a78a580ecb2bfbf7b5f36e812f273d70d0a11870ed65b6a01d72a46c459e1134

Analysis

user interaction
yes
max time kernel
124s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ihre Unterlagen AS-9311002026 163945284.msg
Size 272KB
Sample260826-pmxnnsyfqa
SHA256 a78a580ecb2bfbf7b5f36e812f273d70d0a11870ed65b6a01d72a46c459e1134
MD5 c972bf33c912a668f24e2128266d6c06
SHA1 620356fc8c804ef8eca1a787f5f2629ca9d43c9f
SHA512 a2820535ce9ffc0bc940eade1532827516b8883c77a9cfd33c5396a8262bcdf449bedf6cce38fc081ef1cb3c11231360ef577023195a4a3400c7789936a73498
SSDEEP 6144:KRqjFrq7IZvQbn7Lfj/Br2N3t+h2Un6sBrMk8akG0X8arlUreoseNqZkw+VO:imFrq7evQbn7Lfj/BrQ9+hJnhyXakvtD
TLSH
T12D54BF10BAF54F04F13AEB3189F155C39722BD46AE16968F336D330E97BA9009C52B79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3376_762254674\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_611217109\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_784943672\_locales\cs\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3312	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322209164596240"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{9362ED8A-F6FE-4E78-8F1E-AB8A87DB6876}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1608	OUTLOOK.EXE
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3376	1608	OUTLOOK.EXE	91
PID 3376 wrote to memory of 3288	3376	msedge.exe	92
PID 3376 wrote to memory of 6036	3376	msedge.exe	93
PID 3376 wrote to memory of 3312	3376	msedge.exe	94
PID 3376 wrote to memory of 6036	3376	msedge.exe	93
PID 3376 wrote to memory of 6036	3376	msedge.exe	93
PID 3376 wrote to memory of 2792	3376	msedge.exe	95
PID 3376 wrote to memory of 2792	3376	msedge.exe	95
PID 3376 wrote to memory of 1300	3376	msedge.exe	97
PID 3376 wrote to memory of 1300	3376	msedge.exe	97
PID 3376 wrote to memory of 1300	3376	msedge.exe	97
PID 3376 wrote to memory of 1864	3376	msedge.exe	98
PID 3376 wrote to memory of 1864	3376	msedge.exe	98
PID 3376 wrote to memory of 1864	3376	msedge.exe	98
PID 3376 wrote to memory of 4628	3376	msedge.exe	99
PID 3376 wrote to memory of 4628	3376	msedge.exe	99
PID 3376 wrote to memory of 4628	3376	msedge.exe	99
PID 3376 wrote to memory of 6028	3376	msedge.exe	100
PID 3376 wrote to memory of 6028	3376	msedge.exe	100
PID 3376 wrote to memory of 6028	3376	msedge.exe	100
PID 3376 wrote to memory of 5848	3376	msedge.exe	101
PID 3376 wrote to memory of 5848	3376	msedge.exe	101
PID 3376 wrote to memory of 5848	3376	msedge.exe	101
PID 3376 wrote to memory of 1056	3376	msedge.exe	102
PID 3376 wrote to memory of 1056	3376	msedge.exe	102
PID 3376 wrote to memory of 3480	3376	msedge.exe	104
PID 3376 wrote to memory of 4440	3376	msedge.exe	105
PID 3376 wrote to memory of 3480	3376	msedge.exe	104
PID 3376 wrote to memory of 4440	3376	msedge.exe	105
PID 3376 wrote to memory of 4612	3376	msedge.exe	107
PID 3376 wrote to memory of 5636	3376	msedge.exe	108
PID 3376 wrote to memory of 5636	3376	msedge.exe	108
PID 3376 wrote to memory of 4692	3376	msedge.exe	109
PID 3376 wrote to memory of 4692	3376	msedge.exe	109
PID 3376 wrote to memory of 3096	3376	msedge.exe	112
PID 3376 wrote to memory of 3096	3376	msedge.exe	112
PID 3376 wrote to memory of 352	3376	msedge.exe	113
PID 3376 wrote to memory of 352	3376	msedge.exe	113
PID 3376 wrote to memory of 3788	3376	msedge.exe	115
PID 3376 wrote to memory of 1804	3376	msedge.exe	116
PID 3376 wrote to memory of 5900	3376	msedge.exe	117
PID 3376 wrote to memory of 3276	3376	msedge.exe	118
PID 3376 wrote to memory of 3276	3376	msedge.exe	118
PID 3376 wrote to memory of 3624	3376	msedge.exe	122
PID 3376 wrote to memory of 3624	3376	msedge.exe	122

