1161cfa4454f2b98201f3a4d7ffc16d65f459374097fb52664345239786caaa2

Analysis

user interaction
yes
max time kernel
38s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Message.eml
Size 19KB
Sample260804-tkjfgsthnc
SHA256 1161cfa4454f2b98201f3a4d7ffc16d65f459374097fb52664345239786caaa2
MD5 165fd321a493e817d615f9f4ea18bac6
SHA1 4568322580a82d571152a8ff280593661a4ea0c7
SHA512 5429610721d7b724d6fe83ed22c16ed7bd178d65c30d0c437efdc792d863ba92413afa1b3d7fbfa6b516735753c7329cb90be0815b69059306b278c8a1df3bab
SSDEEP 384:LVTUVsxe0B2Ux0jAvW2dSVLjQt5xEw2rjdSctP:L5asxe0B2Ux5vW2dSV/QtnVeRf
TLSH
T1D5925D01A329045BAAD368797C117E0E37812F9DF3BFA1A03178A65106CF6C4DF5F65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
568	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303332369764251"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F7F2F8A7-448B-45FF-93B2-5174BCD74824}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3788	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE
3788	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 212	3788	OUTLOOK.EXE	92
PID 212 wrote to memory of 1068	212	msedge.exe	93
PID 212 wrote to memory of 568	212	msedge.exe	94
PID 212 wrote to memory of 1384	212	msedge.exe	95
PID 212 wrote to memory of 1384	212	msedge.exe	95
PID 212 wrote to memory of 1384	212	msedge.exe	95
PID 212 wrote to memory of 2120	212	msedge.exe	96
PID 212 wrote to memory of 2120	212	msedge.exe	96
PID 212 wrote to memory of 4796	212	msedge.exe	108
PID 212 wrote to memory of 4796	212	msedge.exe	108
PID 212 wrote to memory of 4796	212	msedge.exe	108
PID 212 wrote to memory of 1216	212	msedge.exe	98
PID 212 wrote to memory of 1216	212	msedge.exe	98
PID 212 wrote to memory of 1216	212	msedge.exe	98
PID 212 wrote to memory of 1132	212	msedge.exe	99
PID 212 wrote to memory of 1132	212	msedge.exe	99
PID 212 wrote to memory of 1132	212	msedge.exe	99
PID 212 wrote to memory of 4252	212	msedge.exe	100
PID 212 wrote to memory of 4252	212	msedge.exe	100
PID 212 wrote to memory of 4252	212	msedge.exe	100
PID 212 wrote to memory of 4760	212	msedge.exe	103
PID 212 wrote to memory of 4760	212	msedge.exe	103
PID 212 wrote to memory of 3888	212	msedge.exe	104
PID 212 wrote to memory of 3888	212	msedge.exe	104
PID 212 wrote to memory of 1300	212	msedge.exe	106
PID 212 wrote to memory of 1300	212	msedge.exe	106
PID 212 wrote to memory of 1300	212	msedge.exe	106
PID 212 wrote to memory of 2828	212	msedge.exe	107
PID 212 wrote to memory of 4796	212	msedge.exe	108
PID 212 wrote to memory of 2828	212	msedge.exe	107
PID 212 wrote to memory of 4796	212	msedge.exe	108
PID 212 wrote to memory of 692	212	msedge.exe	110
PID 212 wrote to memory of 456	212	msedge.exe	111
PID 212 wrote to memory of 456	212	msedge.exe	111
PID 212 wrote to memory of 2364	212	msedge.exe	112
PID 212 wrote to memory of 2364	212	msedge.exe	112
PID 212 wrote to memory of 4008	212	msedge.exe	114
PID 212 wrote to memory of 4336	212	msedge.exe	113
PID 212 wrote to memory of 4008	212	msedge.exe	114
PID 212 wrote to memory of 4336	212	msedge.exe	113
PID 212 wrote to memory of 4896	212	msedge.exe	115
PID 212 wrote to memory of 4896	212	msedge.exe	115
PID 212 wrote to memory of 4692	212	msedge.exe	119
PID 212 wrote to memory of 4692	212	msedge.exe	119
PID 212 wrote to memory of 4692	212	msedge.exe	119

