239f0e95e466ae1863003bf9f65ca1274ab188e70010edb98b2c4dc0542bfaa0

Analysis

user interaction
yes
max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0 - 2026-09-03T142505.100.eml
Size 79KB
Sample260903-ppfsyas1cs
SHA256 239f0e95e466ae1863003bf9f65ca1274ab188e70010edb98b2c4dc0542bfaa0
MD5 23b3d72095638af237bd9f0e4084a5fa
SHA1 49e032594970247e0b679219a0ff31bb2b66247b
SHA512 cc2cc920d2bf6f930aac6a314d40f498c9558d211eed7a23889c6e9e30a0e6755ae3180748bb408c9e586db7bb7dd69e306f1825fc8bc0713ab2ee84bc3aa2e0
SSDEEP 1536:69IeRE7VvX3VQ936B7kcYe6npC/IbtYn9TpFtfP1rr1Ymde680M:6akElFQl6B7qC/I5CTFRP13CAM
TLSH
T1E7836AFF3D524C296B4412ABFBCFE4D46E3E5FCF107508F8A46D2222125D3564AD24A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4048_191055921\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329122517962152"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{FB4756F9-A703-4171-9C52-24E47315189B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1700	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
1700	OUTLOOK.EXE
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4048	1700	OUTLOOK.EXE	94
PID 4048 wrote to memory of 2864	4048	msedge.exe	95
PID 4048 wrote to memory of 5000	4048	msedge.exe	96
PID 4048 wrote to memory of 2556	4048	msedge.exe	97
PID 4048 wrote to memory of 2556	4048	msedge.exe	97
PID 4048 wrote to memory of 2556	4048	msedge.exe	97
PID 4048 wrote to memory of 2544	4048	msedge.exe	99
PID 4048 wrote to memory of 2544	4048	msedge.exe	99
PID 4048 wrote to memory of 1712	4048	msedge.exe	100
PID 4048 wrote to memory of 1712	4048	msedge.exe	100
PID 4048 wrote to memory of 1712	4048	msedge.exe	100
PID 4048 wrote to memory of 3716	4048	msedge.exe	101
PID 4048 wrote to memory of 3716	4048	msedge.exe	101
PID 4048 wrote to memory of 3716	4048	msedge.exe	101
PID 4048 wrote to memory of 1120	4048	msedge.exe	102
PID 4048 wrote to memory of 1120	4048	msedge.exe	102
PID 4048 wrote to memory of 1120	4048	msedge.exe	102
PID 4048 wrote to memory of 4124	4048	msedge.exe	103
PID 4048 wrote to memory of 4124	4048	msedge.exe	103
PID 4048 wrote to memory of 4124	4048	msedge.exe	103
PID 4048 wrote to memory of 1416	4048	msedge.exe	106
PID 4048 wrote to memory of 1416	4048	msedge.exe	106
PID 4048 wrote to memory of 2908	4048	msedge.exe	109
PID 4048 wrote to memory of 2908	4048	msedge.exe	109
PID 4048 wrote to memory of 640	4048	msedge.exe	110
PID 4048 wrote to memory of 1048	4048	msedge.exe	111
PID 4048 wrote to memory of 640	4048	msedge.exe	110
PID 4048 wrote to memory of 1048	4048	msedge.exe	111
PID 4048 wrote to memory of 460	4048	msedge.exe	113
PID 4048 wrote to memory of 1320	4048	msedge.exe	114
PID 4048 wrote to memory of 1320	4048	msedge.exe	114
PID 4048 wrote to memory of 3752	4048	msedge.exe	115
PID 4048 wrote to memory of 3752	4048	msedge.exe	115
PID 4048 wrote to memory of 4304	4048	msedge.exe	116
PID 4048 wrote to memory of 4304	4048	msedge.exe	116
PID 4048 wrote to memory of 3180	4048	msedge.exe	117
PID 4048 wrote to memory of 3180	4048	msedge.exe	117
PID 4048 wrote to memory of 5584	4048	msedge.exe	118
PID 4048 wrote to memory of 5584	4048	msedge.exe	118
PID 4048 wrote to memory of 5900	4048	msedge.exe	120
PID 4048 wrote to memory of 5908	4048	msedge.exe	121
PID 4048 wrote to memory of 5916	4048	msedge.exe	122
PID 4048 wrote to memory of 5368	4048	msedge.exe	123
PID 4048 wrote to memory of 5368	4048	msedge.exe	123
PID 4048 wrote to memory of 5768	4048	msedge.exe	125
PID 4048 wrote to memory of 5768	4048	msedge.exe	125

