f381aad2ba662810ef6fb558e69c91d75e1b36a11b9a28cfd5f647e2d369661f

Analysis

user interaction
yes
max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Message.eml
Size 61KB
Sample260804-t85cvsvfpf
SHA256 f381aad2ba662810ef6fb558e69c91d75e1b36a11b9a28cfd5f647e2d369661f
MD5 71affca6c33a98433ce6bee7b9890387
SHA1 e51130e8de269eb50b46eedaad4f76fecfd91945
SHA512 a6e7344015c0804e398e8586f960b1adfcc47740bf86f5bf8cf3b3aa8fea01d7fe997eafa0970508865fe9269d87d69bede136422f7988d89461be439f3f03a0
SSDEEP 768:WUPnDVDKGalr4q2UPzu00cjHOr5RMZp+gK3urXZOWrkrGEoMIgu85Uix0savqee:DnJDKGI4qVwXMZpRK3Qp9krGcdx8v1e
TLSH
T14D533D1B91C201C704BA4868B9111964BFB06D6E93768CB8FCBFA6778F95C26354B3DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\page_embed_script.js	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2080_1263407935\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1444887173\_locales\mk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
796	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303355393710803"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{908BBB46-54D6-4C92-88F2-53B55CACFEA5}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
2080	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5812	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE
5812	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 2080	5812	OUTLOOK.EXE	88
PID 2080 wrote to memory of 1288	2080	msedge.exe	89
PID 2080 wrote to memory of 796	2080	msedge.exe	90
PID 2080 wrote to memory of 2744	2080	msedge.exe	91
PID 2080 wrote to memory of 2744	2080	msedge.exe	91
PID 2080 wrote to memory of 2744	2080	msedge.exe	91
PID 2080 wrote to memory of 5908	2080	msedge.exe	92
PID 2080 wrote to memory of 5908	2080	msedge.exe	92
PID 2080 wrote to memory of 4608	2080	msedge.exe	93
PID 2080 wrote to memory of 4608	2080	msedge.exe	93
PID 2080 wrote to memory of 4608	2080	msedge.exe	93
PID 2080 wrote to memory of 3684	2080	msedge.exe	94
PID 2080 wrote to memory of 3684	2080	msedge.exe	94
PID 2080 wrote to memory of 3684	2080	msedge.exe	94
PID 2080 wrote to memory of 3812	2080	msedge.exe	101
PID 2080 wrote to memory of 3812	2080	msedge.exe	101
PID 2080 wrote to memory of 3812	2080	msedge.exe	101
PID 5812 wrote to memory of 2500	5812	OUTLOOK.EXE	104
PID 2080 wrote to memory of 2884	2080	msedge.exe	105
PID 2080 wrote to memory of 2884	2080	msedge.exe	105
PID 2080 wrote to memory of 2884	2080	msedge.exe	105
PID 2080 wrote to memory of 4432	2080	msedge.exe	109
PID 2080 wrote to memory of 4432	2080	msedge.exe	109
PID 2080 wrote to memory of 4432	2080	msedge.exe	109
PID 2080 wrote to memory of 720	2080	msedge.exe	114
PID 2080 wrote to memory of 720	2080	msedge.exe	114
PID 2080 wrote to memory of 720	2080	msedge.exe	114
PID 2080 wrote to memory of 4984	2080	msedge.exe	115
PID 2080 wrote to memory of 4984	2080	msedge.exe	115
PID 2080 wrote to memory of 5668	2080	msedge.exe	116
PID 2080 wrote to memory of 4668	2080	msedge.exe	117
PID 2080 wrote to memory of 5668	2080	msedge.exe	116
PID 2080 wrote to memory of 4668	2080	msedge.exe	117
PID 2080 wrote to memory of 2104	2080	msedge.exe	118
PID 2080 wrote to memory of 2644	2080	msedge.exe	119
PID 2080 wrote to memory of 5084	2080	msedge.exe	120
PID 2080 wrote to memory of 5164	2080	msedge.exe	122
PID 2080 wrote to memory of 6104	2080	msedge.exe	123
PID 2080 wrote to memory of 6104	2080	msedge.exe	123
PID 2080 wrote to memory of 4588	2080	msedge.exe	124
PID 2080 wrote to memory of 4588	2080	msedge.exe	124
PID 2080 wrote to memory of 2156	2080	msedge.exe	127
PID 2080 wrote to memory of 2156	2080	msedge.exe	127
PID 2080 wrote to memory of 2156	2080	msedge.exe	127