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.zoom.us%2Fdoc%2Fe04KJoV_TKKhBw7zpXqnZg&data=05%7C02%7Cchris.loughran%40tceq.texas.gov%7Cd3dde06a11bc4d21e83608def23e8f91%7C871a83a4a1ce4b7a81563bcd93a08fba%7C0%7C0%7C639214547708522143%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&sdata=Ml%2BZqgFPN%2BoM%2FkqmLHfACdDk0LY4lnvuTvphF64mrUQ%3D&reserved=0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9ad79c188,0x7ff9ad79c194,0x7ff9ad79c1a0
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,2203231907259584717,17887726938807070014,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
    3⤵
    - System Time Discovery
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,12866917656774364899,18103945255032039018,262144 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,10185041193278419554,14590154602319298366,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11586036059014354237,16747763817450110260,2097152 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,667317208777180059,16156055116560496706,2097152 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,14509978345403987844,18013544627500274993,2097152 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,17840398625318565161,2899021656872536153,2097152 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:2
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,3783194812484700765,6738730890373752778,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,16061365443472647007,1546766393932350990,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5144,i,15638437057883271579,11822795729720577244,2097152 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,15703096451137286764,1447409516701349093,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,4567143567485136456,1214171756062631761,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17234278066943879564,7968886046031473568,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17234278066943879564,7968886046031473568,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9789006766873397792,18256554609138621175,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8422802652599894976,10991907899985744628,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5717759584360597715,3523597174840184655,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5924419399447329495,11544886176046474253,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,9950176987077958067,15107039977195579861,524288 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3668,i,7145935785155565995,2251767255879219484,2097152 --field-trial-handle=2068,i,2495398643877945952,7129921147210897533,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce6612fa5fcb5a512497cb33ab0a3f706834ad222b5696f08863894b1e22f287
MD5 b61a574baf562cd71b636a2b715fa711
SHA1 1fe7a2a795a9ea179937e2326d82f7d0c1f76cbb
SHA512 57b5f9e658e9938a2274a5d040d251b026a2fcdbd7196c08e91c9c8804e840797cfa3f824cd2d748b67ff79abda6aef8ac5f973bef648bd0029490924828ef28
TLSH
T141D02370B83193D0D219003C0450B5011218877236674362E140880CAD3200083C69D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 edae6ee69025ff956dbe8b315e46aa09f95cc81f6a169353a6249a8493f673e1
MD5 a4386f28edf3f57c55f306c3b81ab785
SHA1 1712d59a91bcbd32f4a0b4acc8ccdf960a4f3b5c
SHA512 ec38c2969c39c6083f15ede5dfc5c39292378a009dffbef55882ddffeb235b1f01fcd940f9eb85bc1eada9c3570d02d906f03a815be8db3c0c231ea0b3d64e02
SSDEEP 48:YZl39FM7Nz2ZWAfOMHDL/kw5laTFJOYLqazVjfBeXHkPAh/+RVJX4sNgwW7DaEnA:Y73neNzuWi/kw54pg0INAJXvgz/kr7
TLSH
T1B6A162FD2E91509BEB58C0BE4CE2C42475A49BE4F50FDAEABC404E30240BBE1C259B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ec01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ec01.TMP
Size 3KB