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\Ihre Unterlagen AS-9311002026 163945284.msg"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\1X8S4OED\email.mht
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd7814c188,0x7ffd7814c194,0x7ffd7814c1a0
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,17649492882023180145,5565676866203769328,262144 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,3342402987419256963,9976686842150871959,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4515406645930349937,17432094623130007494,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,17811076185517660001,9083343659651694849,2097152 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,7857960870452300778,9727431849844211897,2097152 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,6366394423539528473,2342771453840723441,2097152 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,17960248632013055747,1350640572913969998,2097152 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5336,i,15596106664478701309,15075072442287545450,2097152 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4022393872336715117,17839087937211090801,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7419837830186233518,8021319172692138853,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,4116371622699826150,11878955488798178298,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,8298546976288472139,1703480504921439970,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,8298546976288472139,1703480504921439970,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,3547731515653198108,8872019903834447748,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16195156548019386359,4038692347361224792,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,744742899592512000,15712755869688321045,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,12449648270253552076,1237817372254244312,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,4680661809235520275,11427652410555700652,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11465748667966115248,9382933450681357134,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1000211516315119474,12996936953848223090,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17464409898012557484,12188279817428709249,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,16028645639550506142,3293412228394248936,524288 --field-trial-handle=2364,i,8083264523329252624,10033543671556334132,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8494f6a84c1b4b7519329e70b3bdbc377cd77d09ec96c8dd8e64873dc531d492
MD5 d6277c535cec78a1ee7b7154b9d1c091
SHA1 d0f1ad29065feb6c2b0e2c5bf7b7fec785785f7e
SHA512 c5d2b5fc8935b123764651b17c4cbe164f0598a192f787db72f7d1971a6fc89d148efa0a3cf49fc8a5cc5548bf69271f882d3bafbf08525133d287390ad7dcea
TLSH
T1F561B696C3224BF7D72995B635EA44AE31F04876390B1F02905B6D3948A3F8C29EE173
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fe5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fe5b.TMP
Size 3KB
SHA256 fc26aaf2dad3f67df2e6aad8c4dbd29dc1dfb33343dcc2cccec060fa4ae3ceb2
MD5 cd48a9d6abcd195a3fc9285ad83c4bf9
SHA1 6db0f06646079ce5bfc3fba7535d77f6ee339544
SHA512 2039743b9e6e60953beb7dee0ba87aa2364b814119ae297c2d7b2d564835b2f3c1f8de197bc960e5d49918335ff26e43a0f95bc522c8a6abb51bcc0f1fff300b
TLSH
T19661D996C3264BF7D72984B235E9449E31F14876390B1F02905B5D3948A3F8C29EF173
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1936b1631952d7691e9bb032ed5c4a438da8758b4ee41fb849957362a6026abd
MD5 1cb6c1b99e9b0e6de98b1468cbafb139
SHA1 f06e2ab024a5d01a03dffc1a4782b92c09c363e4
SHA512 b44360468cc63d1972ce87bd73479f9d695c06d7355cee178bca37b724288794ee3fb81f68b6802d9b6507005602021007563bb24fe16a369f6d5e33ad1e8179
TLSH
T1B841C0F7C3E4857D890196F4AB146E1BCE2D0915432C7C5AC8E4AF1B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 020263c8c51099b6b0a523df9659ebcf0279ce23d62be5e6a69f79a4a56cae72
MD5 aa060d803f653332329e3057a83eeba3
SHA1 a5c734cc2253dc075e910f96221ecdcbb32581d7
SHA512 204859e85559815a327baebb1662dfb446355473fe5e4666b6f9d335216fb65d0878ef11c1569ba53ad792154540dac05f0e0c93d985a6f80ffac892dfb27f35
SSDEEP 192:sxRIRnbQ/fksVfBAHZdzoA8p42/g6+WNIYEgq3FGhhIgVVRc9J:sxRI5Q/fksVfBA5Qf/5ILWiH