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fr.forms.hr.com%2Ftr%2Fcl%2FprpxW-wVFYhAXsMtMUIKqozr9Z3TWscGLL63CCJHYEhWPRLnp60v2TfqqWMDvkoWF-0P9SdCgriXi1MsCfVf-KjmtePOhRdzCabzqndf_nu0TvcGCVZ3lvKhmZhwJnAWBoasv0bJx8CcqpWNm8jVTqloL9BEXZxQoWkrMM1QiAJbkrLCj2IWWB4R9U7gS8ILe6tWcPyZL8P7yZhaQ2MSgZrhSX-OYrQ82uIv_yi5-LepQxV7msmizv1o40kwGwnYpZlGJeLWSD8pwjliM9UdqxJMEtWTr3JUtpAbRBWR4jx-iujlTQ6ADmjZWnzW9fwDNQHRgG1zFOhe6LDHIt2WG701lpyJbG8RSWLOMTI2UrDN1atyxDhGkHmtpQPqkLTYeGpozW--FgecyA08G6Qo8mgak_NHVPla0JvcWqmunAgmuFzPrbn9r2spVH1EE_3FWcqqCehhEz0K3MXye9SzFAHroxZuc8YDvvcCbqLgMDmtuJUaWHS3EpMMmZillk4F_TsrdO-wYG-jBYKKAoTNv1Mmr84uHDFoty1qV12sxuhsGJmMrfgfGqoACACBma4iXVFQvuvTiV0t2833HNN5O0Lzp2RI5EQMNoQOOsgOBWdK6U541Pw7xw9cij6jx6CK4P2W_SKSWJjGh5TQ1lQ69xzrwTflfWMgi_FILqeb0WxYTD86QLyzKVdpuKWt0Vnl-ahEh2bEA0Kqa-lx796igc2G30PRxXOseX9D2ek868q6L9jQs-rx1xP1Hvoj8kYavj6o9ZdeFFelcuUENmWIvA&data=05%7C02%7Cjennifer.bowers%40tceq.texas.gov%7C6cc8b3acc75948ec2b1f08def242dce5%7C871a83a4a1ce4b7a81563bcd93a08fba%7C0%7C0%7C639214566950924995%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=3W6RZYSF6OyBiP9N6Y9VoEKeBjWi88FW5slmbF%2B07HQ%3D&reserved=0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d8,0x7ffcaf5bc188,0x7ffcaf5bc194,0x7ffcaf5bc1a0
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,8692331865208688605,17977825672709648605,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    - System Time Discovery
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,9162502653221378657,10643383000364594179,262144 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,3717586487309496366,18009691678809196817,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,11127374759555514972,3887568045777300637,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2627918382698739575,3359510606911638276,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3952,i,8051584636485296312,6671204852365413736,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5664,i,15362057729119472102,18294810692390387806,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5444,i,13774735032143532927,9442099673387930979,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5344,i,9662224382456891027,9084701531102407480,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15677160358622170035,16652663391427131448,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,13486417221270348247,7803330355867030702,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7005826943064589152,11187437974347926146,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,15530824984139523006,4573008910254065406,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,8408583063460422777,11338981122774662088,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9570723502392972739,11022893241550301035,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,4749682766599624573,17844371144752702273,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,4749682766599624573,17844371144752702273,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,5697235801600020268,4367479355676703497,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13821572041917734223,837673650550908342,524288 