9888ac439a3f157f3cf339fee7a7a6e1ed0ea523fce5695e595f32a64b150558

Analysis

user interaction
yes
max time kernel
269s
max time network
275s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d36572b2-2a76-bfc3-a6bb-7820a5a0805b.eml
Size 4.8MB
Sample260810-lfc4xafc22
SHA256 9888ac439a3f157f3cf339fee7a7a6e1ed0ea523fce5695e595f32a64b150558
MD5 e54b6c0c7ba56fc6924078da8b366bdc
SHA1 dc3f3ac8905dd526555a76e6cf59a13936d2806a
SHA512 f50ed1ce81ebee3031710f14a3c9f9f6c7965091fc16f561ebf8cd412d3f0ce129485d771a44150ca47e503a2b10a8cff269733adce18d21f807897ed311f3d6
SSDEEP 49152:2a2sfsRm1Ec0NQg17JOQqqOMzLN/zDCoMaC+bC7MoeKGJu5/5K4pGiGKtRcdXBxo:1
TLSH
T1F4363338888E27DE4D12D2F6F55AB8557DD937870C42431343BD86A634F81E88EA7CB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1500717461\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1899238512\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_96521474\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_2073119560\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_96521474\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1500717461\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1899238512\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4584_85290141\_locales\it\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4420	msedge.exe
256	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308278263108565"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{CF25666B-48BB-43F5-A68D-0264A4EC5A15}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F64F68EB-1166-4F4B-B9F0-107D16E196CE}	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UUMFE1D1\Lot 2_PD114 (002).rar\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UUMFE1D1\Lot 1_PDC27 Compex.rar:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UUMFE1D1\Lot 1_PDC27 Compex (002).rar\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UUMFE1D1\Lot 2_PD114.rar:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
5900	WINWORD.EXE
2884	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
2568	msedge.exe
2568	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4584	msedge.exe
4584	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4196	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
5900	WINWORD.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE
4196	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1064	4584	msedge.exe	94
PID 4584 wrote to memory of 4420	4584	msedge.exe	95
PID 4584 wrote to memory of 2016	4584	msedge.exe	96
PID 4584 wrote to memory of 2016	4584	msedge.exe	96
PID 4584 wrote to memory of 2016	4584	msedge.exe	96
PID 4584 wrote to memory of 4548	4584	msedge.exe	98
PID 4584 wrote to memory of 4548	4584	msedge.exe	98
PID 4584 wrote to memory of 244	4584	msedge.exe	100
PID 4584 wrote to memory of 3928	4584	msedge.exe	99
PID 4584 wrote to memory of 244	4584	msedge.exe	100
PID 4584 wrote to memory of 244	4584	msedge.exe	100
PID 4584 wrote to memory of 3928	4584	msedge.exe	99
PID 4584 wrote to memory of 3928	4584	msedge.exe	99
PID 4584 wrote to memory of 2404	4584	msedge.exe	101
PID 4584 wrote to memory of 1596	4584	msedge.exe	102
PID 4584 wrote to memory of 2404	4584	msedge.exe	101
PID 4584 wrote to memory of 2404	4584	msedge.exe	101
PID 4584 wrote to memory of 1596	4584	msedge.exe	102
PID 4584 wrote to memory of 1596	4584	msedge.exe	102
PID 4584 wrote to memory of 4752	4584	msedge.exe	103
PID 4584 wrote to memory of 4752	4584	msedge.exe	103
PID 4584 wrote to memory of 4752	4584	msedge.exe	103
PID 4584 wrote to memory of 3948	4584	msedge.exe	104
PID 4584 wrote to memory of 3948	4584	msedge.exe	104
PID 4584 wrote to memory of 3948	4584	msedge.exe	104
PID 4584 wrote to memory of 740	4584	msedge.exe	106
PID 4584 wrote to memory of 740	4584	msedge.exe	106
PID 4584 wrote to memory of 2160	4584	msedge.exe	107
PID 4584 wrote to memory of 4776	4584	msedge.exe	108
PID 4584 wrote to memory of 2160	4584	msedge.exe	107
PID 4584 wrote to memory of 4776	4584	msedge.exe	108
PID 4584 wrote to memory of 3348	4584	msedge.exe	110
PID 4584 wrote to memory of 5024	4584	msedge.exe	111
PID 4584 wrote to memory of 5024	4584	msedge.exe	111
PID 4584 wrote to memory of 5840	4584	msedge.exe	114
PID 4584 wrote to memory of 5840	4584	msedge.exe	114
PID 4584 wrote to memory of 5084	4584	msedge.exe	115
PID 4584 wrote to memory of 5084	4584	msedge.exe	115
PID 4584 wrote to memory of 2428	4584	msedge.exe	121
PID 4584 wrote to memory of 2428	4584	msedge.exe	121
PID 4584 wrote to memory of 2568	4584	msedge.exe	118
PID 2568 wrote to memory of 5372	2568	msedge.exe	119
PID 2568 wrote to memory of 2428	2568	msedge.exe	121
PID 2568 wrote to memory of 256	2568	msedge.exe	122
PID 2568 wrote to memory of 2428	2568	msedge.exe	121
PID 2568 wrote to memory of 2428	2568	msedge.exe	121
PID 2568 wrote to memory of 2348	2568	msedge.exe	123
PID 2568 wrote to memory of 2348	2568	msedge.exe	123
PID 2568 wrote to memory of 4664	2568	msedge.exe	125
PID 2568 wrote to memory of 3888	2568	msedge.exe	126
PID 2568 wrote to memory of 5460	2568	msedge.exe	127
PID 2568 wrote to memory of 2720	2568	msedge.exe	128
PID 2568 wrote to memory of 5908	2568	msedge.exe	133
PID 2568 wrote to memory of 5908	2568	msedge.exe	133
PID 2568 wrote to memory of 1596	2568	msedge.exe	134
PID 2568 wrote to memory of 1596	2568	msedge.exe	134
PID 2568 wrote to memory of 3564	2568	msedge.exe	135
PID 2568 wrote to memory of 3564	2568	msedge.exe	135
PID 2568 wrote to memory of 1648	2568	msedge.exe	136
PID 2568 wrote to memory of 2596	2568	msedge.exe	137
PID 2568 wrote to memory of 2596	2568	msedge.exe	137