SHA256 a95f65a2940a127bb41ef3a38517f5945f198ddb33aa736fbdf43f5b08fbc502
MD5 0fc842f1695d32c77938b13a215962d2
SHA1 f9b76b95ca8e796a0d550d01f1f1454133159d2e
SHA512 0d7c585aad087a10bb7cbe7af8370fb69eb6f9387bfcf362412babd95b3f9143faac3c7184d6743b2dbb80dd6f6944e9765c8079c2825cc7a064fad52a38de79
TLSH
T1BC714CFD2A52419FF354C2BA40F2C10479F195E8F41FCECABDA04C302656BA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_docs.zoom.us_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_docs.zoom.us_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 30e82fc0de9bf8170bdb24caddcad4b24b0ac69a81965d9639d6d741fc83da13
MD5 42234867d1fdcf32aa984f291c249fcb
SHA1 dd8ad51a9a5318e329526213df4daa773708c815
SHA512 08d53fce5dcd798e3b13eb2baa1e55eaa5099e1d95193d00de57b16118bfaa983f06cce804d1ffeb4fad3f46410ca65fd6a16fd109a3ba388ef5d8d2077dfafe
SSDEEP 96:DGOM36QfypOzLxu5LqliFwT0AzvSlq/BP1VkVpPEG4:DlM36wypO3xy+iFi0AzvSlqpP1VkVpcH
TLSH
T127C1BEF2C7E88A6DC90156F0A7147E2BCE5D0A1653283D1AC8E8FF5B93F2475E24194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fe22a9f27dad55905099972d8bee8258acbdb635f85f7a59889f8d345d72e2dc
MD5 a0d4d46ba45ade00debfa739945fe2aa
SHA1 99bd5673f09aa1a973132397d3dbdb7ca77a4c53
SHA512 d5caacd886caab93ccecfa2f15b3baedab95bcb008eba5dc45119f41994559bc3937c9122b5ebe633a316234811eb78ce40b69e775b0dc662e4447514fe57114
SSDEEP 192:sxZiRCyM/jK1Ml8MiD/f/sSpY/z7Gx0IdpY9HW6+WNi8z/YCM4XuiRIg4J:sxZisqD/f/sSpECxtsHbx/1uYc
TLSH
T1F0520815AA34A977CCCBD208FA557F53D6F55473A2904E489AFCDA1C00E6AED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5655bf72ee67ded16a5d0636f01d69a9ec5164e7b1488158d97bf93c0829b69a
MD5 8b2847b9495e914bdbac66744c225353
SHA1 302f3188b173a1f031b220724e78c53f6351fe2c
SHA512 db76fcf6691912399894f5a60af4bc1f86ab173025eae5f2f0cce6a199bb6e59c9bcea16620ae6a12e4fa0d9f3e45fcfa413ab7684386601205fcd40bb0f5660
SSDEEP 192:sxZiRCyM/jK1Ml80jD/f/sJWpVlpY/z7GxrIdpUH9HW6+WNTtqeTXegrGIiXuurd:sxZisxD/f/sJWvlpECx0iHbBXeDuujl
TLSH
T14D62E815AA34597BCCDBD219FA517FA3D6F5143292904E989AFC9E1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fa3ab0a243dadbcb0989402c315bfe3e492613487785e354b0cc7928eefb9638
MD5 439dfac525699729b37ccf7229cb169b
SHA1 dccff01c550192012def0a4801bb8a611024d413
SHA512 ee1c97bff4a4e13dfb601723264c0df9d656622d7db76a769d01c39cc7761402185e8aacdf959a9d1e17952ffc1f4bdb8407056384fe6b95038fdf4d93e69328
SSDEEP 768:Xw8bquV7pLuLfa+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVQJLZLlRTKVgroe:Xw8bqujEfa+WvSCt6u1ja5JLZLbWVre
TLSH
T12EF2FA3B2C0CCB7E4F804E9CED2A6F9A6DE8018B5698C95447FA980C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\b646fcb1-01e6-4050-83d3-58adafc73702\index-dir\the-real-index
Size 72B
SHA256 b3cd6d70c0018370f805f0a2ecf783848e8eca9ea6a410d3442d6b1917675988
MD5 ea63039bd51a2014a9e6fbbb7eebc8b9
SHA1 ff4797ee13bc5091bda90bfadcc0c43ca62d38a9
SHA512 51b03a45e1868deda666c161247e3cf6826c780b21de98d6e4da8751e82e6b82aa0a4d01806f9641b495f7cb5cd9f034293b789aef7e04fc8e11fbbc6215cc7c
TLSH
T181A002594A849083D03017F4D40B15C257054C623010572B83A1F9748C70054818200A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ebf1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\b646fcb1-01e6-4050-83d3-58adafc73702\index-dir\the-real-index~RFe58ebf1.TMP
Size 48B
SHA256 bac7067e17a79c850e7e0fab704b92308fb2b5fcd9531b7ec7a58a2b66174e73
MD5 480e334b10d6caba72c160ad1a7d1b3b
SHA1 6c40835b898f53e1d0247d2bf93bf46045f4f7b4
SHA512 a6bbba9f968cf89f6ec2c9f0ce82cf62c77237183f9cee21cf1b790096db04ced30a681746ed8ae1885f7536cb63fb27a73b80f82f3c8a220251516a1aa100ca
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\d825ec97-d4dd-4a8d-8aa0-ffb2559e4918\index-dir\the-real-index
Size 72B
SHA256 f9de76805180010b60ba1a85be87039340f6fe232d5bb55e96576110265c1784
