db649fe97e97824dbb32f8d9b0ba4d257c19a32c9b63e8a5bbd894d2d91aaaed

Analysis

user interaction
yes
max time kernel
209s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
original (22).eml
Size 210KB
Sample260916-va4jca1xgw
SHA256 db649fe97e97824dbb32f8d9b0ba4d257c19a32c9b63e8a5bbd894d2d91aaaed
MD5 2252f874e5be84a2d55a11476cae5002
SHA1 a15cb64b8c791df2bf3c7cc6cc7a0cb11b83927e
SHA512 bd2fafed9b11b347fa818c684b0feb856c3a89821c21f61396522a86e327083c50ff8d059474475d25031c2b4f46e8c3eb36eb791b75230fc17d4b5833976ce4
SSDEEP 3072:TvtwxL+GSw66TRRqNaM9lQy0tJN64C8j+X+vXCKNZSjAW52hcPHz:TvSxCm66TRg39UdCMqGSjAS20
TLSH
T15724C05349822364DEECAA18B47E33173AA9358F0DF1208D571EEF9D6130DEE1D924E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340510651987162"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{6C8C5705-BC27-46D8-8897-5C5D72E036E5}	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\phish_alert_sp2_2.0.0.0.eml:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\phish_alert_sp2_2.0.0.0 (002).eml\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\phish_alert_sp2_2.0.0.0.eml:OECustomProperty	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 57 IoCs

pid	Process
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE
3488	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2024	3488	OUTLOOK.EXE	95
PID 3488 wrote to memory of 4932	3488	OUTLOOK.EXE	96
PID 4932 wrote to memory of 1160	4932	msedge.exe	97
PID 4932 wrote to memory of 3764	4932	msedge.exe	98
PID 4932 wrote to memory of 3296	4932	msedge.exe	99
PID 4932 wrote to memory of 3296	4932	msedge.exe	99
PID 4932 wrote to memory of 3296	4932	msedge.exe	99
PID 4932 wrote to memory of 4936	4932	msedge.exe	100
PID 4932 wrote to memory of 4936	4932	msedge.exe	100
PID 4932 wrote to memory of 4040	4932	msedge.exe	102
PID 4932 wrote to memory of 4956	4932	msedge.exe	103
PID 4932 wrote to memory of 4040	4932	msedge.exe	102
PID 4932 wrote to memory of 4040	4932	msedge.exe	102
PID 4932 wrote to memory of 4956	4932	msedge.exe	103
PID 4932 wrote to memory of 4956	4932	msedge.exe	103
PID 4932 wrote to memory of 4384	4932	msedge.exe	104
PID 4932 wrote to memory of 1440	4932	msedge.exe	105
PID 4932 wrote to memory of 4384	4932	msedge.exe	104
PID 4932 wrote to memory of 4384	4932	msedge.exe	104
PID 4932 wrote to memory of 1440	4932	msedge.exe	105
PID 4932 wrote to memory of 1440	4932	msedge.exe	105
PID 4932 wrote to memory of 3408	4932	msedge.exe	106
PID 4932 wrote to memory of 3408	4932	msedge.exe	106
PID 4932 wrote to memory of 3408	4932	msedge.exe	106
PID 4932 wrote to memory of 2664	4932	msedge.exe	108
PID 4932 wrote to memory of 2664	4932	msedge.exe	108
PID 4932 wrote to memory of 5096	4932	msedge.exe	110
PID 4932 wrote to memory of 5096	4932	msedge.exe	110
PID 4932 wrote to memory of 1836	4932	msedge.exe	112
PID 4932 wrote to memory of 1836	4932	msedge.exe	112
PID 4932 wrote to memory of 1172	4932	msedge.exe	113
PID 4932 wrote to memory of 1172	4932	msedge.exe	113
PID 4932 wrote to memory of 4844	4932	msedge.exe	115
PID 4932 wrote to memory of 3448	4932	msedge.exe	116
PID 4932 wrote to memory of 3448	4932	msedge.exe	116
PID 4932 wrote to memory of 1240	4932	msedge.exe	117
PID 4932 wrote to memory of 1240	4932	msedge.exe	117
PID 4932 wrote to memory of 4904	4932	msedge.exe	118
PID 4932 wrote to memory of 4904	4932	msedge.exe	118
PID 4932 wrote to memory of 1652	4932	msedge.exe	119
PID 4932 wrote to memory of 1652	4932	msedge.exe	119
PID 4932 wrote to memory of 1552	4932	msedge.exe	120
PID 4932 wrote to memory of 1552	4932	msedge.exe	120
PID 4932 wrote to memory of 4764	4932	msedge.exe	124
PID 4932 wrote to memory of 464	4932	msedge.exe	125
PID 4932 wrote to memory of 1504	4932	msedge.exe	126

