f5312fa91b4182613ec8047e40e01ffe7ae0fe451817356bb86744916ff65f9c

Analysis

user interaction
yes
max time kernel
85s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shared Document.eml
Size 2KB
Sample260908-wdb4yawcmd
SHA256 f5312fa91b4182613ec8047e40e01ffe7ae0fe451817356bb86744916ff65f9c
MD5 188b7706a459d02341aaefcd604718ed
SHA1 9f2aff2fc401d1095a860d42d6c69b1a68dfd235
SHA512 880a47246666d564cb661b9664ebaef42d1cc19adad7fe4c8e1bdd6524c2659ef52979e2541ecd94605437c62647f9517344383f09d51b9b3e448632755ac4f3
TLSH
T13C41CA73BC6E84C46075DAE9E13061459B680D04D04A4D72F0B932EB78CD9E4D5137CB
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1540	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333633179068385"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DC5D5A7B-33DE-4F1C-8816-D8A666EF000B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2416	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE
2416	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2036	2416	OUTLOOK.EXE	97
PID 2036 wrote to memory of 2160	2036	msedge.exe	98
PID 2036 wrote to memory of 1540	2036	msedge.exe	99
PID 2036 wrote to memory of 4260	2036	msedge.exe	100
PID 2036 wrote to memory of 4260	2036	msedge.exe	100
PID 2036 wrote to memory of 4260	2036	msedge.exe	100
PID 2036 wrote to memory of 2024	2036	msedge.exe	102
PID 2036 wrote to memory of 2024	2036	msedge.exe	102
PID 2036 wrote to memory of 3476	2036	msedge.exe	103
PID 2036 wrote to memory of 3476	2036	msedge.exe	103
PID 2036 wrote to memory of 3476	2036	msedge.exe	103
PID 2036 wrote to memory of 2832	2036	msedge.exe	104
PID 2036 wrote to memory of 2832	2036	msedge.exe	104
PID 2036 wrote to memory of 2832	2036	msedge.exe	104
PID 2036 wrote to memory of 4672	2036	msedge.exe	105
PID 2036 wrote to memory of 3160	2036	msedge.exe	106
PID 2036 wrote to memory of 4672	2036	msedge.exe	105
PID 2036 wrote to memory of 4672	2036	msedge.exe	105
PID 2036 wrote to memory of 3160	2036	msedge.exe	106
PID 2036 wrote to memory of 3160	2036	msedge.exe	106
PID 2036 wrote to memory of 2620	2036	msedge.exe	110
PID 2036 wrote to memory of 2620	2036	msedge.exe	110
PID 2036 wrote to memory of 5056	2036	msedge.exe	113
PID 2036 wrote to memory of 5056	2036	msedge.exe	113
PID 2036 wrote to memory of 5056	2036	msedge.exe	113
PID 2036 wrote to memory of 5056	2036	msedge.exe	113
PID 2036 wrote to memory of 3816	2036	msedge.exe	114
PID 2036 wrote to memory of 3816	2036	msedge.exe	114
PID 2036 wrote to memory of 5280	2036	msedge.exe	118
PID 2036 wrote to memory of 5588	2036	msedge.exe	120
PID 2036 wrote to memory of 5596	2036	msedge.exe	121
PID 2036 wrote to memory of 5588	2036	msedge.exe	120
PID 2036 wrote to memory of 5596	2036	msedge.exe	121
PID 2036 wrote to memory of 5812	2036	msedge.exe	123
PID 2036 wrote to memory of 5820	2036	msedge.exe	124
PID 2036 wrote to memory of 5812	2036	msedge.exe	123
PID 2036 wrote to memory of 5820	2036	msedge.exe	124
PID 2036 wrote to memory of 5472	2036	msedge.exe	125
PID 2036 wrote to memory of 5472	2036	msedge.exe	125
PID 2036 wrote to memory of 5452	2036	msedge.exe	126
PID 2036 wrote to memory of 5452	2036	msedge.exe	126
PID 2036 wrote to memory of 5452	2036	msedge.exe	126
PID 2036 wrote to memory of 5568	2036	msedge.exe	127
PID 2036 wrote to memory of 5568	2036	msedge.exe	127
PID 2036 wrote to memory of 5568	2036	msedge.exe	127
PID 2036 wrote to memory of 5740	2036	msedge.exe	135
PID 2036 wrote to memory of 5640	2036	msedge.exe	136
PID 2036 wrote to memory of 5328	2036	msedge.exe	137
PID 2036 wrote to memory of 6132	2036	msedge.exe	139
PID 2036 wrote to memory of 6132	2036	msedge.exe	139
PID 2036 wrote to memory of 6132	2036	msedge.exe	139
PID 2036 wrote to memory of 3792	2036	msedge.exe	141
PID 2036 wrote to memory of 3792	2036	msedge.exe	141
PID 2036 wrote to memory of 3792	2036	msedge.exe	141