MD5 9cbe2a9cf84f80f17bad07944ffb59f3
SHA1 dd61364aed60370bf95bc6226564c4fd98eea30d
SHA512 673ab8f869d117e19826cea5fa112064674b8701989e14cae3315e7e3b9e59c8db521f1fc24c2fa605ee9474ab78f518f0527825b0551901e8272c08a17ce140
TLSH
T17DA002950950C501C4C105B4F8D50A8013859C604844860242E125D8DCAB942C145000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ebe2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\d825ec97-d4dd-4a8d-8aa0-ffb2559e4918\index-dir\the-real-index~RFe58ebe2.TMP
Size 48B
SHA256 a9b19fbb857b5f56e832f37ff9228aef046f956955c20d628fcd568a89fc9667
MD5 8ca63ed04fd1834845fc835b1bdcdd11
SHA1 edfab15485ac2f476701b7a125364719d5de740e
SHA512 d13ad6971f6bb3dc71d46862118f7730a90dae16a9e8e4c4f56c541b835cc0ab2eee229be808084e1c7a71d1eeae93b2dd29474240bbd8105f272302dad12667
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\index.txt
Size 241B
SHA256 63f4b17d3a08c44dc7f26656c4418fd0b61e57af9a8bce848c039047538dff16
MD5 f7ecf3bc0828d8daf8b228917f2da883
SHA1 9b6cc2b65ac4c50e7c5354ea783165c9c25db69f
SHA512 33732b32135df09fbb332c039dfebcfe4e79f577baec7341ee95f3247ed085cdbb92964c8261d1a9699fe57558eccaa0ad569e2d4ca58204a238ade98c88d868
TLSH
T192D0A7632A56C900F996CB864164E8088A057F8D4906C90C4CBA2EA86971D25DA4E530
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\index.txt
Size 327B
SHA256 79ee3307f94d78d504a591778bc735491991833894b4e48dacb0e802e535bd43
MD5 e82bf929f763e16d4d7a6b0877fe971e
SHA1 5397be79d5afe07f0f37faf330caa815584495d7
SHA512 4583ce3762d6d1a3901eabd74075d7789ebf86d12196993eedac66da5e707436d83e77a2acc5111a45b40d56c361bd3fbe398e15f23ccf42c29b1b3928c3f597
TLSH
T127E07D531E03CD04B8D2CBC64054F828CE01BFCF4C15CE088D6B4DAC5960D54EA8F431
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\index.txt
Size 332B
SHA256 f4966833b8f6946f9c102948faf34a51f522417bf3b6692b2ee6980e94e77f28
MD5 432e9581e666e11adad1cce72517c970
SHA1 240a39e99cc915114f543c8df1f35776f5c030a1
SHA512 b0bf0befa063f3a79c4d6cbc475c2cdd7190a3285c18cb5f480a6e00452453edd8b691bcc4b0dd4d290332db4ef8c9b70ae1068ea0280e32df31cb223be36d11
TLSH
T1ADE026531A078D04B891CB878064A418CA01BFCF4C15CA08896B6D685970D55EA4F421
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b11b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8db12fae3ff427996b8e2a99e204c018c8791\index.txt~RFe58b11b.TMP
Size 146B
SHA256 6ead212c919567127dea12baecb5cffeb5bd76fc4aa948fd242cfa96caa24cd1
MD5 d1d4bfabc6159e6c58202d7293a22d4d
SHA1 f7c80f913c6556e52420a5ccc1ba0d4651cb973e
SHA512 f0b3ab754fd8e0dae1875a9ce6bcc1854843d46497f75615ef0134aa79c5f95c9c51374084aa1eb95d3312f777fb890c984b5c03dff694d00287b819a4e9bb55
TLSH
T1E6C09BB367058C046517C5CD5251F44597057F8D494E854C4CF67E649A75C74DD59420
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 83beae1fc3bd153d90a8407a13ce43d70f6971038b1306900830e88daeb26097
MD5 1b9e319b751170ba43fddf9245ac7835
SHA1 5ebe2b391be8e2d9093faccc2dff00202569fe11
SHA512 496e99f76b8f01fa0846d2cc52de79c0614dc971f21907d5326d9dc0e8b02b47b5ef0663817485f756fff85a1d96ba4740bf1ba857ebe31acf0db5fa3bd7a63f
TLSH
T10EA0026389554690C1450170D90503445309AA221000125D51F40D58BD994B1955A055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ebe2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ebe2.TMP
Size 48B
SHA256 e10983e22f5f6dbfe90b88a993587d3648d98340e748776d8ab45ba50c5193c3
MD5 eecb84b7694fc28af1607d4f6a3cbec4
SHA1 30a4a8872591db05dc4c90d6920a99c37e8b2641
SHA512 8a8fe57d6832399f2d316265393d38490880ae2874e23271dcba357dd5a962f0681ba13b3957c47edecb7215e613bc0f49bb4e93b0c26c400cdd041c5c6b09fc
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 812468ddfe64f678271097176076bf099e5480085a4cd2e0be6a99be71e89656
MD5 91e2c21de099a90b34694f77b2a584e3
SHA1 d77740c36ae0d9409924882fe5f42dbd74b9fdcf
