4056 wrote to memory of 5424	4056	msedge.exe	89
PID 4056 wrote to memory of 5528	4056	msedge.exe	90
PID 4056 wrote to memory of 5448	4056	msedge.exe	91
PID 4056 wrote to memory of 5528	4056	msedge.exe	90
PID 4056 wrote to memory of 5528	4056	msedge.exe	90
PID 4056 wrote to memory of 5448	4056	msedge.exe	91
PID 4056 wrote to memory of 5448	4056	msedge.exe	91
PID 4056 wrote to memory of 5536	4056	msedge.exe	92
PID 4056 wrote to memory of 5548	4056	msedge.exe	93
PID 4056 wrote to memory of 5536	4056	msedge.exe	92
PID 4056 wrote to memory of 5536	4056	msedge.exe	92
PID 4056 wrote to memory of 5548	4056	msedge.exe	93
PID 4056 wrote to memory of 5548	4056	msedge.exe	93
PID 4056 wrote to memory of 5780	4056	msedge.exe	94
PID 4056 wrote to memory of 5780	4056	msedge.exe	94
PID 4056 wrote to memory of 6112	4056	msedge.exe	95
PID 4056 wrote to memory of 6112	4056	msedge.exe	95
PID 4056 wrote to memory of 2808	4056	msedge.exe	97
PID 4056 wrote to memory of 2808	4056	msedge.exe	97
PID 4056 wrote to memory of 2808	4056	msedge.exe	97
PID 4056 wrote to memory of 2564	4056	msedge.exe	98
PID 4056 wrote to memory of 2564	4056	msedge.exe	98
PID 4056 wrote to memory of 2564	4056	msedge.exe	98
PID 4056 wrote to memory of 6068	4056	msedge.exe	99
PID 4056 wrote to memory of 6092	4056	msedge.exe	100
PID 4056 wrote to memory of 6068	4056	msedge.exe	99
PID 4056 wrote to memory of 6092	4056	msedge.exe	100
PID 4056 wrote to memory of 1096	4056	msedge.exe	101
PID 4056 wrote to memory of 1096	4056	msedge.exe	101
PID 4056 wrote to memory of 1096	4056	msedge.exe	101
PID 4056 wrote to memory of 2192	4056	msedge.exe	103
PID 4056 wrote to memory of 4748	4056	msedge.exe	104
PID 4748 wrote to memory of 4400	4748	msedge.exe	105
PID 4056 wrote to memory of 5244	4056	msedge.exe	106
PID 4056 wrote to memory of 5244	4056	msedge.exe	106
PID 4056 wrote to memory of 3512	4056	msedge.exe	107
PID 4056 wrote to memory of 3512	4056	msedge.exe	107
PID 4056 wrote to memory of 5756	4056	msedge.exe	108
PID 4056 wrote to memory of 5728	4056	msedge.exe	109
PID 4056 wrote to memory of 5756	4056	msedge.exe	108
PID 4056 wrote to memory of 5728	4056	msedge.exe	109
PID 4056 wrote to memory of 3448	4056	msedge.exe	110
PID 4056 wrote to memory of 3448	4056	msedge.exe	110
PID 4056 wrote to memory of 1788	4056	msedge.exe	111
PID 4056 wrote to memory of 2176	4056	msedge.exe	112
PID 4056 wrote to memory of 5756	4056	msedge.exe	113