TLSH
T1B232B7166E68AC3B9CCBD21DFB557F53D2F95132A1902E48EAFC960C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e7c423d923892deeb66135fbb3b391bdb2d8dbf61912e599d8f549226cd51fc1
MD5 05936e436ee7277345474588f847b99b
SHA1 b20fa34910bd97be80c6e7ee42d0c7db1af2d91c
SHA512 b28b1745b817475183a6e890d6a7831ef3993c111dfdc10652b0df5709c2bf639433a3ecd3e85e2d0d4257835883c378cf09db182be6a14d445737fa1823b7ff
SSDEEP 192:sxRvRnbQ/fksIfBIHZdzoA8p42/g6+WNIYE483FGhhIgD1VRc9J:sxRv5Q/fksIfBI5Qf/5IDWuH
TLSH
T17A42C8166E68AC3B9CCBE21CFB557F53D2F9513260902E48AAFC970C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a3acb543e72d277e7bca44cc105bf2d4b8ee4d263bdc0ec58feee85ab1827332
MD5 c359675b0d7f396d5c3915f3efcf75c2
SHA1 5fbe188b6f68d44b7a10543598cb2572f6f85850
SHA512 bbd1b60f833d2a962b3e7768a5d54e3b8b0c4485035b418d8ce747c2032adb2fedfebad2a136a94f3d470969c1fd3987b6132fbecc0f097ccf4cf65bff062dce
SSDEEP 192:sxRvRnbQ/fksIfBAHZdzoA8p42/g6+WNIYEgq3FGhhIgD3VRc9J:sxRv5Q/fksIfBA5Qf/5ILW4H
TLSH
T1FE42C7166E78AC3B8CCBD21DFB557F53D2F91132A1902E48AAFC960C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 34e16f7fefe1594ea7303299d69ca5d7819244a8ebadeaec0124a0730ee675b6
MD5 5a548676d3f40ec078b07f406f8d7e5e
SHA1 54438d164f5c158f6257e0a57b5de8049cdb9d91
SHA512 140fe5318bdc62e405e7f26f6d71863db88d954491176c164847f903a60cd3376ad9cbd74adc16f2e6cb587beae3698edc307724cc40bdd3315ceb7712bc7445
SSDEEP 768:40Dk6DJQD86J7pLuLzn0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAj:40Dk6DJQD86fEzn0DbWgQ6DjfIQDFu1q
TLSH
T1BED2EA7B640CCB7F4F804ADDAC197A9F6D6802CB96D8898047FA891C02C77EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a99d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a99d0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 60412a7be2f7101adbc6107ecb83a8020f24e01a76c50e18bb8010d520d70d11
MD5 fd8f5309166cf471e9972fe741b66934
SHA1 f7a13b7bac8b8d925458deba0f3029fa9fbbf48e
SHA512 d40c1cc77561a725a179ae53105683cbecccd46a83c12b14f8c39bb5387d8738f51c480dd84e4cb43ba0f444898c1e5ecfa6fc8d7e96d69725905e113e98017a
SSDEEP 768:l93ZGdBDTd+ZoH0WeX6+qTko0u229a4vsTXRH5X:l93HpFvVTVKa4izX
TLSH
T18FF2AE71F8A6DCB388FAC244B61736875E7811A3D6C81E44D9ECBB1D15076692B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26fc62edf1188dd7541db2f8a13ae7ec42c0168eeb8d7d8510ed79c2434e127c
MD5 10da82b3dcc2ec81d62f26323143e84d
SHA1 0e3f194a7a7330f4ac8a003ab333dfeec76ad9b5
SHA512 819976834fc0fe4de67b3c20eb04d2d3692fd724b167d9e7c464de7e51094e69fdd0e241be951730752474175ae7ab7470d37adc526daae288a10a42325d735c
SSDEEP 768:JFQj3IwgQGdanZoH0WeX6+qTko0u229a4vsTXRH5X:Ij3JpFvVTVKa4izX
TLSH
T1AB038D72E8A5CDBB98F6C785B70676479EF401A3C6CC9DC4DAD8AE0810871AD170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0b54c6ba34551a103e705f4fa8fc236dc266e1041016d731b8bda0ffebf1ed42
MD5 abe90940139c5483bbd1d09e8fcaa287
SHA1 2ab991d1b7f501cf63ccf2f97dcc5c2bdf770f4c
SHA512 8411ad5b1bd7eabc232267387fb6608bdaf826364f7658dd65b28292ba238a13ceef69ac39cfc157945eaf58ce0dfa7ba56f521b8b6219b921f92b8aab0e66b0
SSDEEP 768:/93KG5BDTd+ZoH0reX6+qTko0u229a4vsTXRH5X:/93kpavVTVKa4izX
TLSH
T124F2AE71F8A6DCB348FAC244B21736875E7811A3D6C81F44D9ECBB1D15076682B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 43f61b51a1734a3f18b359e36d9c9017d0b245d5e7ddbea820e35da4fd96c381
MD5 ec2d7962ccb9a5c3734d1c1750c12b12
SHA1 70a7d26be2abeed443fe123cc9cc07c2f4fc8b18
SHA512 6e0d036989320cb7883ea230705fd93d558083f718b7b6937821e6477c9eea77e5e21f1526508b56091351955f9091d6b13a8d11cd982a45693605d33171cacd
SSDEEP 768:prv+4UNbdG3NvyDTd+ZogeX6+qTko0u229a4vsDceVH1SdW:pbsbU3ZmvVTVKa4BEH1h
TLSH
T10E03BF32F8A58D778CE6D784714B75472FB92163C7881B80D9EDAB0D025B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7def14780b2608de720c57c7bde7b9dbaf09490a2aebd10d0ded182487d97c98
MD5 c491581c9f1a52309e22eef129bd6a8f
SHA1 c306e800af1b7b300eb74264bc359ee766fd6d01
SHA512 b5984d51f079f07d59d06a2259dd9de35cd3365ec8bfd6ae6b76915bedb7d632bdc1d7ff6dee41aeb32ff3ab673732349d0932f0f0677b99d856104691736355
SSDEEP 768:Qrv+4UNbdG3Wa7DTd+ZoH0beX6+qTko0u229a4vsSXeVH1SdW:QbsbU3kpKvVTVKa4ZEH1h
TLSH
T18E03BF32F4699D7389E6D684714B72876F7821B386840F94D8EDAB4D064B1AC270FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