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5244,i,14626252007968089731,6175587417190084083,2097152 --field-trial-handle=2392,i,9392218380631956117,12686821048247807376,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fr.forms.hr.com%2Ftr%2Fcl%2FXFHRCDiNSlWEfGwq5Mqcz-7gnoAMeBJilqmm5O5dxAAWgmRvoCMnpxzKAVMGtqwzlYcWWVfL6Yw7UOsrmmbzseIDg1N1889arjnnitxPi1ZEbni4bcpT72QoqaqC_cXpjONWRC_GO3QQJ17cMu-IGLUAXWZFFzgoEQvQf0UsSKcyI3QGv2yOBGLjiqWh6UwCjY5WGkYi_Vx3YRW5UhNIsj7qmre_CtcJ-MroTOSqRkm76N0H1-9Dw1C4LVxyvh_3Es5D_zn8zIUmm4Lf071wekhmEfn8St8R_DWQaMGzq7F5xRvNOv2v1-NVRYhMEAVkPcV28NMIraeT98PxmHWpr1FEkCqzKKzbkdAR9OGUcQ--ERfhFKm896FPRJS5-p3u_3QZ1wnYWdTjxyVhUtiWZHc3elRvapd9IVxXBm21_sLxpcFNJq_HFf5qQHTpm3JpVoD4uMaAlrqCXT_ql3B9CMbtlioQ0tTLA4O0RFOtVYraVAT5jdJf4k1XB4yLSMcEekVTWAeLj9ApsAsgY9zNX_YXrIjnmJP31sKD8WlN2uvlUZKxSmgRpbISkLBU5EwYWjlImkXr8OzbTc1XNejX1gRNqu7ZaGcD2_KaTjXksrzBwjAE_UlSxtDBq9XwRdi3BTKtLxNNMBJs8ar1sOZkbn096MxGYbNCzGDU1DkjXjXMol9nPB0grLZ1Vh_WbR4QiIa3_vBaGxGXYmpzN1YWGxb6YJbvxOh1u7GdtFuFq_KL5942_IqLwpd81IkiNajXnc-MXDWIU-uolum4k7ZEzw&data=05%7C02%7Cjennifer.bowers%40tceq.texas.gov%7C6cc8b3acc75948ec2b1f08def242dce5%7C871a83a4a1ce4b7a81563bcd93a08fba%7C0%7C0%7C639214566951049486%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=JH5vdNLr1tmUVLR9cv8mkk%2Bt9VBtXG4S5Dzr1k0K2dM%3D&reserved=0
  2⤵
  PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d82ea9f5048a058b54054c19091e561a75963ea183ab115da2cdaeae6cb560e
MD5 b4831b12b2fbb230624b96b07ff5ca17
SHA1 b070ba34c6404dc203aaeeeb4e6159ed8ff901f5
SHA512 6a6ead2273affe341c133002b1afc54dd45448838689498705d15ed818adc543fbb7f0ec5232cf85aba2563f70647330a3e4e7eb8b436ddddfb01869edc7fa87
TLSH
T1F9E022A6DC22EC2708FE0B19A089974AE70117673A40995F3A3C920C8FB472A49C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0a00ef6fc380178e24993c5063fe51a106a83d2f4e56473e8d3e98a13b48e471
MD5 1ecc6eb58e01beb02fb6fab60c715684
SHA1 b9d93d5b21553a212fd9249bac30b5362651b4fb
SHA512 c2a0bbb3103179ca1103e676f0c72370e10f1d7ca1437d54e12e3529f2f6b8b6f9bc478fd18cf34981c112275837b3c9d9783ac100f949b5d96a96d5c100d03a
SSDEEP 192:sxZ+kREyMqZjK1Ml8MjD/fGs/cdZdIaRuvEzodpIloHW6+WNoBmZrI5P5tIPD+oQ:sxZVd7D/fGs/cdzIKY3NHb9ZrUocgTG
TLSH
T1F582F856A9345A7B8DDBD22AF580BB63D7F5113395904E84AAFCDE1C00D7AEE310281F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4c4c843d66c457bc5e031fd3acb225964f6d7957a4189903f90be924c75e39bf
MD5 3d1b78f0a032a5175050c36ad549c523
SHA1 c9e135103c2e00f83120e94ed56c3d24357cfe7c
SHA512 62febb47aaff85a9f3b1429d4e800b615b509788e3c120bf8b60b86429f8c3ef0b6f2a0f1c447ea1def4c8daa2b29fea5e6d2b13c92c785ca850d475c25c4f4f