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 - 2026-09-03T142505.100.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.rewarded.co.za/mywelcome/e85295f7500c4b1faea747a08ca11c65
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d8,0x7fff3419c188,0x7fff3419c194,0x7fff3419c1a0
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,10188377236080853462,8864259279237524601,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16666843436214238843,6905925812303729821,262144 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,2303572437636843276,6299626982209454045,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1023438846666850667,9994212127238886230,2097152 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9405119646282854011,18364457414343955638,2097152 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,5160621820324365263,279556360856328150,2097152 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,10144440496875094115,5975398967079270878,2097152 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,14043388398493208259,6720768542301467979,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6308402416300396734,11977792681128810447,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,5013984846114634127,7852060309963533206,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,236682260955153465,5633261174153830439,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,276281517424781713,11604365814636942164,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,276281517424781713,11604365814636942164,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,12127665459884454503,10562975106716172076,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,14593747176297993292,5399084144056613170,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1632010164180244753,6733887051153677063,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,18150710134002179389,5222601339565869141,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,405234445214765704,16018452378825433431,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,10514616108771946464,13405704373267745963,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6152127851321146874,1696736713973095588,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,13088432779939318256,4203435802556127635,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,16569121960885242087,12618883441761568039,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6682515684860365391,3110827639798644924,524288 --field-trial-handle=2300,i,4477180208762265407,2304456794375911858,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4048_191055921\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 604d2220298d6eade8b232c8e13900643f70ac1cfe59ae2d7a086e2012aa4783
MD5 96e67f9722395e6d5c627f3a71beed9c
SHA1 336b0f87d2237364a495ac0da0a935dacbd97c1c
SHA512 7c450913b404e257b783ba015a85d742dcc460bb369f9a83b78454283140bbc347c4d3c65e4d4199f3e3d5c2035ffdabffc367582e2dd4870956ebf027bbf3a9
TLSH
T15871A354126BC94ED7210331E0E33534FCB28FA90EDFFE95118197BE19E1F6E2166418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b2db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b2db.TMP
Size 3KB
SHA256 51b3f76407e2dd35a91b794d130b994e4792895df0322e8f4a95d080adad483a
MD5 97edba7de45bb316723553432d2247c5
SHA1 441e6e9eebc84db02f8f2ca047bdc7d3ea636e40
SHA512 d4fed6228fb45bbf7fdc62689d6ba29c65bf1ff871210b15980680f56888572dd3ee72bcb2b9da3b4dda301da04ca28c9e25971bc780ba8a2cbbc358184b600d
TLSH
T189719118126BC98AD7200331E4E33274FCF28FA90EDFFE8511855BBE19D0F2D612A048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a79dbc0-0c0e-4f23-bfbc-62da5ab10ad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a79dbc0-0c0e-4f23-bfbc-62da5ab10ad5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4b80cc67ff439fdb0e1180d62497b38662e8dae90be3ce261c02abacd18f4a5b
MD5 92f87f4533624484cef4041ffc3788a2
SHA1 6e9fb2374db84440d47833bee77ca944155f5947
SHA512 cfbd7925e25a088b6e17d8239e836ecaf3d69ef650d2bd5ba8430962ab73c46c83f0b08caae1e4207063851509d3e876f4fb830c6b7f4773458de73105f03f24
TLSH
T165519FE3C2E8CA6DC91159F0AB146E2BCE2D0914836C3D5AC9E4EE5B57E2471E201A5E
MD5 SHA1 SHA512 TLSH