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\d36572b2-2a76-bfc3-a6bb-7820a5a0805b.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2524

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8da6fc8a-1879-4ba7-b79f-6ce8091a08fb_Lot 1_PDC27 Compex.rar.8fb\800256.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d88936e8-8abb-44d5-aaa9-638e49158ae8_Lot 1_PDC27 Compex.rar.ae8\Schema PDC27_1.pdf
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffbf65c188,0x7fffbf65c194,0x7fffbf65c1a0
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,9884451740470554251,7177693196252483872,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,4179026632722520187,1778965091670581620,262144 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2784,i,1856202695807669378,6481935026379959820,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11452887983875502576,18254147803978222892,2097152 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,9330051087974402216,9519249644239007809,2097152 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,13812449226998495234,432833524181984847,2097152 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7397578809049274179,14660646634032225912,2097152 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5172,i,3537153277708830697,15975896928319762064,2097152 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:9
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5364,i,7881043458070514551,4487591963720738535,2097152 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:15
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15637571561380074673,4861305000898331956,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3037566220647597149,13836609983267060180,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6480856543451015105,3438792702281393464,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,16375373390161801564,14720530661619958209,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,16375373390161801564,14720530661619958209,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,6606034328834800092,799349594271986347,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,2383263493550740582,3648464390120546881,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,15971531222232904663,2607987902710963708,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,3618990696475460096,13983312729523254022,524288 --field-trial-handle=2196,i,7401900625324467775,16451457007282267688,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fffbf65c188,0x7fffbf65c194,0x7fffbf65c1a0
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,787705393804843787,13696438181082548120,262144 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,16000747120037102874,8860318182307177970,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:11
    3⤵
    - System Time Discovery
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,17656946569812348781,11007383346673859358,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:13
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,16625951121584159799,8394012628681098108,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,16625951121584159799,8394012628681098108,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,5262727382917829698,7931437391505006786,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,9666550381014743438,11835614751368126729,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,9298389243847304272,5929387395572630646,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,10763068199448046120,4415605400784704934,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,3873903606656282613,14977401821095335410,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,15016455077703923961,5808920629001157448,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4876,i,12891904082682746719,2454900587428628800,262144 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,7684617238335033347,1187939945212482247,524288 --field-trial-handle=2760,i,1577456403839759655,3500185438842061818,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3540