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\original (22).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\phish_alert_sp2_2.0.0.0.eml"
  2⤵
  - Checks processor information in registry
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\email.mht
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff9bd0cc188,0x7ff9bd0cc194,0x7ff9bd0cc1a0
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,16725458305592526582,6554900095466260924,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,16666335058555130813,16644670135045616708,262144 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,726594425416987331,1343621922245401208,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,16790176951317122390,5744160381665730229,2097152 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,18167142220982011778,1072640646460859826,2097152 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,7643052337062092568,5123804337661326498,2097152 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12840381911869524358,13830383765321161170,2097152 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3696,i,4814867925804670544,16283709059393885036,2097152 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,5217104527155046287,9051765562212806650,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5900215725169393498,12237643497819549443,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,7280879389405926896,7361444264065218814,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10214213291905684220,11296319838253653780,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,7744931350542736955,13483582772455267380,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,7744931350542736955,13483582772455267380,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17235156769579227763,7084287468860506543,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11258214935175037536,6099322779632717055,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14329237298942473340,13982718318371186937,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,5755010438364569315,15360757538782333205,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9067293019376852616,13828665649254112540,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7613504961032854450,13211695725465020501,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,14489507673506317158,8022851186478883237,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,6604139297794247567,16261020433722410424,524288 --field-trial-handle=2396,i,5800633504027275591,15002556420346129456,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
    3⤵
    PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9a41887ba252cbfc769045912fca82789927558c46b0ffd47304fbf1a7d2b6ae
MD5 3ab53217e4a6e811257cc6c5135d483e
SHA1 b537145b46ecef2007c3c541de86c7bbec58cd4b
SHA512 04dbf966a9aa8f52b7b15c88182ff3fcbd81e12a277863081198952ebab6a812c8d16ff47dc4b908a021fd3aa68cbe0ea3f5238ef2e70a1903022e19a1ef9159
TLSH
T1676183C1649240BDD79803B07DED2CE7B53C1AB966A37D10C59BE43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1b83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b1b83.TMP