Submit Download

ee5c84e2-c325-44b3-bbcd-2b3d74ce1ca1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ee5c84e2-c325-44b3-bbcd-2b3d74ce1ca1.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6325393ecf286cc0f525b42c45ad414dd1ba40bb65b3760ae110281ac34c1bf9
MD5 b5bf101332167e2db0dd809ba545ccb3
SHA1 4c7c2e3ccef801a0536143f36c9aef8ec71238f0
SHA512 a8db4c0406add497a7658ee60cd521a1f5016d77eff90df484e821d1c67eb19ff1f49f77eefac52b884008710bb4a9765d83eb7f20ebf76c6abb695db4f0d6de
SSDEEP 192:sxZuR1yM/jK1Ml8MiC/fmsjW2DbIdpWANIHW6+WNKvM/S6wPfvZIg4J:sxZuNqC/fmsjWLcHbF/gc
TLSH
T12B52F901AA34A97BCCDFE209F555BB93D6F5456292900E449AFCCB1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4cab62aca027dcd7d005fe84dd41fb0f0f3f995cb823eaf402f429318648bb23
MD5 4da8ca8a70ca69bd7d855d9cfe489fc0
SHA1 493eeefb9b98757f376a7d0022a09493f1ddbd9c
SHA512 c18eb6189f30376369e200f2be65f38e09bb5c0dc9b1854c16f039c420c69da825458fda03df4d2a5061b4c12ab57e04343ae25dfe048edd3b0da9a7a16e365d
SSDEEP 192:sxZ1R1yM/jK1Ml8MiC/fmsRJ2DbIdpHKANIHW6+WNKL/ZS6w2PvZIg5/J:sxZ1vqC/fmsRJLIHbSZHj
TLSH
T12F52E811BA34A97BCCDFE219F5417B93D6F5456291840E449AFCCB1C04E6BEE221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 032ea0a3e171802c6c66c0bd981af016791c9fc17def41b7683b3f41829f6d7c
MD5 4aafce1795afc8652ce7cdafef88c8d1
SHA1 bb25acf4a99323e1d2a56d7f048ae2a9a7687dca
SHA512 c988960af24ffb6d251c868830addf3a52470a9bb473901498e15cddccdcf093258cf21d7050aeba4bb2655041bf2d327fe545db600d6bb00f5be89b923b0e29
SSDEEP 768:tq4jey27pLuLzmmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTS3cPLlrZ+d/rj:tq4jeyWEzmmWvmKxEu1jaKS3cPLZQdso
TLSH
T1E5F20C3B680CCF7E4F844E9CED2ABE8B6DE8018B5A988D5447FA444C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9112e4c95f5ce272eaecce3d93f3f7890a8863f1e3d32a941b94dd1dff6a717d
MD5 8368f2252674c76eae13a51c63f5a462
SHA1 d0649d5473022943c3e3fdf2a57b65d6724ce6ca
SHA512 95b9bcea66d304b0a0e3f8ef5514f0400972275c280253a45f479919062b10305f5f4f6c4a0c8277999b9d4a21650a905274e230b3105d9953868601a7ba3153
TLSH
T133A00237219C8845C0904274D89A46D83352D9145D0D275380F4525CCC521454D52418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597b12.TMP
Size 48B
SHA256 32cabface3ce2ac581594f5c9adc479dab466344d87193ad1626dce0bdb79153
MD5 aaefa35badc155aa79c1beab7918d4df
SHA1 eb34117130a3fcacbba1c1a4088294ac9a725ae2
SHA512 ffaf40d90214879059e94cb4d858a2ffac441a32e41dd86ebd10e4e8f0abce36cad49736c8048a48b869fc4e8914b8cff0996c6220ba2ca4dbe86e77099271f4
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 89b2204eff500df8b453861c59261aa67062a066dc9462f53db471ffe8eca263
MD5 53ec3cd6274c287b1a0751983762002e
SHA1 225ae504d2c8a9a98c5a81421f3a0c5b978b614e
SHA512 b979a167dac1f30dc3390ed6127a48d47fdc5b416d0dc5228d1e88e6fe35d22ab9e82265a028f8790ad4b666e8946da230281ff4a70a6b0848a2683de2bceb50
SSDEEP 48:K88I7KZiEzyNdIpKGkcSaIfKbSAfypIBKOQ+Y:K88QKZi6mdKKGkdasKbSCCIBKOQ+Y
TLSH
T1E591475372BB43526C3E28199761972B574172A33504EA2B3B9800764E2BF294EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0485.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0485.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 aea0c0df76dced1317b7fdeabf08fba617ebed0a4e9ee7f896f8259a434f63cb
MD5 d1808f7262262aa082508def246498bb
SHA1 534d61bbe1cd8c97dd9f75cae4bf61de6180eaee