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2fe0175c-5fc6-4925-8945-0890d724d96d_Lot 2_PD114.rar.96d\800938.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7ad7f78c6f81c115ce6f95362bd947e87a2faa4874d7babdfe4354a0599add4b
MD5 6a6270612689ba1ccb0c69a8b83c5721
SHA1 ddb31cbba66bea9dec20e3fea163a0c189330928
SHA512 df27d938dbc7afd89fc624fd3aaef3c205b826d53c523c7a9fbe5e9a99d70dab7e3ad6340400f95570c8e8bac2c615e178332a1a269db50465d3bd5a9c55f07f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1AEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55a7d885fadddbff4768ba6c4d1831cf3c97e5cee2c6278de82c828bbd98df7a
MD5 b27d7e363563245c4556040952fdbf95
SHA1 dfc224d76f71496470da48460fe6bc98bd6b630b
SHA512 53bb58d5ad6a6e99815ef4adad0abf35d7e22ee9cb08396210cbf4d6d7c933cfd85b85d6129c7d2584767453a8628b8d168f33fd574d277fc5d3c3ab08469a5d
TLSH
T1AAD023F079B2E3B0C60C00388110021011224A723AAB23176240480CEF3C0C2C1CF8FA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1ec854c28a4dde8f950dd736eff851c97e2de74a6ee334a0c4f8ce987efef0a7
MD5 8f11697845b4fbadab0fde43aec86cde
SHA1 af37a7dc93f0db8fd6749a5664b19f0a2f4325d3
SHA512 8eb6fd72d82337a73aaaa5092a72a5fca4509a46c8d7233beb5861a8bd49cd0330b7e154c478a8e1ab7121086e1c741d7c2dfa38c63584207867333e415582e4
TLSH
T194D023F0B791D730C60D05359950732056B35A7034AFDB739151540D7E7D095D2DF069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 04f81df8736255aa11431f7c0a9cef62effcdfcab457142db2c9c90f54b8611e
MD5 7125ddb7ae9a5176fb6d412220d934fa
SHA1 c1aea4f1521dc38b6d1b3a031bb4f3f61135de78
SHA512 6d2ff58fdd063bdf3e42a2dd1a2bbf55f1eb77bb8c147b7b66e38f8ae9f82d4e07350dfb349a1e3a2353672177f2360914f3eba9d11ea270c2326b656830a192
TLSH
T198E02BAAC861ED3B04FD171960640747EB5013A727904A9B3A3CD1184FF133A4789C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 74eb5346026650e95975d2ab66efbc82c749fae4d05d64c5dd229bbd0b4446b1
MD5 9a2ab505323abb9cd911208af5bb3b41
SHA1 75ea57a019eb89c337158f38cc6a0a86268bf4b1
SHA512 f595c4757b4b8ea08c7b28f7feaa6589b1258e2dad04c75d77e4134cef5e9270e8a839410a2254880f8ab3a85e244a5a103f950783df91d9f49b8a5599a5c440
SSDEEP 384:mXBcT8JeNGATA2ZJ8mGEnjFcagCMtB8Kzcu:OcgJeNGU1Z2mG0pcagFBnzcu
TLSH
T11D13E83E72242C17CAD358FE0A9F9B32AB74D46CC2E14567577A35248B90F635ACE207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1eeda20f57cdfe5f7f6a47c5b8c94b92730a966a6e5f3f374d50256bfa1c9695
MD5 ecc6b345c571ea7616a20390ecf546a6
SHA1 df069fab219c6c77168a3ba68fa94f4e3a6cd132
SHA512 c7093ce709befa17961081b705e6d64593c1f97756366791fc42e33200ea0673d723cb74b033823543adf838057186e376dc12877e201eea0158fd51243ad708
SSDEEP 768:x/NVAUL/76LL/objnyIIRU+6bNj0qTDIJUfAcB6VuSHo+vwtKDec/af8GKdK7a0S:hpL/7QL/oxIGjl4J2SI+Y8ecy0uVdj
TLSH
T1A4444DF70951601BCBA842F5E6033A3ED1BB455D7CD1F9E9E1784C812829F32B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e15addbedf5da60efe8ae31a47bf3d804b87e210cce50aba6bc9170486fd4432
MD5 f8a7dd864341ba1f0aab7144ac44dd7c
SHA1 c4ef2461d1c3efad79482ed692f867ac4f452340
SHA512 292dac566ac3b8be2d9254fd5780b130ee71471338ed239c520516f3b8cc4dd9e96e8695d60ea6869f3074d1ae41e80318e5529223bfaf9960d180d6b4b2f794
SSDEEP 24576:5HNIZYfNbAojX3W7lB6KXxQeZxUpJDN1vpe/HU9:5tIyFb1jWD3XxOpLhpUH2
TLSH
T164166CEDCA7858C3CD639A30B5F0E9477C7413C3F994C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9db89decf875219434aa49d6fb467b6f49688b2700bbcec52e889181ec4702c8
MD5 3adc51223ccd058f115b6cdf48cfe250
SHA1 1ad35df7bea4f99ee759e955055d77d2733a1c9c
SHA512 0100f9c6b81e484fcda359e4658427e5d366e012ab8884e573127d70caf64d905d660499fda9e0e9cd4fd5900003a7a07077ea68b36108cc054a89f809a1905b
TLSH