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\be62a4a6f4b22cfa07c2e34d8996162f.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tras.info/secured/docs/3f09f2431c/index.php
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x354,0x7ff855afc188,0x7ff855afc194,0x7ff855afc1a0
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,13536107800049183720,10364357650940735718,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,7594770279568011168,6102740113513360682,262144 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,7532958493114519235,6615527325009885224,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6764097948129581959,4546785400516785855,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:72
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,13076076963038742950,18008933942792184688,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6083891923311400238,5302334759900514222,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,1008708725047587494,4118058879792345919,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4136,i,1230604477941655568,10326647685791905310,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,14633549809992670099,18441142160431659672,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,3116293842184945161,8284623075974593224,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,618801056941778672,6428278734662751036,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5472,i,2989755680919910664,14171801154191323386,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3444,i,6232595694316782414,7065567515926570682,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:9
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,2581654456858415316,4520677516108723710,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15490161941529253989,6377406146766963482,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3664,i,17484746543653191160,16591166228845210882,2097152 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:15
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,2833876923406436491,7387823351021275116,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,2833876923406436491,7387823351021275116,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,18293014631416863362,5927753362425575697,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,2718301958831524221,13780227687439931833,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,2183976898853638449,12749300592033373920,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,4697474521962486566,4156642203096977799,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4936512305265878048,7750008844484897254,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,2889320515372302049,2862528028134509980,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,8637041160680712610,1715327950099691598,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,3909335359256541135,3053114977947435980,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,1595028246466738923,9727103608569996180,524288 --field-trial-handle=2144,i,1783315289127643427,15034939717870854399,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
    3⤵
    PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ee4216c9-6903-40de-b3c7-e5e4d83f5925.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ee4216c9-6903-40de-b3c7-e5e4d83f5925.tmp
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c08bb072a9bffad29d0e3db1ec4f906a346c450e032302ab1b08462b0dacbc9c
MD5 0c8b1bb54d49495f362a901d6e5f7def
SHA1 366226a4b773c38ee8c3969874b3d9199d59e5a2
SHA512 7b50f97ae7f1d291f4420a3f9b8ae9c755acc573a737f5d923e64617aa6bfad5a60c4b6512cdba607ef0548beb039ff7c939b409914a44b082aa59818327a840
TLSH
T1E9D023F07C1AF190C22E00B4D91026001119833235977373D4D4480CBEB0C8042DFCF6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c2b555b2eaebb77a61810b3554e11786a64c7abf979d88384bd24634cde70138
MD5 3469f631c6c957363b035aa22e2145c7
SHA1 6847438955efb2e5302bce6f59d3bde730401536
SHA512 450e6b68d68eb446e13ce0cfc185dbc75f44c70d0cbde16f47479e2b60d7e956234c6659a1c6fcd83abcbf03ebcadbc0197e295ab548a7db06f249e6657d6bff
TLSH
T19F716F0732732260F39218F2B8E20B273C3E755A0927CE07D0DCCAB6561B36146AB4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58872c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58872c.TMP
Size 3KB
SHA256 5c7ebc13c8f634d40a936eccb941507b463029318f932732ef6d68b602bf69e0
MD5 588561381b3443d60bd8a58f779a41d0
SHA1 c7a47e0a2770806a9b81fe904f9c02d18657dcd4
SHA512 8265b6d1eacb46b8843d5b5092ca0b49cc4cb16fd514629ac956307c8e070d176710a3a8122fbd595ea638ba00a174414b6a8a8ba26b47fe4b0e146ee6acb522
TLSH
T1C1715E0B32722261F36228F1B4D617277C7EB45E4967CD46E4DCC9B16607362466B8EC
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7e2af199de3ba9cc8d7ddc713efee56fe4a2cd1e1d80a1eff9cda434a978548b
MD5 f570e0cc6da554a4082f73f1747111ca
SHA1 ce5f45f3e20d8da292a2d7d79c6abf542f2ef571
SHA512 952363107ba942b52fe73dd5c381e91ea6c957f4a655bb8dc32a1e4aedd2e782e0b93f59c8b61762cd6bf532b7b202b6b7dd776c730ed0beff1fc7b3e140a065
SSDEEP 3:MsEllllkEthXllkl2zEklfUZKl:/M/xT02zn
TLSH
