hxxp://t[.]comm[.]bupa[.]com/r/?id=h1201d367,92afd85,6e6e7ff&p1=81614074&p2=153812357

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://t.comm.bupa.com/r/?id=h1201d367,92afd85,6e6e7ff&p1=81614074&p2=153812357
Sample260925-2kbpmsyblh

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
812	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{92A5EBB7-F9B6-49AB-B219-A546C5936810}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5912	msedge.exe
5912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2816	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE
2816	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2200	2960	msedge.exe	87
PID 2960 wrote to memory of 812	2960	msedge.exe	88
PID 2960 wrote to memory of 4088	2960	msedge.exe	89
PID 2960 wrote to memory of 4088	2960	msedge.exe	89
PID 2960 wrote to memory of 4088	2960	msedge.exe	89
PID 2960 wrote to memory of 3576	2960	msedge.exe	90
PID 2960 wrote to memory of 3576	2960	msedge.exe	90
PID 2960 wrote to memory of 3364	2960	msedge.exe	92
PID 2960 wrote to memory of 2680	2960	msedge.exe	93
PID 2960 wrote to memory of 3364	2960	msedge.exe	92
PID 2960 wrote to memory of 3364	2960	msedge.exe	92
PID 2960 wrote to memory of 2680	2960	msedge.exe	93
PID 2960 wrote to memory of 2680	2960	msedge.exe	93
PID 2960 wrote to memory of 3120	2960	msedge.exe	94
PID 2960 wrote to memory of 3120	2960	msedge.exe	94
PID 2960 wrote to memory of 3120	2960	msedge.exe	94
PID 2960 wrote to memory of 2488	2960	msedge.exe	95
PID 2960 wrote to memory of 2488	2960	msedge.exe	95
PID 2960 wrote to memory of 2488	2960	msedge.exe	95
PID 2960 wrote to memory of 3032	2960	msedge.exe	100
PID 2960 wrote to memory of 2592	2960	msedge.exe	99
PID 2960 wrote to memory of 3032	2960	msedge.exe	100
PID 2960 wrote to memory of 2592	2960	msedge.exe	99
PID 2960 wrote to memory of 1964	2960	msedge.exe	101
PID 2960 wrote to memory of 1964	2960	msedge.exe	101
PID 2960 wrote to memory of 2312	2960	msedge.exe	102
PID 2960 wrote to memory of 2312	2960	msedge.exe	102
PID 2960 wrote to memory of 2312	2960	msedge.exe	102
PID 2960 wrote to memory of 4332	2960	msedge.exe	103
PID 2960 wrote to memory of 2176	2960	msedge.exe	105
PID 2960 wrote to memory of 2816	2960	msedge.exe	113
PID 2960 wrote to memory of 5984	2960	msedge.exe	121
PID 2960 wrote to memory of 5992	2960	msedge.exe	122
PID 2960 wrote to memory of 6000	2960	msedge.exe	123
PID 2960 wrote to memory of 5148	2960	msedge.exe	124
PID 2960 wrote to memory of 5148	2960	msedge.exe	124
PID 2960 wrote to memory of 6076	2960	msedge.exe	133
PID 2960 wrote to memory of 6076	2960	msedge.exe	133
PID 2960 wrote to memory of 880	2960	msedge.exe	134
PID 2960 wrote to memory of 880	2960	msedge.exe	134
PID 2960 wrote to memory of 5644	2960	msedge.exe	137
PID 2960 wrote to memory of 5644	2960	msedge.exe	137
PID 2960 wrote to memory of 5912	2960	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.comm.bupa.com/r/?id=h1201d367,92afd85,6e6e7ff&p1=81614074&p2=153812357
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff928dac188,0x7ff928dac194,0x7ff928dac1a0