T1E35162452BAB1BC2DB2287F19DEA146A36F1C84825CF5E30404EAD336B02F2F5BD1123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4ea9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b4ea9.TMP
Size 2KB
SHA256 1b10caf095aaa47916b43ff6a7237ccd3953174dc21af46d303f4fc98d0fe807
MD5 636876dd4afa3ae5790a8e989113d85b
SHA1 11f418e63611d92e8e18648337e3450fa5397f47
SHA512 432d9595635c4e6a918f303d0946419b078061f10fa7d742e196835b7efaf973574359ac35960ea8441e269765dfc456c81a2f748419579fed4a4e9070d53ea4
TLSH
T10E513C512BAB5BD2C72687F1DDEA04AA36F0C84861CF6E30404E6C336B02F2E5BD1023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 6a5a9cbcbb2c077ca37626d2c02c8d832cb88da72e667f247eeab05575a4efbc
MD5 0367ece56ad2a7aea4ef0715cf39c6b7
SHA1 72f5aeed874b9537fd7eaef6b9854fa88251d006
SHA512 8a65eb6167d92f7d6943ad663c0d419c4057d65371a1756e34b4ea1e2350c60b32b70afcd8f1f67b2ab62d49641cdab717e1c1397f84c130c6b2971467112756
TLSH
T1B7E0D8A565CAC1AD9D6075C75335AB0CB5D43456D685FD03170088C4B642611BA7355B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 7e5e2caae08201c1aacb8a9d51190bef6c2122bbef7f6bb599157ddda7cf665f
MD5 66d87a265d1f02ac6216d7fe668288f4
SHA1 c903e30f36659c70889655163ba91fa3a6a9499e
SHA512 23ee5fe40ff730863486cdb414cbffca4efdf2469938067128f8659ec36e9f787cc9660d4dd62836ffeb545f5650dee111cc089e643d494fedb1dae5fd785a81
TLSH
T147E0260454CDC979DC9469D38378B70CBBE1345BAA88FD0217488CC4A101B41A7B7380
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 e0e34dcb62c75568173c668df77f4f9dad23a451de72fe67f991ca184601e3d8
MD5 9bee2d2edcd1421e453effe80ee1a7e7
SHA1 6c237eb7dcc5fa66496edc309ad7681bc9873cbc
SHA512 d4bc54ed8680c502c3834f6b8942f58b300165a6300a2caf92f88d4c4e77756f5005329ffc6df20690ef6cbaef84c0ba265f5526c4a933e61ca601ba5f83e019
SSDEEP 192:rbazrH+bF+UI3iWGVoWN3qL/baSVVV63:rW3IkUI3ijVoWN3qL/WSA
TLSH
T12D24004E5F243722CDBD813669E744A35C7CF03F8B5366DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 268B
SHA256 26aefab950a6c78fd77dd8a2e1ad90f5dbf53fdd1729ad93c254c29d8d7165f1
MD5 dd2abdc898b85b487ede84604829592d
SHA1 00b82c932f88b84e3e39162cfa266d14300c77e5
SHA512 c543924cd3f41281d7e7f83bcbcea69e41a9c3f2632db7cc5667b8c0fb449df44416de6737e151e8625ccf989ebbbe20274e2e880fdc4a442c2abbc962896143
TLSH
T163D012480469113DF17D5A61C9F41B63C76AD6202FB5B9CEDAFB0E4855A561604C730D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 c5565268a8d85d34f16d7818396dbd38b58a8b981de1da0301d17f8901288d31
MD5 12aa3e5b1e1f627c93b9b83c0659afa7
SHA1 8980b76aff220a66d05ed8ab6d87f6c20f292deb
SHA512 28fac4bedf7650d606ff1c6b8b4bb2c05deb60bbae2afdd927055879703a14f3cd6aa9d70e378b9aa6740644bc314a36c861f7dd0f39be5824914e1f86e80ab1
TLSH
T13CE0D86165CDC5199944214F53687708EBE0350ED688FF022B0598D0F441544E6B25C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 f1781aed51125de5f00d372979f177bb7547334ccb73a00e7894dae0fc1dbe19
MD5 d7e3dc42bda4619d3dbb971b62a42b60
SHA1 925b9de3c9dda6f3b24279f7b3f5ac5a51a8c361
SHA512 a38a5a388e51146f39504659719668c270ed4c04b0ed02dc10ab08bc43deac6b3e7ec659bab090bb64178b233c31756eb4bc9b9392153521e11d9e81746d0614
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7obmWwgCvAfmoHj1B/Z:qDeMatha9RArgvA+oDz/Z
TLSH
T150B2204D5F307221D0F09B7ADED184632E7C221D97B33A459E5420F3CDA256BB606166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5c505c336d8212c3c7e35efaaf53636294394427d5cc73dbace775b7a1c385f9
MD5 15a6dd5081eea515c12eb6d09927655c
SHA1 30774c9a83adab9b8f83ae6653108dfd79648869
SHA512 2109afffd6b24ff04b0af3e08b1a08eb3ec7eb00df406da2a196e491a5e0f03f995f80d7f7fd0f89735cab4e2932285ca9700dae49cea52708e6768000641f31
TLSH
T12D41E1F7C3E8857E890596F4AA146F1BCE1C0A15432C3C5AC9E4AF2B93E3871D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 837e1e685ab0fceae5a17957eba2219f912b4700b5461c702bc0e84611fe5057