SSDEEP 192:sxZ+kREyMqZjK1Ml8MjD/fGssmc8aZdIaRuvEzodpIlkHW6+WNoB2/9hILma2PIG:sxZVT7D/fGssmc8azIKY3FHb1/WTgjf
TLSH
T11472E846A6385D7B8DDBD219F584BB93D2F9153291904E84AAFCDE1C00D7AED321381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2f5c1a3320147f642fc9ff45e6860b3f606bc683e54646a76b7eb9184f470b1c
MD5 f09e8b71390a4fa77078f203bcd6c3ff
SHA1 de64a203e31c34ece3f7eb26d6c7dd28fd903230
SHA512 94a1a785bdd33722d6e5954e8354f7f20221ac3e712da3849ce391de8a3763e610d8223aac5db746197c44d05044339dbec9c3104ab09f3ec6395234aaef3b6d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6ysy10Lli:eY8Od/HEnFhWvFvQXu1jait10Lm2Nuo0
TLSH
T1D6F2FB3B6C0CCB7E4F844E9CED2A7F8A6DE802CB5698895447FA844C02C76EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 5c1636c3dbcd3ec5b3f9f442fa84e4de0eaccf797058bdaa0fcb9a57af993dba
MD5 31fcb46a870c7bc4f589cc9cf5fd4b34
SHA1 ffd8f4de1d4fff7c0d2caed57fb8d7f206f37b84
SHA512 9512f8e9293882959e444d216a40b30bf244cbdb4b83b2aabea0f1d7a2347b61a28f240903ee199639cc7eccb876ec29682e26012677d0b53fa47014a6535654
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGn:05ppxnY753RNBvRJJdt7p5J9fvXqHg
TLSH
T19CB2795A713E0202397E2948B39696364F4235A33058E4BF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e49d4640fc5059a49469cd376044496f8415e3dd6a963c66c3be10c8047242b8
MD5 cf9fb4f3f1391032ef97ecf0fe6b88db
SHA1 8d849cba0e2ee8a6c173b92ce4364cd1560feb86
SHA512 6446412f0eaab95a4cf6f848d2bba764385fbf9adcfc7d9bb27bb86ffa04f7e2cc9abed64339a4b408d9f6dc1c55ea262368445b78d06a5e37ac2a40a13bb972
SSDEEP 384:npdiF9CcmyWCs3sNC8TUNTUlIm2QckCr9lvKphifGGb/4w9Vob/pdEe4KV8p0TH1:pUFccps3PwgbkU1kFGb/X2bMI8p0j1
TLSH
T1E0B26C36EC58CEBBEDE74F89B74A7A07DEE01227859C59E4DAD85E0D00971DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 269591208f15835da91bf934f19bf285395d967972d15ba5e4d18d5a98b0d441
MD5 24ac994248339cf7a8c8763aaabf4e40
SHA1 58a192df38abea2e17dbec80a27bc662a1d87828
SHA512 f0182a33303f5c0df7b8b98948c6d0c0d06044b50d98a7b4d1fa332781614d50f3bcc89574f23fa8ede9538e17f989a4692dedc243bf46451b0fe6f843eca4c3
SSDEEP 384:npGiFUCcmyWCV3sNP8TUNTUlI4EQckCrdZWphifGGb/4w9VokEL5dfIty/7IgZ:ptFfcpV3OwgfkmIFGb/X2kefd
TLSH
T149B24A32EC68CEB7FCEB4B89A74A3653DEE45163898C4EE4DAC85D1C00971DD174B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 39f4435eba6f26556c4416a7fdcae60e515a13b338d3b8e967463f5e9166c003
MD5 a120d220c4a806eb86ce452ada0325cf
SHA1 d91052cac3e62801f0ed14225d4c910e4e366041
SHA512 1087f28c24f97c0740f5f6dfa3f5449b5ebc0851ec6a883ba01fa5ff1c98b8d119680661e293427ff52bb451e6f8e9d873389a778b08ec54ce5c56eb793548c3
SSDEEP 384:npGiF0CcmyWCV3sNP8TUNTUlI4EQckCrCoX2phifGGb/4w9VokEL5NfIty/7IgZ:ptF/cpV3OwgfkAXoFGb/X2kmfd
TLSH
T146B25B32EC68CEB7FCEB4B89A74A3653DEE45163898C4EE4DAC85D1C00971DD174B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0985db2539d1097f3aae99840d99ce06bc9d6b7d6df3d01257a66e2b41ec1b1d
MD5 af3bcba352b65cb8b4c49ddb17eaf571
SHA1 ccd6f3de924d3e38113ebf965e3034d6b958d195