T1EE4404057FC10C05D5001071C011C3D10770D4100531574334510413FCC5DC01D00410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 98006c947a76c005a3e2af0f9440989776732b723d63e8112363182e154385c4
MD5 35764ab19b1e11eaed81279d9cc1498f
SHA1 50d8015527f0d7ed757081e404dcaf6285d75a71
SHA512 28bc181f0ded28c17e3807025f6d29146b88137aa9aa95a75725d0c18a238a8c563c461b9e4d95322f8154f03efeb03d20e439616b86cc0b692b2ff7aca8fbb0
TLSH
T18D51D0F3C3E8896D891256F0A618AE1BCE1D0910832C3D5AC4E4EF6B97F2431D14158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bb01179c80397b8b27c5632b7f042385058869b5d9ebd9af49c8664b7f2c0c47
MD5 5cabcb19a36f8ebf5f625c2eb769366c
SHA1 38ad60e7f3b30e948123fe8557259a6e5011ff88
SHA512 05746ba8a33e0869d1223da79f23137e7d4f889fe70852ba02d54abcb3291453aade4c9bde77546361836fab66335891fbbc265ea0a62b79f2d193e99c4ed25c
SSDEEP 192:sxZgtR6yM/jK1Ml8MNK/fVsqGvIdp30/W6+WNW+KC1/Y05YS1OwwOBZIg4J:sxZwY1K/fVsqGAk/bp/59O8c
TLSH
T11452F7157A346977CCDBD209FA54BF93D2F5157392800E48A9FC9A1C04E6AEE2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b1f18c968f08b540a03650be3ad93b4f380ba78b6d1834aa9e5fe2b4fe678ab7
MD5 c375c44d23f1eaceaab775910483b111
SHA1 91fc0c26dba48d026bf97bb480dcbcd6a51d9d88
SHA512 35dba6b55f6b93edb84675da49381ea4cba312eccecb1ddd8fa26f7702e7dbc67b3a22bb3f58d41de2819f5537d90f69906a3b64b09a22f93bbede5f4b3ad4f2
SSDEEP 192:sxZgtR6yM/jK1Ml8/cK/fVsKWpVvmgYcMIdp30/W6+WN/4VbZY0daXOwwvrZIgb5:sxZwYFK/fVsKWvvmgTk/bCZ5oObl
TLSH
T13762F915BA346977CCDBD209FA55BF93D6F9146391900E54A9FCDA1C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ae8963379f57f42a1819d87094d03b66c76dab96cd0c7231260fbb2e0748dcc0
MD5 4eab5745271d4f1293f3629c391fbccf
SHA1 a1efd6ba708711ea411ce552272319aa4e7573ff
SHA512 b651880241f9390164bccaa4a656d62e04ad3cd8dd6d9586f7e388bb169c59e16de12b4da193bdc81fd13d5b0deedaeb31a141b25eed4ef682138d398c0b1255
SSDEEP 768:C1zXl8pZ2Mv7pLuLfJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eJ1/Ll0:C1zXl8pZ2MpEfJ1WRmsYQL0u1jaKeJ1q
TLSH
T19A031C7F284CCB7E4F844E9CEC267F8A6EE8018B96D8895447FA480C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8f1942b9b1bd1a80cae7328ba3394b67b1238ddd660d107106b1aa5952438dd4
MD5 5f2071d137078138c0788599e7f49cf9
SHA1 3c49af24f3c2732a0b6e39b81140e3d05baa18ad
SHA512 8dcf6bbd678232b10c23b846d2d7fbc2dd376c4d69b4c4a49bf47706870de403801c85cfca69a9d509b7f6be8c81537eeb049310d616ff46dd5d1eeacdb9e5c3
SSDEEP 48:K5wh8AC2SgW+jzIXogKA1oags4wlT6Qtyj0J2q0GmxzKjsIkCxKZ4RUx1MhebCm1:KYHOKsEqedWKGoCqUQK5Ch
TLSH
T1F091E61230BA12422D7E3518935687A60E43F1673129FC3F7B6E057A1E2AE115EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ef9b17131b9a7cd1bb71dd8c93eb410bfefc08a019743247f3c7773c344dbf46
MD5 e9e8c8c29d3ab39b5a90b659ed02b0ef
SHA1 7667e2d123fb976fe11b096e1216bc670c32a68c
SHA512 373e313634f5effb5f3e16b753235526d8a34da44a6830083cd3ee1d5d9166050a9984f5b3951877c3395657109a1f8c32c089be68d5ced9f1115bbd93c8ab2b
SSDEEP 192:uucL8NJbQBIp6LNEm7QmiU1bEfgE4K/GPTaXRCNC+2GVsAysqJVVU8:n68NJbpIE8aY7K/wC+2GtyHU8
TLSH
T132322B3068A9DC3A48E2E614F5833A979FB5207799C52F54D6EC5F0C00CB39C231B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 25b2cdc937c7a76db3ba926622e311ef0a15ea97cd367a6cafc3da2785779d37
MD5 8b7c35f7b43e0091091f7daf8487aab0
SHA1 80c181e5db292cb160a4d4793b9be98096d09f22
SHA512 2edd393c54287f0e11175c90371a6cda25f426cdf09cdc173a09a80ee65fbf84fd72605be130005e230a5f4e400cc2ff850deacb86af44e6b616c32553d7a5ae
SSDEEP 384:nMZcIg8NcOpIE8la7K/wC+2Gt5m6f91AKRAipTlBeRs9JKgqijURhOGB:agYO/RlGtvf0KRAgxTjKgqmURhOGB
TLSH
T134C25B7C9CA5593E84EEB748AA4E29370CB9413BD2F45E68D3ED2B0DC1B649CF306425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2a046ce3718b05c830cacd4c777e2ded7be23e2919a4a458bab303a716de70dd
MD5 77032ae4864c8d4051b1a35e747427d0
SHA1 8e603c91bb48f53a35cc266b3715daaaba4d8a16
SHA512 9c7a5c3014db63ac67d3e9ebcbdd43650163e7d1e0fc0aebc744647d196e5b20a8fea6c5d99b2702a545fbe94be375a9c4beffd440da1675853d790308714c48
SSDEEP 384:n6ZcIh8NJOpIE8aY7K/wC+2GtyHBeRs9JKgqijURhOGB:4hGO/RlGtOTjKgqmURhOGB
TLSH
T12D928E3054AA9C3A94F6F545F5923B5B5EF42077E6C52FA8E2ECAF0D00C619C231B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1496e963969c02df557399a0339852df9cd8a19add0c715b9e88bd161b4708d
MD5 f2449f63f09f98f9874714ccf952a36e
SHA1 ca6aeed9acd7f4fda4e20e60c0fe2e7cce4a7398
SHA512 0426f25acbe5bbccdeba22e0e181816b94da98413bfe0ac8d88225e6f7ea91d40922320bc7bc68a6976bf45c5dec6de9192baa05646de8e2a4ffad58dd6649a8
SSDEEP 192:7GN86fNNQmiUybozHiPL/GPTaXRClV7qyRcU6:7GN861LnzCPL/EUyGU6
TLSH
T1D9020B34B8A8687B8EE2AE49F5877B175FA5112BA6952F94C6E81F0C00D719C1347832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0891fe8306d361d19a98788652425979c0490d91d9002050a080b767553803ea
MD5 416f044f2a52ddd6439532bf00bdd95c
SHA1 df91b4f930fa822638f984392d82c9f4d552168e
SHA512 d55ba5cf2da7465adfa818ab5c165d0620a194c378a9f0c8c1f748782ca14d38bf590cbd62fdce7850c7836c7f7858378b744648d9a39dda66b82f07ace0bda7
SSDEEP 192:GGNc6fN1QmiUyb/SiZL/GPTaXRCNC+2zV3ZysqJVVU6:GGNc61T6bZL/wC+2zLyHU6
TLSH
T102120B34B4A8AC3B4DE2A555B5C33A679EA52077DEC56F54D2E82F0C04C729C274B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4abb04ab-01d0-4bca-9c9e-cfcd02f5dc56.tmp