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Shared Document.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.cl/goto?url=CAESYQHrOzAVNpwy8GUzro-0boVrPLtPc4YwUJaHOXvzQrOPNv5is0dns9adXy21rMy2IErn9X8pY8y8C6SGpjvag1ia5WA2yuAx_WAgquFZUIwYQzpgIjVkvuqmJ-VltnM_I1E
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa5443c188,0x7ffa5443c194,0x7ffa5443c1a0
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1900839599567125477,15047312559055313715,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,13678217827216360178,6371606877951584936,262144 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,11018136862308631189,1020222339335197434,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,12475952043591065454,3841114025990513694,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,14890364355622599593,12508536496598540781,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11765111819484513537,8853946055503449030,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,9779116129836663367,16696608792842829230,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,7424070570362453932,16186505691920631466,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,10366838284446507604,14002824795698136139,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,12773144872643516350,7151227354512333824,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7058288345695054559,15176296160058895161,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,10938661662577202447,8704250969274482331,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,10938661662577202447,8704250969274482331,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10233256923036175283,10734346837288165466,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,8581973274645959046,7230144182424220161,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12269233968046261879,14896575473018936084,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,13172419407227600734,12573771696575984763,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,7725878124706927659,5163790362317155497,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6332,i,14790292731874070662,9199101211960917562,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3516,i,17185595731505826512,1542792351381638943,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,861806862400162951,17654155213431914927,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13853147283563944932,17016080565940466530,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,5161312123691131435,7711555744409803450,524288 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6556,i,13919563306797536937,9928567367775822509,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3592,i,9908111687891435051,14756231879198444481,2097152 --field-trial-handle=2276,i,11498640855393611814,10155749782367361253,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2cfe0e512fe66762495535e6076a96bb4e6ed6f34c98c4a7f8df941ef3c8c17c
MD5 5c148bcc6fa502a2fee964c0dd6afdfc
SHA1 9199b6a7ccde16500ea75a0020ab5db0df5569d4
SHA512 4631fdc4ed2e6e278c330749a012433d939adf4beecbd21c6f7a1cb60fe9640888daa64ec4b81642fafbb45e59921d422ffcb8d6579eb20f08c08622b263623c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T113B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22df140cf27633bb5a5cfb41856accaa97390f0e68ea50ce283a05244e70c75e
MD5 8309d4388bf9ad61f64efb2cff858a46
SHA1 5d506ca1d6f3121b4913ac8dd94595ef742deb8f
SHA512 c96144f89130652cb71678e2400de8c4bfd6104eb4607c508a56a32ccdaf7e724e084d306bf7a01138b4da19f98f2e33e355a539958acc257501ad3d4835f6fd
TLSH