SHA512 ac5f18ac2440da5bffee3fcfddf61acf714d258f41a593113628dc09810c9e7ff95d4646068a4fdf8215d03b9f9e38cc9c81a5fa8f5540b406c4065f77cc1f97
SSDEEP 384:nriFPZcIZ3sNP8TUNTUlI4QQckCrCGX2phifGGb/4w9VokEL5NfBeRs9JKgqijU+:GFHZ3Owgdk+XoFGb/X2kmfTjKgqmUC3
TLSH
T138D25A32D868DAB7FDEB9EC9A78A3647DEF00163D98C5ED8E5D85D0C009319D170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6af4e0f76e3c51a36cbc8909acdd5951c33c15622128bbfd2a8872c789ad8cbd
MD5 dbcee83360fcfeac74adc86db8112d7a
SHA1 da28c59f39288bb79707d36bc0baaa45ab57dcae
SHA512 7530aeac13e14f4d0eab351d4eed9ff11919c52593d8bccf8f0d435c1e1766e03bd213da5cc932168e34e1c7b654c3478ac9fa09f428db402cdfdfc86c93a14e
SSDEEP 384:np2iF9CcmyWCs3sNz8TUNTUlIm2QckCr9rfXphifGGb/4w9VokEL5wfe4KV8p0TV:pdFccps3ewgbkUTZFGb/X2kRfI8p0j1
TLSH
T131C25B32E868CEB7FCDB4B99B74A3647DEE01263898C5AE4D6D85E0C10971DD170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f37b75b0f44d3e50058ae5436c110c6f3312d67ea212e202dfc99925856abcd4
MD5 d8d3e3db18f460a9f1ef94c1dc436f72
SHA1 f1d9ecd0a596dc4286572af2aff7399451de3681
SHA512 fdaec631fc5b9f5414e411a638bede67890ff1dbed8cce27899ce84af563c0568b129057d29be44f1952e05a6c27307783a6e87ac19693ae43f18c452ac5659c
TLSH
T130412A48B6F91108B3B7BF5A9BF2A8AE447F7C772E46D49D00110D4E0A62B41C972B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 070b0578f52a41fa1be951886b2c88db3597892b1ba21ec6aecafd7a2522883f
MD5 a634f527937f1724c0f4621dd97c5881
SHA1 1a33315a21072f9f3c8550f8c6cc504b125cda0d
SHA512 07a75f160ad5273660ffb641351d2c4842e814539615a1b772440728af8419633878c53d36c8ee38571168321652a88489a9b1a48a0712632708a922b8345266
TLSH
T1B1513958B6DD1148B3B76E16AFF2B56E887FB9732B06D18D10050E4F0A22A40CDA173B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5812-13-0x00007FFC94D50000-0x00007FFC94D60000-memory.dmp

Download

memory/5812-10-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-39-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-42-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-12-0x00007FFC94D50000-0x00007FFC94D60000-memory.dmp

Download

memory/5812-9-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-11-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-1-0x00007FFC97050000-0x00007FFC97060000-memory.dmp

Download

memory/5812-41-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-40-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-7-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-8-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-0-0x00007FFC97050000-0x00007FFC97060000-memory.dmp

Download

memory/5812-6-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp

Download

memory/5812-5-0x00007FFC97050000-0x00007FFC97060000-memory.dmp

Download

memory/5812-2-0x00007FFC97050000-0x00007FFC97060000-memory.dmp

Download

memory/5812-3-0x00007FFC97050000-0x00007FFC97060000-memory.dmp

Download

memory/5812-4-0x00007FFCD706D000-0x00007FFCD706E000-memory.dmp

Download