SHA512 c2cd26b2276c63b31076cbed6bb843f08abb624c7bb56b71e220917f2a106c54e9b1ea41a7e0d1df4a2781241a924ca249d7a6fd4e0db92ea7d363fcaa022fa0
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdqmdyKW0ag:ynBtXItg
TLSH
T1A6B11222727B034238BE680C96558B2B9E5231E33815A46F7BFD40520EB7E215DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b6a5f2c35e28806c8f68df91a8f45939241c411e31b31487043a48f5d8613144
MD5 4127037cdfe4bcd9379e5242b912b0c4
SHA1 71271309b770212f5075e7fb101997bc935e09c6
SHA512 0aebf21e8996f46d76471bafacf216f5ac4fa6f15e265ffd1301d9247c2edfae61cd9cef8e00f0c3d90fa7cfbc8fda39b03a9ef309cec6d9cdfa6272cd278309
SSDEEP 384:nwZcIhsNBXi1XAcEa+UOH+MH1uyBeRs9JKgqijUaF:Oh8hHaJOHZVjTjKgqmUaF
TLSH
T1EB928C3068389D7259EAB545F8863B674FF86077E981AF95E1ECDF0C009764C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70c5fbe29088156799b476363c8e926421824a05d64b2f3e4020259699afee88
MD5 9bff69dfb2f4161d7594706d85d9ba53
SHA1 632df8420754303ee40590f261138110da1aee56
SHA512 21eff3b4a0368774e9f16267fbf1165b5bbe8fad2aca0a2c5f9967c34a0b16ccb14dea457359acfde4113be86912b8fb5d05289d63ea611697999b300ce98efe
SSDEEP 192:vONJ6Db6QmiUy4GHBa+joOmw+4sRgsCU6:vONJ6u8HBa+UOH+WDU6
TLSH
T13802C73568785CB79EA26E49F88B37279F94207B99966F94D6E81F0C00D764C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 453bd303376836d21f952bc9e9ffc469f668345a95e8e51b5dd4162f50eb22e7
MD5 525f135feec5c425a4788f457adddd1a
SHA1 4d277aff233b9f4db1c8e5d8982accb93a2cdf5c
SHA512 3a968f55efe98fbfc038ad5fcaed95337f252231d18cffe3d58bd5519bd96969cb1858411cf0603003f4cd9c30b1f127354913f574dc2815f583c97b79672eb9
SSDEEP 384:nPZcIhsNBXi1XWt2Ea+UOH+MH1ovASw5ILED5C4Mk3ABeRs9JKgqijUaF:Hh8VtlaJOHZV1S6D5C4MkwTjKgqmUaF
TLSH
T1C6C27C70D8682CF741A5F9C8A582E6276EF41037C19D4A4CE2F8BF3D305F8B81316926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80fc2b58f398d053d3362e42511d3b8ea5da16c02647df4e6d78805dec44c0ed
MD5 228a8cf7ed02b523b235caf28a924ee5
SHA1 71bd5cc073c0992d9ffab53c9142fc4b995da3fd
SHA512 09b9256e8e79f3bb17ec9f7fdd79838c32c5114cfa21b3f47150b69f6b45acce534ea413f2d8f6c4f6d6d10303319155e5e0d3c52fff764a4e8a59a9444960d4
SSDEEP 192:MONtW6DbfQmiUy1GMBa+joOmw+4z5FqNzxrqRlyU6:MONtW6JjMBa+UOH+MHeuyU6
TLSH
T17A12E735683C9C731DE6B548F8C736A79E9920B7DC46AF95E2D85F0C00DB64C270A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca49bcd3-ebeb-437f-873e-3b65ab156d2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ca49bcd3-ebeb-437f-873e-3b65ab156d2d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 bfd38bbb39d8b4b6fdad9fcfd1dd67f40fb363f04d4776fda629e8a4f150893c
MD5 74f25ec97ac2b492de0fb159de8fa376
SHA1 56ccfc6f7b9ffeb4faaa91e7922275f324ae3900
SHA512 0231e9a415b52b7c49fbd7d79a7ae653ca1696413f98024258b1144889fd60b0289e2d1b8f540c7630520dca533cb043d15caafe9689fa9a6baf0f07086ce01d
TLSH
T19E41285CA6EA1119B3B37F6A9BF6686D087F78272E07D49D10110E4E0622B40D8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 16b1102c565cdc0700da00cc954e0413d89dab0c097b06ce796fc3f00b436c2f
MD5 c3ddc9acbd737cb6ff6efe8522981f59
SHA1 bb16f8c8aaee8bdd6fb6f434c575f3ffa13855ff
SHA512 f5c59b80de654739b7159ee71fa65fece48612d21435f95b3feb343ae289df290549e76bf6956295f7b81e07c74af2e5a36b49ac9163753b33cdadc69ab5b037
TLSH
T12C512F68AAFA1048B3736E599BF6796E487BB9733F07D19D10110E4E0623A40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9305abfdee31bbfd5bf916564d2ac2fa4117e84bc52f547855ab1698b751836d
MD5 2d67a1916264410f96d1f3b91871f9e3
SHA1 33d6655dbcce9a15a8259fac9d52966599039939
SHA512 0cfa4b023d942a915e7858d2c187c4254ae271abbbf4c60a717276d6d685e6fc13d66a79c2c292fc5449ddae164ee651736cb2e7e6c8546db585969af6d606ec
TLSH
T18D41075CB6FA1148B3B76E569BF6A86D487B78772F0AD46D00010D4F0662F40D8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