T1F0D023207E7DB5D1E1271038E513474032DD55F63547520BF550451E5D7A4C393DE9D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71570742241edb6ab8077c8ac2e9786174fdb40614e75e58552b75df2bcbee59
MD5 edc6cedc4bd0ab3893e6b397a7a34f76
SHA1 e9a0a5ea92237a59f6e2591ed073b1c31ae7c6df
SHA512 5fa998c29ba86da7288009c5fe0c68e14e92a2b674bef5fe248fb1ba115011e44a14038339941907ce5ecc8d56790eee94cb4e8b331a2c62c8139febb4b50438
TLSH
T176716EB0140EB8A9E35E0138ACC25E0CBF7140E9F817BF7D1A508F75551DB2882FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590edb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590edb.TMP
Size 3KB
SHA256 9cd11986892cd22ba6e9e39e9e648162c87ba15cbff45779fedb10d576f2a12d
MD5 7332cf68ec3de8c82f008f65e442d77b
SHA1 b7508841c7c6851b64466a997d1f6673313b5432
SHA512 2af014205d6e00fc24bfec7313e79bd0babb42a65dc50342683985fb099a6615e81934518625e404af87003c93a9a0137c6bcd4960d05cc8928b45ed0fb632ab
TLSH
T189714FB0150EB899E35E01389CD25E0DBF3140E9F817BF7D1A508F75551D72981FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 821b994aa5b82a76193eaef5e3b1ac41797b10274e03efafa761867e96b92cc2
MD5 ac4735bdf8bd2418caf4ec5184bd9fb2
SHA1 d72166c633e5b378e8c48624e2de7f72c33986b0
SHA512 638ceb20f52edfa871fec28383e92a93e1c3b69b419d2c9e1865ab4f1c93a2a47660cc33b3f6ebd599301278530bf8fd941140e1f3f4a3f76a9a5c06f1eeb338
SSDEEP 3:MsEllllkEthXllkl2zEkl9:/M/xT02zn9
TLSH
T1984404047FC00505C53710734011D3510370F4114511D74734514C535DCD5440C10010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 894043e871478a2c4bebd46e3734fc9a6e2d92e9a06e24cae1c8d992ab9840e2
MD5 13dea02e97fc36bed760ae3ca79f5fba
SHA1 86a475eef6af1b47917a0fa31d64d4d904d375bd
SHA512 a197994032a83ebe20a7360ae48f7bfa3c6665b51dd41deb82cc98c914930cf427067d0c6b97990efff8986eb36e7a7399193beb6480cea46e26e4cda8c5c6e2
TLSH
T10941AEF7C3E8856D894196F4BB14AE1BCE2D0A14832C3D5AC4E4EF5B93E2471D24194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 058fcbfc801c6da2a1baf86bd008493a5bb5e97a13b2670ccd4a4e74c633e896
MD5 30a8be9fbfa5df48f2782cc871444a4a
SHA1 027b679a25202b9fa0a54df376bc7927a01b5c88
SHA512 a06c30ae914fc24022c38cf31b8b612911e3f93aa1a8cfcc34537e4fd98199cf94df20661213e7237b586772fea65f4886e6a5ee621ae71669b325fe56aa6259
SSDEEP 192:sxZnbREyM/jK1Ml8MiMm/fs4sYt2Bp1MIdpJHW6+WNGYzctJ7Ig4J:sxZbiqn/fHsYtyJHbGZc
TLSH
T17442F806AB34997BCCCBD309FA557F53D6F51463A2904E44A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3fa87417207b57c2796d4f7f5779aa15ef25b18ad92234ea3de1e10a63f888ce
MD5 87d4db6925fe664cddc75205578be3ca
SHA1 a510a7cf46ee27354a567a6ba16c9ae15f364fb8
SHA512 8f1e908a8af66402774c005aced0e5e575a29c6b15a9db62d79dc361972dfd51bef53ed8f0b9cbd60749f5d12bcc5f741f542753c3de6d6b9c2cf376d3d74514
SSDEEP 192:sxZnbREyM/jK1Ml8TjMm/fs4sOWpVcP2B21MIdpIXDHHW6+WNIck7/YThY+Gir9f:sxZbK+n/fHsOWvcP5IzHHbIr/iNf
TLSH
T1FF62F912AA34597BCCDBD209FA857F53D6F41863A2914E44A9FCCA1C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3a3e566709c9bf5f9f80fbe90f00d231b256abdf9854a84b919ed7831fcabfca
MD5 77701c4fcdbd682f9bbfc7b3bc69096e
SHA1 cb0d8d3b193be8d2c3d44396d572554c3f335084
SHA512 79d928dc688d8fce001d0048bd6a94f4e054ea92aced0ffd16b2f18020c240d3960c98bf64081e55f9fec8b8410df1bc417460cb51a2856965340d8a95b40037
SSDEEP 192:sxZnbREyM/jK1Ml8MiMm/fs4swP2B21MIdpIXcHW6+WNIcoP/YzLvJ7Ig5hJ:sxZbKqn/fHswP5IsHbIb/IN
TLSH
T18752F912AE34997BCCDBD209FA857F53D6F41463A2904E44A9FCCA1C04E6BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fef198de5c5a3975f379b8b61e8bcffb3cc8c7d1b908f19a2ad2b5c8eda63174
MD5 6cf9125308eecec42ea3cb22b30e1bec
SHA1 e771ce2dd18820fe3b5f524be9d5624fdec760e8
SHA512 eb140957e7464a2f0ba394817f41c90bc53b3730e6d629d7af8dfc96794d7c5a643e58f1157438c3a43e3429fa5b5e9ff542f464e0ad9b08b15d942ede4b0a39
SSDEEP 768:JMW7kTi7pLuLb80Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0Fa5LlWYSjyrop:JMW7kT6Eb80Wvqidau1jaxFa5LA3jpyA