MD5 ec369f177cb8d92d82a229463421b085
SHA1 6f73b9947c692987c0d16e8d8ba1ca7a2d2d4e87
SHA512 454087ca626a2279bc5c92b3cadd06152e704f6f38ce2567b999032fe497a42592898dc84ac08b45250d4a7d73ce6e26f5bcbaef2f2e83b20326cf7f8cd36397
TLSH
T155C0225281F8FCB2102A49BD0B84A885A77AC830000040B0CA95D23CB2C04B75A2602D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 232002b1f5d3d2df4ce9e5b275647e2c8c603e0bc4c11c417ae58f0ae1a5f0c0
MD5 b1283f8d4de6255d1fd5da0c8d0801aa
SHA1 631ce9301e0e76fe4eedb29f06f03139fd6fa02a
SHA512 1cbf5fef5cf088e22fddd81021c5e1143627f4e843ea5c2592313c326d49d8c9d10852229c7b5eeb817b1dcbac820a970e83c23db01d35f695eec68350e89297
SSDEEP 384:sxRuB+w/f6sgWvKkPyVjgyvX0/5IbOmykqWSr:siB+w/fOYKk4M/5I3yJ5
TLSH
T1F852C915A928A93B8CCBD21DFB597F63D7FD103251942A58B6FC9A1C00EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d3587a8684d6d82ac5cebf8703c9027f8afed1f55518743dcb5ca7dedb4b6ac9
MD5 e85ab7d0383a1ad156ae4701e646dedd
SHA1 b11cb608ee0fdaeca662ff305140e225cc181416
SHA512 db67b0ab4491bb5d6fb0f68ac2c17ab22991453f6b52976bf2532a21811e4551afe789ab1bff88b7611bf4be2dfc49a691996e0a9ede86ff0be12f82866e1fd2
SSDEEP 192:sxRumR9Cw/f6sWWpVoCwPMZedyrnZzoA8p4B/g6+WNIYgtXOwuCYAgGIgVSPS1J:sxRum+w/f6sWWvoZPyVk0/5I1OmFoc
TLSH
T16D42B815A928A93B9CC7D21DFB597F63D6FD1032A1A42E58B6FC9A1C00E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 03168e07794cc51da1bb27f3172f9af23897fb1ef49ae5452d58c8f4db278b84
MD5 f1c21bfdd5520a6fa9a3029e151f406a
SHA1 782439ff500ac929114b58ff97424f9b4647c27f
SHA512 8b6653a70111b2f36d76b1944f4355ea514a90dad9c699742e9ef37465cfc86d2e313cee9d2c34775ad4c16a57eca81c918bd045458850fad148da34a51c8f87
SSDEEP 384:sxRum+w/f6sVWvKfPyVjgyvX0/5I1Omykoc:sim+w/fzYKf4M/5IJyHc
TLSH
T1C752C815A928A93B8CC7D21DFB59BF63D7FD103261942A58B6FC9A1C00EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ce7cf7e357a031e6a88289fecb9154ecc8b48c994970bcc2d5b58cc78c983182
MD5 08d170a80024010a70fde4593b94120a
SHA1 5cd7e19a133a606d2983aa5f119fb414a51e1fb5
SHA512 7382c867a8e921c85148279a36e90b2821b701a5b329b08f60a9cf60f02082e4e9d0373db0a1bb332c641ab0d6c851176aa5f569cbbca060dfc32d89e9fcb9b5
SSDEEP 384:sxRuB+w/f6sgWvKfPyVjgyvX0/5I1Omykoc:siB+w/fOYKf4M/5IJyHc
TLSH
T15652B815A928A93B8CC7D21DFB597F63D7FD103261942A58B6FC9A1C00EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f6c4fe82de29c3a6f4446cbd84ae1837701bdf13dba6864e8131c2d9328b4af2
MD5 2d1869c7aaa6ab7e2edcd128e7bad66e
SHA1 7f828ffd794f9f371d1047687271d8071c854c9a
SHA512 e9e2a96a375319e831425a7f5754eefe5f5a95be40bac99cbd6d846cdf25c1fcc48cb9be578c06350ba86bdd3a3a0ed977a32ffb5ea2d2b4ce599b5f0ba53805
SSDEEP 768:j26HTZ7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVSyBVuwDro9Te0r:j26HTvEf6RWgs2f02u1jaxyB4wwaI
TLSH
T1CCD2DA7B640DCABF4F804ADDDC197E9F6D6802CB9698CD8047FD941C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 feb6ad39c269897a36e00c497cb7ad68d23f12681d9edca1c557f5f68ab78b46
MD5 bce5409dc5b9f717b2a3e243a58b79d2
SHA1 5bce09165c8dc8df1bb285abf5095163638c3420
SHA512 7b21512aced1359c920891a89ee58515ae225c3ce62c0d6ff96eb7cc964398a985ce25d88da8c66bcb7d19545b4fed1614ad2d13395dc54206d691b046a4e0b6
TLSH
T156E04F555AC9CABDA9A922830374B308FEE8751BDEC8BD022F9489C4A582F44B5B3181
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 5f21c5dacb984aa3afe2985ed0046772cb78580334b509e96f08bfeeb476b0bc
MD5 6cbfd8284b774fd5d9ca14515762fe0e
SHA1 d727454d027b0c9c88ffc73312528e0f21814142
SHA512 fd613b3eaae54d8f6babb9a2c99369fee5b46cc45e0346f1e48874e3dfa018e4104550d719607a091f899baa48ff675abb745db34f9c6b816620f07ddb24d352
TLSH