b0288c0a-0983-4e23-a104-9fa814a6e456.tmp

Path C:\Users\Admin\AppData\Local\Temp\b0288c0a-0983-4e23-a104-9fa814a6e456.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c88ed3e2-71a1-4132-adcb-647f2176b73c.tmp

Path C:\Users\Admin\AppData\Local\Temp\c88ed3e2-71a1-4132-adcb-647f2176b73c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir212_100079557\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f17e9386-7654-4da1-909f-bc51be93430d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir212_1297097540\f17e9386-7654-4da1-909f-bc51be93430d.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3788-10-0x00007FF995C50000-0x00007FF995C60000-memory.dmp

Download

memory/3788-9-0x00007FF995C50000-0x00007FF995C60000-memory.dmp

Download

memory/3788-2-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3788-8-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3788-7-0x00007FF9D8530000-0x00007FF9D8725000-memory.dmp

Download

memory/3788-5-0x00007FF9D8530000-0x00007FF9D8725000-memory.dmp

Download

memory/3788-6-0x00007FF9D8530000-0x00007FF9D8725000-memory.dmp

Download

memory/3788-0-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3788-4-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3788-3-0x00007FF9D85CD000-0x00007FF9D85CE000-memory.dmp

Download

memory/3788-1-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3788-109-0x00007FF9D8530000-0x00007FF9D8725000-memory.dmp

Download