TLSH
T1E0F2FB3B7C0CCB7E4F844E9CEC2A6E9A6DE8018B66D8C95447FA844C03C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aa428f3738266d840cc572f13964beae3e8562dbbd94da301188e71d8cf24ebf
MD5 8b4a33c1e7f73af06bf8c4e21726e5a7
SHA1 30c5a9e4bdb5def38e0d02133ecd760bd17d7b47
SHA512 e8c3e942b33de30a6f2b3e8f3d6ca742f68a758e147652f339778e1f2b23bfd80e7e931f2e5c6a33437e30ece5503581f99c24c9b91a6bb356115fa7f51114be
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT73sbnR9JkZ9uPIufkKjB7pkPH08ORH5yljIBKIwEwxo:KIbCKcrUAKdamuj6KIwfxuKKU6
TLSH
T1F1911616363B0A113CBD6889B2A68A275F4232633014F4AF7F78207A5D6BE250DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 9cf60cbb94fd19cf235a2ee508fe86e54813c3a20bc1711899a8feea42ae71b0
MD5 99085e451a665f081ee34e84454aabe6
SHA1 05516ecc573b730dcffa2ff5d6986b4794ea6b78
SHA512 b2455bf52f61c119ba35c4255d9f1b2757f25bdac077f4535f30f1881bc08e5cd08c5aff873db35a41de95f7a1085b58b0c9f1c1e333f1e0cb95e773694c72e6
SSDEEP 192:zVLsNXeQ2LSrvLBb9HQmiU1e304aGBPKb++FdG24RFC1SJrojdN3ZSqqGqva+4Lf:zJsNXebLabLmLSd3UCEJrUpDsa+VY+G1
TLSH
T146624B316D24AC3B99A7B245F98737539EB420B7A9C56E58E6D89F0C05CB38C2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 87d0bd64c59e37dc22bf8922bc27a99a0b3711600e76137f04566e139a6682fd
MD5 197ceb608bd391daac46396f9aeb5f3a
SHA1 566525b7f0f91d927b04755286b276a794b68c87
SHA512 52662e14483b0cf9a08183a3c9986ae152b4e49398d8605782ffd5a3d2b3be14a03f38bfdff33e9493e46ae286f6c3982516a330eed259b3f941a950852e2e1b
SSDEEP 384:n8ZcIhsN9lbLabLNLSd3UCEJrUyXA8tQI/AF5h4Mkkpsa+VY+Guo7:qhYLa9mYhUP8mF5h4Mk+hgr14
TLSH
T103B25CB1DCA52CFB5565E9C5A982E6036DF45037928D990CE6F8BB3D304FAF80312C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d77f745e182ef201ae3df563df9986a5b588bea79d9f6118f7c64b0c936beb22
MD5 8d093b5f743144beb2faf90e2c85ee4e
SHA1 94014b45155f2c0b965f44a2ef7f4e2a24473a5c
SHA512 2898b08a943d33575fc00c1afbf2420bd0efbb660770aafc25906b123edf126323705674654e837fe33b1c9cb2e24c13084257383fe03f3fef55b3a5d40bc87b
SSDEEP 192:yONS64BSQmiUyH6J5GBPKb++FdG24RFC1SJrotWw3ZSqqGU6:yONS6eOLJNd3UCEJrWpDU6
TLSH
T107120834A865AC2B6992B141F8C737539EE8107BEDC59F44F6E49B1C01D779C2B06C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c15a3ef4ea98201f3f9c3ac337f1e7e40cc41752615282c9cd926be735283c5
MD5 d5d5a2f27ecee46e7b749a0db42d6858
SHA1 62b62c521853f2f3ae28d260662804d7d2250e33
SHA512 b42dbc278bc5a764d8ec1d878001ef25d4b20f0443421134309d77b9bc6aca39feac5cb7a3bc2d9eab62ed9cd9f65a2ab3ce2595c49148ba9e6eccf5754b9b0e
SSDEEP 192:MONi64BAQmiUyH16W5GBPKb++FdG2MaD3ZntWU6:MONi6eAwoWNd39ptWU6
TLSH
T11502D834AC786C7B9EA2AE45F88637175FE8113BE6C55F44EAE85B1C019764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 eb279ff1793da0b690a9470455ee7f4978d37ce5b8d14651764679b515570a71
MD5 af0746a8b0be118c27098cc0ea5bffd3
SHA1 e8934cff90178411343c9087ca5c7a1a1c4acca2
SHA512 f75b3036565eab04724385181102e4dedea974968c91e12eb21cda7feb5ab530e6bd3b7ec938453a6b71bbb246d736cdfe97465b146821797b6024aa27344823
SSDEEP 384:niZcIhsNXlbLabLmLSd3UCEJrUpDsa+VY+Guo7:QhaLa2mYhUpDhgr14
TLSH
T1B1828D715C65AC7BA4A7F242F98637039EF86077A5C5AE48E6E8DF0C04977882707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c16218e0c0fa2a6bcc55aa37a469594c5c3c71bfd15d751dbeb98598911c633
MD5 ce0791641a4e91c8f14417a98001506c
SHA1 9c5f92d5b4c93b2d073526aab4acedb70ebe7374
SHA512 c7a778497d413e1f4d64e7a060c2768043b04dc647798630c725edc1cabb28b78089d9b6bf2f27023c5d0e71a19c5fe104e7248b8cf319dad813e7b90baa1a65
SSDEEP 384:nGZcIhsNXubLabLmLSd3UCEJrUpDsa+VY+Guo7:UhXLa2mYhUpDhgr14
TLSH
T14E828D315C64AC7BA4A7F242F98637039EF86077A5C5AE48E6E8DB0C04973882707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