SHA512 dbf762a0eb53dd4c80e2d0b7d462da5b1eef52d0805d188f1ab2f8739526460bf3a29d23daa0728e15796a27c3f8b620e9f732168a23933591c41e4eb8539c3b
SSDEEP 384:nIsNRujzDLZGuf+98RUlXU+2mWFoxuvzxV+Mhdplf9:IXzZrqlUlmIo4184plf9
TLSH
T117622B317438AC639DDAA145F45B33A39EF811B79DC56F84E6E99F1C008A29D270EC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f1a1c449bcb98bff728202f730b699c5b694d371516827b895bcf3ecb19ccae
MD5 090294a330304c177fc31267088937c5
SHA1 3dd53d8da19faf02b0ba9f060fc20aa6ea8c6e92
SHA512 42737bf0a20c2fe0e0561f4bc0940814c44c9fffa428a477576ed9e994b608ddb71203c1fd1f193185f811b7b17d2c9d6d9a17aeaba5af34083d79ea1d3d27fb
SSDEEP 384:nSZcIhsNRTjzDLZGuf+98RUlXU+2mWFoxuvzxV+MhdplfCo/:gh6zZrqlUlmIo4184plfCA
TLSH
T147827D316878EC6398EAF146F48B33538EF8507799C56F80E5ED9F1D008579A271EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d3c83ce0077ebb226b3dcd437529c341712a65b1b895785135221fa0f0de3a4
MD5 3a8e3a2d2176068e62d3b5c7494d346d
SHA1 d7e6e78888c00eaffd96bbddb4221d94d69b0be9
SHA512 539c9ae35004dbfea71bf6df06161567f088558dc542ef485ad8d560543d9ae37bd6fb56164584d04312d334f0f6e5ba854ad79777f9bd9cdc12b2be04178578
SSDEEP 192:EONu6hZ0QmiUy0Cpc/+jVnjzorRUY5wOZfzU6:EONu6oepu+98RUn27U6
TLSH
T15202EA35A8787C778EE2AE45F48727239FE5112BA9956B84DAE81F1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b9bffd4b6b48a7ffb69393b91c96d16905980c35be45873c2807e9a893b3dba7
MD5 7162ccc7d2fe27b7e633f8d76b41c5a8
SHA1 c119cf7593ddc20eb982d3418292ca8d9bde2118
SHA512 12303b30be1f65ac0402d0a92204f7ae7c70707f5083a8d4395d5a2197d6e9c3bdf2f21f845885da969a2e9b3f6899f34c53b2cf048b0c9c79bb531b0bdd0fbd
SSDEEP 384:nJZcIhsNREjzDLZGuf+98RUlXU+2mWFoxuvzxV+MhdplfCo/:BhTzZrqlUlmIo4184plfCA
TLSH
T12E827D316878EC6399EAF246F48B33538EF8507799C56F84E5ED9F1C008539A271EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2db4ce3462c5e8c038dccb0162f57bcccc7bf4a6dc3019efef669dccefaa503
MD5 43b1c60dc480687c147e500bbf465107
SHA1 f18938ba67671bc82e2c0c83b5eab64b01447058
SHA512 ae96a4a4102b9deef527bf6fd709189d97eb3cd4dcb6a870315c92abe985bfed27987a7d4cdb5eba71c457f36061ecbd15aab18fb67991b55da503e7e6cf05af
SSDEEP 192:6ONk6hZHQmiUynCZc/+jVnjzorRUlXU+2m35cOqHqFZU6:6ONk6djZu+98RUlXU+2m69oU6
TLSH
T1D7121C31A428EC674DD6B641F08733A39ED411779C856F84E6E84F1C04C679D370EC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2bde9f6eed2c97e4d9ee8c627dc35e22e736fd43a1bdb06c08b6ef54e785797f
MD5 10178b771cf4b09f2baf4dbfc7216f1b
SHA1 d0501913f51300276509f6274c66d75bad515788
SHA512 1c9d1f4ede83f846d9d77752a0f09967c9a6fce1fd832e7540fc9ba17973cea39a0c07d8f0d382894387dc17080ba1216e4e764d6b8b55717e7bfe29cc853f29
SSDEEP 384:nfiFiZcI3sNj8TUNTUlIlTjzDL5GurDfYx+98RUlXU+2mUFoxuvzxV+MhdplfCo/:qFQ36wglz5kxqlUlmyo4184plfCA
TLSH
T155D2A4F198D79977E8AE5383A73E2E428EBCC16374885980B7D95E0CCC421BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a8fc2030ce004eab2c50030d8b4c5abf5255e5decb9c33c1b468d823e43092f6
MD5 6aa93b315e5388b25bd9387a8e9c4fce
SHA1 ff98febc7a9e6a264714737d3ba95b9e37a0b54f
SHA512 b59d0f787f465744a747f3bde6e08808b3515b8d7d019c2b15b61f2c92a4fd26fcd4f50df4dd0ac384b1a5ea80edcf701f4b06e068708286c4ffc49da2e0586d
TLSH
T102412C5CA6F92144B3B7BF5A5BF6796E487EBA731E07D09D00010E4E4A22B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