Size 3KB
SHA256 3ddf10cf669abf07a2ac8a4789eb69ceed17bab2c43798828f142d0779bc1462
MD5 d322ce242e9cf7e0c5bd38f074a213db
SHA1 6a0379867840d7e990cf13b842d0be97bb6e1bea
SHA512 72c4265b6a65ad491bae5bf5c55fd7ec0d28e22e869b9419244a5935a2c75695eccfe1339312936db7a7aa533b768821afb38b6d64721be98e1911aae77bcdb0
TLSH
T1AF6183C1649240BDD79803B0BDED2CEBB53C5AB966A37D51C49BD43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0c6ee02de27d21f63db28929a8604b640798b1189290840f050d8b12971e7ee6
MD5 70b8d5ffa5c463d406b5eae3cedf1502
SHA1 9f628b23a3a6375978bc45d87d3ce6523e4ca746
SHA512 bb4786abf6d6844eef3c488a0ead8b9c05f2f6dccaa0638856a450828e0064630cca4e0414a7afbd2dc6c3ac4be511392ee4186d1efd3a5a78c200dd5840168f
SSDEEP 192:sxZaRCZZ/fEs0UOymQoftIdpdgHW6+WNGY3Rt+XIg4J:sxZa8Z/fEslHNeHbGSyc
TLSH
T1FA22B816AE28A97B8CC7E21DBA257F03E6F9503291941E58BAFCD61C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dd4d22f774f99fc15009a51cb2455e93e6c09bce418d37ecf24bfe9fb0ccb9e1
MD5 2badb5afb882ba675287ac87cdf1e9a1
SHA1 256ca4a4a8329d65ed42b5a7a2c51fe2889215ce
SHA512 87aba2e93c5fc8d2273bace21635708652dd4a48bfd8eb5f030e54fe237dce5c917d110d08ed5df4a7b945a926a5264199c4cf8a395a554332fca24262fdcf07
SSDEEP 192:sxZaRCZZ/fEsO1OymQoftIdpdgHW6+WNGY3Nt+XIg5/lJ:sxZa8Z/fEsiHNeHbGQy5
TLSH
T1B622B716AE28697B8CC7E21DBA257F03E6F9503291951E48BAFCD61C05E7ACD130781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7bf6c771267b9377d4772ff00cbe3971fd83e86d3474c4e3d4219e02bc1601f7
MD5 35c1344d51bedebbfbe78345a491d72d
SHA1 62075cbb72cb11701b0874650c5945f4cbc8e578
SHA512 9a29f1639b350648ec152a8648e12fe73d8a72efc1bf6517b74724c7fb4076489f080ecad24a4cab5c4e8356119a2382c3a8dc23d40e6df42b2e477e70a38a5d
SSDEEP 192:sxZaRCZZ/fEsOUOymQoftIdpdgHW6+WNGY3Rt+XIg5/7J:sxZa8Z/fEsbHNeHbGSyj
TLSH
T1B022B716AE28A97B8CC7D21DBA25BF03E6F9503291941E58BAFC961C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e265be8e658a72f0bd3568ef57d55af20f7727f8e0db8b50217b8e87bed6c41b
MD5 6988302861428046126c897f629debde
SHA1 4859543964af30138cf11aad0bfd95ce30d77857
SHA512 2350474c513a6e5cf7118477bb1e707343acc5398e74cf28426f804fa5d9c28f3695ac4b57616d1b573b230ce07d3dd1506ce54e61b8904b0d98e232d6b374fc
SSDEEP 768:ft30AvZ7pLuLMWSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVqAqmLlLJ72cron:ft30AvvEMWSWvS2l9u1jaPAqmLZ12Hn
TLSH
T143E2FC3B780CCA7E4FC04A9CDC2A7F9E6EAC02CB5698898447F9945C02C76EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f89e5a505a488f648b020f38b76e66df4a2406e3d17e25651a21946f03b7cd7d
MD5 679060e093c1a20daba8a347350a97d8
SHA1 b2f60f66901c505b1d78321a70bb94d83d16d99c
SHA512 7c04e6b4014775fbd81535d46731d396599e9df55b6c9b6c845f49e1b174299a1fc3ea639ea456606b8427125653b52e070403b9e208829e9a64767b060c31e0
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLWRsQO00tbYvAISotK9M1OtxG9Yn4EV:KwhyKSQSmdiK2oBAQKpOyI
TLSH
T15791182030BF520079BD398D86A49B5D118131B33565F62BBBBD00B6DE2EE091CFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 96d81ab76f8a3fac989fc91f76dabec9c0a8261f6f38e79c7b2533651a010421
MD5 aa643f709843ec3f50d1f3dfbb3ec12d
SHA1 d246a57c0585111f8d12c2e37f1843fc57670edc