T182E0926565CDCA7EA986218B5324F708A5E67406DAC8F9626B0894C4B3067C4B263540
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 1b58de46fef3cd2eb197e0fe40ea64de297d9fd8748cae4bcd6b378e7effb212
MD5 ef00b12b543370ee612690e1fc8b6cfe
SHA1 fa40bc761b8e39159daf5e0d0f9a07aeac28798d
SHA512 2434b804e47b4ac69be9a81beccb48b2ef1849a1f1dcb4fd8949fbabf6c0c8a2098a45aa3a32566d995c69ded8ae0565bc35b6bc42473088e7afd1b7f7ccebac
TLSH
T139E0867495DDCA79AD5471C34374B70DAAF4BC1A9BC9FE46570C48C0F502B44B6B7680
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 e68a56e422256b0a2d9f3ecc79f54ee385dcc83ff7effefcc6bfb838dae70547
MD5 9ca80a3e2b47bc8d79fd1f80c05e6238
SHA1 ba85e61fc651866786a391a466827f1f3a16b695
SHA512 e2459a48566a84c74df73d1e91abb943c072c57cf02030e795c9297eda3ba500d7a4dfd31f2372663f70724af14f9d57b745f3b6d1a18791202fe6d4d8104f89
TLSH
T1BF519D1078BE47A02D3F351C8398963752C2B1A7341CEC2B7BA810A65EE6E10DDFD9C9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 37ecd6d6860f51c2f9dcf7e683db5a27e4cf5d19c8cf2a0a1aab092342777f55
MD5 f6b95c149f15a027d30b9648fc744648
SHA1 02b2d86885215dd169961d07a222576a20ee674c
SHA512 4f983c61f8e520c8aeca1d8c69d29877aeeb36654db14f1e14741f514298c486341eea715ec74e06e02312975cc878c6bbe9b090bcebab320d6c24bea0ea3cb5
SSDEEP 48:KbIdsoKSS+oinlIhI+KyL6++Wwuv/uYfyhaIPKXqc95+1pPTfQjbMDIwRQK5FhHn:KITSKooaiaQKXqMiAKva+h
TLSH
T15D91B21078BE47A02D3F251C86A896371282B5A7341DED2B7BA810A65DE7E10CDFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b6a611e5303e92573f67f3c3be18326a6ef84c5e4f09d34a4c20d85f81ed4d63
MD5 f1484583543c9aa75d088a6786958ebc
SHA1 4eea9df3a9c3f8acd76c413ab127e37724199774
SHA512 0c65326ad24aa1de96ffbd8b0d7aa9b33f52dbd158615aad347b6846b158ba20822df2670e9d879c1dc66cfb7337419967b1fd40acb5b657d6d4c6b4ad689e65
SSDEEP 384:DNrRZyCSDnxTIC+chVxV8MEhIKyll7svbFKfk7:xFZJSDniQRyI1l7svbF9
TLSH
T16E44640A7B747001EDE6D9725CB080771E3CB16E8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 2c7f5f47a897e286d3570e9bf749b1565769527fd09e3bf3d75d40f69bdc47f6
MD5 5fb408b229981234a4ea8eacdc85853c
SHA1 99609449c345f53d7e3e1403bb261a6b3c5e83ea
SHA512 1fb14c0feaa7b619eb3811092ed36618117956e7a4df72fb624f35e5fa5c8dea9ee56f90dfeb81c556df6584d07ef7460ea3eab588e06fdde662d4a94a56ce3c
SSDEEP 192:iQEIII7brMIMtMYcYLDOGOedAs6l9HMQ2siVwyYHh:iQEIII7brMIM2B7euswB2s
TLSH
T10442846A26051FB7C15E1B3A337286645ADC89814132326D31623C6FCEF7ED782E56F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 be325f4d646a3996c117b1d883793ba9bd5d8cd2747ee8ff39f46f1bbac08f3e
MD5 3dfdeadc105888492ee3d98fdc6b66d1
SHA1 5bc4011d1e2feabaa7b65c49a8b750f05fcfdbad
SHA512 8e91ac681a09f53faff958d86067225e31907f2505fbb2645c6b973792e06d0b33442331fb092fa2e6b7ba8aaea1951a74678fe5ce2db3de22fd74055f025d24
TLSH
T188E04F51B9D9C96EAC6421875274734DAAD5391BEE88BD461B0488C4A101B44BBAA281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 bc4cb086fc3bd194d2574b494fac7d8fe6505e63e04a840634f9bb4ebb740692
MD5 e9a0ec42a9178d241bf38f3ed03109d5
SHA1 e5b933d7b841fab38713e6785ce960e80e9fa175
SHA512 84214aa0912895349b3b106563bf5d2bf238fe00c2843848a73cde580416a4876b08e49fced2c78d0e117977f680dfdfd0da2dcca6643c40315e9e71a9d8f547
TLSH
T13D212255F330D109E15A827A607F9B391738E8128FBCEC0F847A20346EB2A440E4B7E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 8ac2629ae8f83509d3762781bc1a7e66d9bb9d7864e3effeea1ad8d5d6518326
MD5 79e5f0af42627f60a00d2407e9b596b1
SHA1 1975709a3d23161dd051b2bcf7d9ba9ae40e60e9
SHA512 3ea408227333b57cb460e390884f5f7f9a54d6aa5ba6b24c2bea7167b87e284c2a78fb90a67a872573cf36c17f8c8f2e3fe3e7f605d84c9ac4ef4d13160716e8
TLSH
T1EDE04854B4D9C5AF9C9421935374B34CA6D93856EE94FE051F448CC895017457B67281
MD5 SHA1 SHA512 TLSH