40d75bb3-c28b-48c5-a3d1-e0bb5fb210e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\40d75bb3-c28b-48c5-a3d1-e0bb5fb210e9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bad3a58a-30c8-44e0-a0d9-2771f00c0c0c.tmp

Path C:\Users\Admin\AppData\Local\Temp\bad3a58a-30c8-44e0-a0d9-2771f00c0c0c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

49da2d70-8bb6-4854-9c04-178a64c9611f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4048_1710480388\49da2d70-8bb6-4854-9c04-178a64c9611f.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4048_2087276174\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1700-7-0x00007FFF5D530000-0x00007FFF5D725000-memory.dmp

Download

memory/1700-5-0x00007FFF1D5B0000-0x00007FFF1D5C0000-memory.dmp

Download

memory/1700-9-0x00007FFF5D530000-0x00007FFF5D725000-memory.dmp

Download

memory/1700-6-0x00007FFF5D530000-0x00007FFF5D725000-memory.dmp

Download

memory/1700-10-0x00007FFF1ACA0000-0x00007FFF1ACB0000-memory.dmp

Download

memory/1700-2-0x00007FFF1D5B0000-0x00007FFF1D5C0000-memory.dmp

Download

memory/1700-44-0x00007FFF5D530000-0x00007FFF5D725000-memory.dmp

Download

memory/1700-1-0x00007FFF1D5B0000-0x00007FFF1D5C0000-memory.dmp

Download

memory/1700-0-0x00007FFF1D5B0000-0x00007FFF1D5C0000-memory.dmp

Download

memory/1700-8-0x00007FFF5D530000-0x00007FFF5D725000-memory.dmp

Download

memory/1700-11-0x00007FFF1ACA0000-0x00007FFF1ACB0000-memory.dmp

Download

memory/1700-4-0x00007FFF1D5B0000-0x00007FFF1D5C0000-memory.dmp

Download

memory/1700-3-0x00007FFF5D5CD000-0x00007FFF5D5CE000-memory.dmp

Download