Path C:\Users\Admin\AppData\Local\Temp\4abb04ab-01d0-4bca-9c9e-cfcd02f5dc56.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bdc01c7-efac-4be2-8077-f61878212d46.tmp

Path C:\Users\Admin\AppData\Local\Temp\5bdc01c7-efac-4be2-8077-f61878212d46.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

3717cf4f-fc29-4329-943c-e1db961c01cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4056_1588140784\3717cf4f-fc29-4329-943c-e1db961c01cb.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4056_969415223\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5320-9-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-0-0x00007FF843B70000-0x00007FF843B80000-memory.dmp

Download

memory/5320-3-0x00007FF883B84000-0x00007FF883B85000-memory.dmp

Download

memory/5320-7-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-12-0x00007FF8416D0000-0x00007FF8416E0000-memory.dmp

Download

memory/5320-10-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-8-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-11-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-1-0x00007FF843B70000-0x00007FF843B80000-memory.dmp

Download

memory/5320-13-0x00007FF8416D0000-0x00007FF8416E0000-memory.dmp

Download

memory/5320-2-0x00007FF843B70000-0x00007FF843B80000-memory.dmp

Download

memory/5320-6-0x00007FF843B70000-0x00007FF843B80000-memory.dmp

Download

memory/5320-48-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-5-0x00007FF883AE0000-0x00007FF883CE9000-memory.dmp

Download

memory/5320-4-0x00007FF843B70000-0x00007FF843B80000-memory.dmp

Download