Submit Download

b602e9ae-e5c7-4e84-9664-b8102b9faa0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b602e9ae-e5c7-4e84-9664-b8102b9faa0b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 46f74cee5d2e47a0869c05ed5227543987aea04fa2cb0278557c79aa6762eb66
MD5 c69cda79885a1ee5c315e1e5b2ca78e3
SHA1 cc13a426325eb0d353e6b1892206df0a1b9bc857
SHA512 4494b67ea9deb837446d559ec2082956589f0fed7045a001e07cca1d2dddfda7daeefa901f469e8d40e4da389f9e31cd996362b5633e89b4bbe209a8b3b8ff81
SSDEEP 3:MsEllllkEthXllkl2zEfls/t:/M/xT02zN
TLSH
T1524404047FC0040DC500113054D1C3743370D51005155F4374F10D33FCC75400C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c0152b38b7f07179ca3e2ef852ba0dc646dfa78b9e3662d8d55124095d3023aa
MD5 893cdc0a0bd227277181fc1265f13ec0
SHA1 8cfc77921cae620e91fa0cad48f979b398739b61
SHA512 2497fe3a6e28fe538bbe9f0c56ffe1924db1f764f3bc082f84b336a3d7fae467a85a11466b589c07fcbd73b80c409ae02cd764bce2d0458535a8998017d48118
SSDEEP 3:MsEllllkEthXllkl2zEflmZRq:/M/xT02zXv
TLSH
T1B44404047FC41F0DC5011131C051C3703370D4101FD1775334D14433DCC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 686e445367ba5e1e632a824c607e8074851947b56a7283b30329749fb858c0f3
MD5 60392fd5ba12e23414933f07806625e4
SHA1 0c8b40f60cd5d4ac3727750510a3179465ad6c40
SHA512 d739a079d6e5003c5cfc73ea1af5a1e5ee7f0916ed93753e56f352313372e25e709529988f18e55b2181aba869575f4ec4efc16c23bf36c2faa93fcc1ddc1f80
SSDEEP 768:hrv+4UNbdz3e1u/TBOWGa9ONXyer1IRCzniBceVH1SK7:hbsbV3e0NSIqnzEH1l
TLSH
T14D03BE36A0A89E338DE2A386B14777137FF86057D6840B90EDDE2F4E069B59D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 10f8a1e24bade9a941394f86cb93170e97361b8b6e822531ca3ecf651dce3fd9
MD5 f5920389ba0a73211f02a025e57aefad
SHA1 9149903522b8d2a7c784cf8be8613df5d8c46900
SHA512 b214a32914e8d556e62856d55493b27b22a8ac7cbe60d0daadfddb0a98bf9d1436c0842283d733285809bf43619cde1d9b06c4ba475626e8d6837185fbcf1e4f
SSDEEP 768:8z3ckKC7Iq/TBOWGatDteONXyer1IRCznieAhy6Dq9Jw:8z3H3FSSIqn2TuJw
TLSH
T16FF2AF30D4A5DE334CEAA386B64A7753BFF82027D6C44A54E9EA5F1E05C365E130F41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 4adcbe77210cd310163fd47839915cb54ff28d80a4a7289aaf5a30b79057157a
MD5 353415d827c75ab2afe93470172e5ed0
SHA1 1ef9f267f12e3a117eaded443ab5363b9210ddcb
SHA512 d32cdad60969ffb0059c839d349dda5aa87c01a9f08a092f2c00d0cd130b3075fd739f90b995eb8616ad901a8cf503a1ebeccf3d5c72f09fda787d6535597bbe
SSDEEP 768:6FCz30wghkKC7IZptONXyer1IRCzniEurS26XbdUtxkHDCSFMWE0fFHWUwb0jhSJ:Nz3N3ajSIqn8r9yexkd/tHlK0NSJuJw
TLSH
T1B443AD39CCA09E3F8CFAA7C6B60D37039EE91123C2AC9994EAD91F5D10D70AD130B855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d6441d3a1af724ac77c64538303b473a114cfa8cdc95aea8727f4b0217580952
MD5 d791847738ddb2b9808b688a80b55155
SHA1 e8b35c64ed6148076bc3af18cf20ebceaa44f4af
SHA512 7962ee51142a9b1345b5e59ac9869aa17979cc26a4e2aeb4a19762d52ac5389ee5fb2b79f5b47109bff8c2b1b77f19158a6bf54c3f68c9b687b6fb714f628862
SSDEEP 768:6z3ckKC7Iq7dNTnOWGaOONXyer1IRCznieUwb0jhSWy6Dq9Jw:6z3H3F0SIqn+K0NSUuJw
TLSH
T13E03AF38D8A49D3B4CEEB386B24E77126EF85037D2E40A94EBDD1F0D45A395D630B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 5869ee290a988306d25a6bde08a5c103da0650ac2c0173714a6ce3dd4fdabc47
MD5 cb9b8f6794ac28788e04c55830569805
SHA1 8f46149f2bf0e60648daba61a99e643ec5efcd12
SHA512 9583e0cf3441b104646abc86e240854adda6f03a5f9b5e0a2753d10249c673bed4208fb825ef1ef55b2fd538d96b6ce3ab3376783ee2241775beae90af2829af
SSDEEP 768:Oz36kKCUIq/TBOWGatDtdONXyer1IRCzni9oA9IOhy6Dq9J6:Oz3loFxSIqnVrOTuJ6
TLSH
T158038D3C9C609D3F88EEB346714D26626EF81037D5F04A94E7D91B1DC4B295EF70A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 026956f9d2b6eb797e5b3341f42e3fee0ea4f2f6005d78969fd84d64d5bbb469
MD5 4ce117259177eacb0a3cd074f01d996f
SHA1 99adf9db0cc71c104696cd2afbaf921d9b06a6ae
SHA512 1abcb5eb308074ffa0d58762d32ee2c24450d9d7c2b33ce0fe34b360a6b921c8f522320feab656dfc0b39b0a704a8b1249087087d9481391bfe8e979090af58a
SSDEEP 768:grv+4UNbdi3jkKCJ9q/TBOWGatDtWONXyer1IRCzni9khy6Dq9Jv:gbsbc3oFE6SIqnDTuJv
TLSH
T15313BE31E0A8DE334DE6A286B14B77937FF8206789C04A94EADA1F5D05C759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8b0d3870c68061a30af076384d9e5b1a77f5974edbb5bac377bad706513e3926
MD5 a1f6aae886580741d4bea961783e9462
SHA1 36e9dd6b5164fa2daf46024ca4b684e13a1d1c86
SHA512 cf42192c19f9932783c9be64d358956b920c031f1274ea577ed42b82ec516112d714d18db10822f4cd6c603513e3075b4d9103dd8265715855469a0eeadea8c2
SSDEEP 768:Irv+4UNbdz3o1k/TBOWGatDtaONXyer1IRCzniwkeVH1SK7:IbsbV3oeeSIqnIEH1l
TLSH
T18903BF31A0A8DE334DE6A396B14773537FF8206786840B90EDDA1F5E099759E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe5b4ec8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5b4ec8.TMP
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