SHA512 9b807b00dfb107c13b66ad2a487db20523d3c744981fa10707bc7e74b0dda47aa76404d1a1f1e889ff83e02d484990b1c4ac5339fcf86b262caf5fb1ce43b720
SSDEEP 384:nSZcI6sNIUFZ8puVOn9iX5FA+eMSG7O6R2Feo6Go0:g648H9aE+SG7TROH
TLSH
T17A828F716878AC3A59EAE116F4473A539FF860B7DAC85F48D5DC9B2D04C7A84270BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e6d62871e7ea5d91e9152639a562b4730a759d94a432cae8ba9bbdb53e5f2422
MD5 9a1b174c00aa99d02c929fe3c50b1e18
SHA1 abf7427dc52e008101fea8bbcdc6b62accc45dc2
SHA512 2bd0d18b7256377a62d737c9880c1c3c3f71df8de9693183622c2694c50a153cad6ae39957beef522c697b1bbcb039227794c25e1d0ec03fa01fa1b25f71657f
SSDEEP 192:LONe6AmwprQmiUy7F6siX5FvY+9JiVXU6:LONe6ipd66siX5FA+qlU6
TLSH
T1D302FA35AD686C7B8DF2AE05B54B3A239FA9117BD6942F84D9E81B1C01D768C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 104bd04cdf6ab701e0d20286ddf6163ec7ec1fa676e298b3886370fa7092517b
MD5 90363e370018dad059a3ff226d6f49d9
SHA1 dab47c72f4b2a352c3d9dd0f46ab3f3ae02281a6
SHA512 abf634da7a05f737e57e7c073c68cd0ab107ff075b30751fbb2c274f53c89bf0fe9c4f0addf1ae6d3561ac1374a4b1f3e01dbc4398c1ff02eaa32b261c75ec9c
SSDEEP 192:LONa6AmwpqQmiUyRFVsiX5FvY+eM/lRR/W+wU6:LONa6ipmOVsiX5FA+eMTGU6
TLSH
T176123B35B878AC3B4DD2A515F08736639FA821B7DE845F98D5E81B1C05D7A882B0F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 787adaa3d93fa49246cc92de7b34e828369e9921fc4d33ca39299c06721999ac
MD5 0fc836d9ada04f4816364ec83c1965c3
SHA1 91fe42df1c18f00556f9543836c1bce55b1897a3
SHA512 ad253709955cb4bb5e7fb3ae79c300fba15a656a1c40dcd4e1be2cea37f173d288dcefea3de0af6288c56e7b85d787bbfe40c61684f4ab4039db9ea674cabae4
SSDEEP 384:nEZcI6sNIU4Z8putOn9iX5FA+eMSG7O6R2Feo6Go0:i6F839aE+SG7TROH
TLSH
T160828F716878AC3A59EAD115F4473A539FF860B7DAC85F48D4DC9B2D04C7A94170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d0647e2-bac3-4b5f-a360-685c156175bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d0647e2-bac3-4b5f-a360-685c156175bf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 997a02c64fa1e4324d654c1ad6e15a3acfc1b890cd64e1db725aed68b4af3df4
MD5 93c89b4a3595076014190ac326a10be3
SHA1 6a31433cd16cca1b3ba3a594dc37fa24f703374f
SHA512 51b4e2117b585ede9575112011879cc5508a0ef5bf7d4d08c1274dc2247cd823b3e27ddd6f559d410dcfb3da4293bb52b5db44426f0e877935f01d23dec813ec
TLSH
T141412D5CB6FA1148B3B76E5A9BF6686D487FB9332F07919D10110E4F4662A40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 730fa64bd1a81ce624fe91a102386587edba33f3ed084d99122cdcd593236ca2
MD5 10701d453fdb0ab2d5802b3efdefe231
SHA1 bef3d495846f1c9b83069558f4827a7b84951316
SHA512 73bbc22042877c406a7210d17e886f57e4a73a59aeed2b6887b0563e3a6fba258437095bb3a3652f501c408290380dcadb481a624725f06b91a9a26b295c9636
TLSH
T1CC515C68A6FA1115B3B3BF599FF6686E887F79732F07945D10110E8F0A22B00D9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d7a7c7ccdc6e05427ad6d2111591834c6f1c92215096db49fa5a22fb0f8ecf03
MD5 8422c2a63f98f4989c71befcf86ead0f
SHA1 d5f0a17f1613a652b881b2b2c7adae082b3d3f8a
SHA512 023b01d3f5ae1aa3d48f4d7c8d02e8902b54ee20c15319ff1187a640c7b9139454a06f3fa93f882218079ed1419235ec2fc004a972190f2a02cd05f8555356d4
TLSH
T12D412658BAE92148B3776E5A9BF7A86E887F79672F06949E00110E4F0622A40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