email.mht

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\1X8S4OED\email.mht
Size 32KB
SHA256 473acdf41d6c722707456d3d0829d5438c67c4a2c5f0fb31b1a281ba33bda5c5
MD5 e5f1149f00cc683cf9ef75073aa4bc5b
SHA1 e7415f2c89b6f6ee25865fb8e5b1779c295229f5
SHA512 68e2555c36f7a78b8cc5bec466778d24bfefc0964f9cc9036f5667c986cb72f55dbb1d36c687213bfff7158b96f00d45a621dd92d3eeeae25f2edbf21342cb8a
SSDEEP 768:FMVn9elOC65VXROl1e1678VjI+li+u6V3Bpli+u+VXh6lBtpHHHCH7HmHfVzhWlc:FMV9elOC651ROl1e16789I+li+u61BpG
TLSH
T16BE234849EE38EF4067173B09A722E84E7E18A8FD712115573BEE364DF4E90048677B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1f09821-9c9b-459f-9835-64bec4026a1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\b1f09821-9c9b-459f-9835-64bec4026a1a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3376_867094480\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-9-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-8-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-47-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-14-0x00007FFD5E8C0000-0x00007FFD5E8D0000-memory.dmp

Download

memory/1608-13-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-12-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-11-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-0-0x00007FFD612E0000-0x00007FFD612F0000-memory.dmp

Download

memory/1608-10-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-15-0x00007FFD5E8C0000-0x00007FFD5E8D0000-memory.dmp

Download

memory/1608-6-0x00007FFD612E0000-0x00007FFD612F0000-memory.dmp

Download

memory/1608-5-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-7-0x00007FFDA11A0000-0x00007FFDA1403000-memory.dmp

Download

memory/1608-4-0x00007FFD612E0000-0x00007FFD612F0000-memory.dmp

Download

memory/1608-3-0x00007FFDA12FF000-0x00007FFDA1300000-memory.dmp

Download

memory/1608-1-0x00007FFD612E0000-0x00007FFD612F0000-memory.dmp

Download

memory/1608-2-0x00007FFD612E0000-0x00007FFD612F0000-memory.dmp

Download