F7375062-B43D-4602-A7EF-ED24235B1FCF

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F7375062-B43D-4602-A7EF-ED24235B1FCF
Size 191KB
SHA256 a7533e1512e5d493e8acbfa4cf1b38ad3fe697042a0e65165587377f4cae562f
MD5 365402e0abefdd2dee8d6c9bd5780db4
SHA1 086675c0a718949a0dfc0cdbc3a7c2975c7654b4
SHA512 af1e7fa5c700a96cb363c8e5ebad605931067a97e95f7c4d4045777ee4403edcc9c3b18498f33ab209a1ffe52edf4500d1e54bd881e3164348b2ee0dbe0e4282
SSDEEP 1536:6rVe3b3yFKTpb8xsghEaIe7HWsDXjj/mblcAZl1p5ihs7VXXBEKD0aO7qamZdGVE:gQe7HWsDXjj/EX257cL
TLSH
T1A61412A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 14KB
SHA256 abb7bb537602e5e6a1d1ed59953b24bd312f5217667314bf3e904eadb1419a77
MD5 1301d153ba62aa299a03508aa694d0a6
SHA1 4aedfa3cb96c3100694ced1c43860a63661ae3ef
SHA512 89a8ce6851c5ad40551c4f92aae24b7eaf552a86bd940e1d4b234ae18e7fb01225c74e5487b69155334fefc6a0905c8b1bd2cecd0f82083e7aef8a258ed0d224
SSDEEP 192:LTjeT8T9etV5qDKz5le9PGZpl7/xGLjkLaL9kIq/POpz/u2IwXZiiUNCoNjXNhNs:sB7cChhWnSBuPc2
TLSH
T14F62019295ADC5EBA835BF1653D627A04009752F26CF70496718034E338BB098FFEB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lot 1_PDC27 Compex.rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UUMFE1D1\Lot 1_PDC27 Compex.rar
Size 1.5MB
SHA256 1bf021fb7fd4e6f382f6290e13c916af835428ab25d758d2a108ea64af64ae0f
MD5 0175d92e3546c2240ef9f78727a14c07
SHA1 3bc8b41c29d6df5147247f1a70a70acf93d640ed
SHA512 89660c28b183b6f616ffad9155b67a2e6a315a138f5914f29a8918a47d492b9dde7face003e38abe69f1f5bfbe557b41be71c4b87b0289ddd002d61c46ad31cf
SSDEEP 24576:DuSXDD9kuheXFP+/ATlPaeZym/F/Kgm7Fa2ICk9JNWJ/AyWUHzjuln+vxtNbetAb:Dzvhe1P1lPa9mtC770IkHkJ/A5+zjO+t
TLSH
T12F753314FD3B10503CF85D80DE667A416424E326F97DFEDEEB86A48B42EB141E90FA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lot 2_PD114.rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UUMFE1D1\Lot 2_PD114.rar
Size 1.7MB
SHA256 2ab05126249ae2730d8cd95cc796c58a92453d0291823315ec459e1e633503d6
MD5 ca5b1decc062a235f92e9384699dc2ce
SHA1 927b6046849cfbde5a5296ed4680f6d8e7d97a90
SHA512 afcd09c8a8001e5c822887070a826faf9a2ab1eaa1c193b770a5f4978766801aec6e9a1a9891ce8fa02a61ea112bcb540856e89a01553b320b62b8f66d309a49
SSDEEP 49152:8WY1fu+qIFE8JpMtIGl2u7c9RESNj5pAmrBLG64Wo:8BuWXWIi2uo9vNjbbFMWo
TLSH
T1658533A5C836B589853D49E4F218EE96A7016B64CFD2FC31BA33AA884F7E7720415F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2825daa2-9c1a-4064-817c-2079974a15a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\2825daa2-9c1a-4064-817c-2079974a15a0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

mso130.tmp

Path C:\Users\Admin\AppData\Local\Temp\mso130.tmp
Size 663B
SHA256 039fe79b74e6d3d561e32d4af570e6ca70db6bb3718395be2bf278b9e601279a
MD5 ed3c1c40b68ba4f40db15529d5443dec
SHA1 831af99bb64a04617e0a42ea898756f9e0e0bcca
SHA512 c7b765b9afbb9810b6674dbc5c5064ed96a2682e78d5dffab384d81edbc77d01e0004f230d4207f2b7d89cee9008d79d5fbadc5cb486da4bc43293b7aa878041
TLSH
T13C01594D57C40925410F48B2524A576897ACECE294D56FE0205E7A499BDC9C14E83F38
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4584_1155870154\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 4KB
SHA256 f36e4b9a8fd00141218b422091a21e6422220c4d0f7c21bcf6cb44882a56ff71
MD5 fb48fa5124c49cbf9acd0bf0751e4778
SHA1 b1d72ccf3a7000c720b9c9b7ff4ba3a18b8f17ee
SHA512 a89ddebc4b7ecb3b68b09b7e458cad3197074fda429b956898eed8ea34e6947450f447ca28b2bf3fc2c27ee66ec3686642d482cdca3994b619653bbdd1e354f6
SSDEEP 96:U61TgfYhZfNWbS4K3fYh+fNpTRqlsQSfYhTfNL/L+xbJfYhwfNM6E3odfYhcfN8L:U61MENkS4CzNbql8CN3+x5JNM6me1N8L
TLSH
T10B91E1035BAF5B2AD0C04373622E8349DB717C02EA59DB1E6B88D53B7D60960CF4C69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4196-5-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/4196-45-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-3-0x00007FFFF2E5F000-0x00007FFFF2E60000-memory.dmp

Download

memory/4196-1-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/4196-4-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/4196-9-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-11-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-14-0x00007FFFB0B50000-0x00007FFFB0B60000-memory.dmp

Download

memory/4196-8-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-6-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-15-0x00007FFFB0B50000-0x00007FFFB0B60000-memory.dmp

Download

memory/4196-2-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/4196-7-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-13-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-0-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/4196-12-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/4196-10-0x00007FFFF2D00000-0x00007FFFF2F63000-memory.dmp

Download

memory/5900-129-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/5900-131-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/5900-132-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download

memory/5900-130-0x00007FFFB2E40000-0x00007FFFB2E50000-memory.dmp

Download