email.mht

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\email.mht
Size 81KB
SHA256 e3fe6f7dc61675f8b567135d3040a8711437571679c5f19acd1313f5616dbd1c
MD5 62914e837eae1393e0eeefea3140c0fe
SHA1 961abff9dc6b8e35614b097dce11d1de8a07c51c
SHA512 9b740a6c7c996def075f4b02c3f41828abd2667285edb32687c46cfe0b133d17b895b2d6cb2752078dd6e9040dc729547e9a74dace50a7b1d585b213bb48b609
SSDEEP 1536:ktyXHyMSYp2fYlbVgz+zisT77rxjiCQhjhrRdYh8bTdv:oyXHyMSYp2fKT7ncCQ3bYmbhv
TLSH
T16083271AE3D031D580AFC380B89277788A3A5D5997A26EFE245A377C9B0DCC71356B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phish_alert_sp2_2.0.0.0.eml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\58KK6UKT\phish_alert_sp2_2.0.0.0.eml
Size 95KB
SHA256 c8628ee5bff4dccc1b99553cd87632a55354c5327ba4f6b025acd19c040877a2
MD5 0a8f1df1ffd05e4e4985de47ddbc9ef9
SHA1 d8c806984d5c3ca4efd56c3f187060e85c0336ca
SHA512 4db454a1fca0abd91163c907ce6957587268553d8d883b18cf06ab193cd1081eb536614e82a8031bfe05a52dd7200055719fd79e9c8fca938db70c8dda1674df
SSDEEP 1536:rB0LWa21XJJ/B9ndQ85IKZzxtzHoJMUWiJnOFqTVP:d1FJ/B1z7UMUWInOgTl
TLSH
T1A6A35A16E3C0359A80AFC380B86277B8563A5D69A7A26DFD641B3B7C970DCC31756B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaa38929-8af0-4228-9f8b-06d9dfc2624d.tmp

Path C:\Users\Admin\AppData\Local\Temp\aaa38929-8af0-4228-9f8b-06d9dfc2624d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b55c8217-e8fb-4bd0-8526-deb38c9f5f55.tmp

Path C:\Users\Admin\AppData\Local\Temp\b55c8217-e8fb-4bd0-8526-deb38c9f5f55.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbe829f0-b6f3-46f7-b9d0-9fa6773834cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4932_1072049\bbe829f0-b6f3-46f7-b9d0-9fa6773834cd.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4932_2114156222\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/2024-108-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/2024-107-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/2024-109-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/2024-106-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/3488-11-0x00007FF98A6B0000-0x00007FF98A6C0000-memory.dmp

Download

memory/3488-0-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/3488-13-0x00007FF9CCF90000-0x00007FF9CD185000-memory.dmp

Download

memory/3488-10-0x00007FF98A6B0000-0x00007FF98A6C0000-memory.dmp

Download

memory/3488-8-0x00007FF9CCF90000-0x00007FF9CD185000-memory.dmp

Download

memory/3488-9-0x00007FF9CCF90000-0x00007FF9CD185000-memory.dmp

Download

memory/3488-7-0x00007FF9CCF90000-0x00007FF9CD185000-memory.dmp

Download

memory/3488-1-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/3488-3-0x00007FF9CD02D000-0x00007FF9CD02E000-memory.dmp

Download

memory/3488-6-0x00007FF9CCF90000-0x00007FF9CD185000-memory.dmp

Download

memory/3488-5-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/3488-4-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download

memory/3488-2-0x00007FF98D010000-0x00007FF98D020000-memory.dmp

Download