456d2366-08f2-48a3-8c23-6551c10186c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\456d2366-08f2-48a3-8c23-6551c10186c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa69b1d790819bbeabc5ccde8502560d62a09cdec4fea0d8744ed73d37e0fe83
MD5 bcc051fb43b0c1eb184ffec1e78b4166
SHA1 45581745fd68b97302b4b82cdae4e5418452312e
SHA512 05e184141e5d1efbd7f3d38d33d37da5dcfea829fdeab96c03a420c947a1eaca660643e04def07a2c7d0465b20d2a52b9b0e2c094ebec88f0bde5a3069b326bf
TLSH
T13C412658BAE90108B3B77E1AABF6A86D487B7C372F06D45E10010E4F4A73B41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

78b2b5a3-505a-473b-878b-674faedccf34.tmp

Path C:\Users\Admin\AppData\Local\Temp\78b2b5a3-505a-473b-878b-674faedccf34.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea6e2bcd-3292-4346-9c00-e1ff763160ea.tmp

Path C:\Users\Admin\AppData\Local\Temp\ea6e2bcd-3292-4346-9c00-e1ff763160ea.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1527401262\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62f76491-baa0-4057-856d-9645ec1eca84.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2036_1824376222\62f76491-baa0-4057-856d-9645ec1eca84.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2416-10-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/2416-7-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/2416-12-0x00007FFA3BD30000-0x00007FFA3BD40000-memory.dmp

Download

memory/2416-11-0x00007FFA3BD30000-0x00007FFA3BD40000-memory.dmp

Download

memory/2416-1-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/2416-8-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/2416-9-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/2416-38-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/2416-0-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/2416-6-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/2416-5-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/2416-3-0x00007FFA7E06D000-0x00007FFA7E06E000-memory.dmp

Download

memory/2416-4-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/2416-2-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download