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,6670075554879075114,15797510556346817047,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,5388380279823417497,14212310688651296683,262144 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,2500669301926059180,10859355929532030224,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4902113065301564072,15877344160585771792,2097152 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13616784907285278310,13628996642731785369,2097152 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,16003726734155972897,7861762186838168845,2097152 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,8967196847874316706,6469897746236020244,2097152 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,2077106343371113594,18355089795270035307,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2188796271351040362,16288962047099655545,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,8984997590797793055,9491568203469375187,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5828,i,16718700193446160198,2308120979766875560,2097152 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,13028048988557852584,5290614904419072961,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,13470156212400126784,13506567001971626361,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,13470156212400126784,13506567001971626361,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /t "C:\Users\Admin\Downloads\bins-25250.oft"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,670733974160547504,4212784222625160600,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,14704333131835112599,17355856351440553606,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,16815706346860198535,6020705961699771814,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,4113614097881284596,5212460693741221079,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,974856158281060752,5176344539505961863,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,8672531883852046053,5406282676011435873,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,10035913811777381833,11250747142796611042,524288 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,15659922102954741169,1185937174657304087,262144 --field-trial-handle=2268,i,2475968805640937496,5732817082934550679,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a1c7b71deb372bdfca96592a54bc6fbc86c5c1e2d594790e482caf9430ca09a9
MD5 d9c79bd725622c65c1f430d2b95d5ef0
SHA1 1e8eae98a31f34308c6811be4e338f0a5404f058
SHA512 a849d48227a1fa243cdcdb41115780b23230da3f4d5be741359d31a9f26959b2c9bc2eea2729c78f15ad5e753e59b02b2373297bc4cabbcbd3b613290e899351
TLSH
T191E026880BCAC36EF3006C8742784B8C82C03B5B93CCBA1A1B0088887286458F6F76A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 377f115b48ee7fdb86dbb6be928359a5fc1ad1bfb909b991fb8b9b169a171844
MD5 3f6a697a71f5ffb4490ad1df5d0f96fe
SHA1 4d5cbb541b9317264bcb0faaf8ac6778043d3d82
SHA512 d1bee941456216e78bc633ebeeeda3f6a18c6e1b8f5b740888504e15585a9e8f0ae0b1930e5761a99d35eef2120b1533dc526f8a1bf68aa854bfbf5b2bd608b1
TLSH
T123E07DED06C8CB2EF300A88B426CC71C82883B2AD3CCBE1A5700CCC47282040B2C7AA1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ae57066740bd50206bcdb6bab40cc40f2b8fd37e304a17416f12bd5e988822d9
MD5 be281090a6a9da8a7f61ef5a297fe3cf
SHA1 b8f3ec6e37711cc97b5f99fa55bf3d7fe028debe
SHA512 eb809fbefee5ca4b00af2a40a59b1fed76209b28c1ef11441dfa4f26ce4ea475ca0fe4b350388b956d240a71cc7263ed0f09394e22036bc509d6dddc8353b03e
TLSH
T16161A4410B135A97FB9835F0DED930ABFD70788061739ED19350EB78860AF855C96290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d4df.TMP
Size 3KB
SHA256 620f13b7608891248c990211cd9999671c3603a713c59458bba2d578e0808d81
MD5 30c679a1f8f8b5dbab8357bf34fbf3a0
SHA1 b51508623a20ae0224f56338ff12ab302d336d32
SHA512 7dbc3d1446a8545a433f95259c8deb9c00be18007ec44b49cad11b5c632409f59a08757ac0ac8d12ac95b3d6e4ff0c4103358a5de2bb27aecfadadf0e270e0bf
TLSH
T16F61A3410B135A97FB9836F0DED930ABFDB0788061739ED29350EF78860AF855C9A290
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36eb4942-cbfe-4e5d-a102-14e7806ecf14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\36eb4942-cbfe-4e5d-a102-14e7806ecf14.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1a2041fe9f9690abb9378732976c68c80f28532494230c98e2fbd696c3620089
MD5 8e70f2af0bdb35fd282c7118e65f61ca
SHA1 38526b7612313b1c4057dad91afbded8a08d351e
SHA512 1996e0aa062ec0d6f9bd755567417519ff558e130fd3e6225267b3977e2928e1a01f48234d15d3b9b7ae7d5419fd20d77f26e6e2eeb4c1f570973e315ae212d2
TLSH
T179217CF783E585AE891156F09B24AE2BCE1D0516831C7C69C9D4EF27D3F3461E001A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 246d00eaa5fd45534c7ceff97fc4d40566615ae717711873f804e80cac54d9c5
MD5 53ca70a14151ab8d21495bb87308a3ef
SHA1 88161559ad66016b0f38bdb5689cf601bdfd7820
SHA512 56d73b7885dbf0bc3e9d0332b140991e70019fdb2778baf8438f6054dec12bed2304f5d442be36438105b52052e86dbf75c586356a1b9cdf19e422d6644a071f
SSDEEP 192:sxZmVRUnt/f5mszySIdpOwMHW6+WNGY3Fy+/ZoIgrJ:sxZost/fMszSsHbGDt9
TLSH
T12522C7166E28657B8CCBD21DBB25BF53E6F9503295D11E58EAFC861C04E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e56b01594dbd6c7e4374f06780d6a9451a9b3ed7ebe9a822f11adf053dc8e0cc
MD5 e6949cf9e424476f6d89abb88d1c39c3
SHA1 cc67aeb7fc2c33689fcc10f9efeb16ffbe19b944
SHA512 a1f230db86b3e2d39b71b946bc94cd004efcd11eb9ad1f09fb846fced9855782ba27d14e4d48f08faf6ab0d268aa1ab9e767e3003d46c4f24293f00f5ad356e7
SSDEEP 192:sxZmVRUnt/f5msxEySIdpAwMHW6+WNGY3Jy+/ZoIg5sJ:sxZost/fMseS6HbGRti
TLSH
T1EC22D7166E28657B8CCBE21DBA25BF53E6F9503251911E48E6FCCB1C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 404c61030a4e784dcb3c518840490b24b906c0a16b61ed4346c325565a89eede
MD5 b001a371836b6c70b90c3a4daba6987c
SHA1 a342b42031a7cf088339e527a2451b04a4c533d7
SHA512 ca2218ee72ba6815395a51fe868e44d5786698ca657d33d008c4ec28c9695dbed5e15a25f06a25a7f1303551558b0d5047ed363b6484e8aea65beb743425be60
SSDEEP 192:sxZmVRUnt/f5msxEySIdpOwMHW6+WNGY3Oy+/ZoIg5sJ:sxZost/fMseSsHbGCti
TLSH
T17F22C6166E28657B8CCBE21DBA25BF53E6F9503251911E58E6FCC71C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 56e718a12d570112bb61f11562235ab77f0be2ebe710322595c1ec82b4afe73d
MD5 db6ce75a5d2d46ed74deeb7b8cf103d6
SHA1 1c1cc9dbdcdc562841b844a11e6036a6c25a47f1
SHA512 f6bb343ccb39bb8bd0e2a9e673eac50a1708b630012db56b4917b77296eed92a511112e836e48908d5e3b1f52b6aa6f411169f97ceaa1525da046fb8289b8471
SSDEEP 192:sxZmVRUnt/f5msxOySIdpOwMHW6+WNGY3uy+/ZoIg5GJ:sxZost/fMssSsHbG4t4
TLSH
T19122D7166E28657B8CCBD21DBB25BF53E6F9403261D11E58EAFC861C04E7ADD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6ee2c39e42a45d6416d208652a6b06e56088866bd634fcdd0529c6a168ea4f69
MD5 ae89650d864b1668af7110c0cbbce2e4
SHA1 ec14b6e6fce243367139c55af2535c7dac0873cb
SHA512 aa1774771de8f2eb8d273cd6554d905a790a976f851aea94f008f930294fad3d07de6783e866f98ef94dd8cf06981d72b5a989f2b951d3f517afe486db0abaae
SSDEEP 768:g430AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ721rolZMtk:g430AbSWvS2l9u1jaLmLZ12Op
TLSH
T1F5C2EA3B644CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c2db913a99183034d28da13f2d0601edba150a5ea43dcec0000c51cb61d1395b
MD5 f64d7324c92b48e82372483adc8376c3
SHA1 004439b9e9d943ea036922c77a1c5a33541e4a01
SHA512 0c3094be29464cd78daec92d988ad117159875b91dbcb666c445846e58f4a2e26e300af330e61c58622cc941d951f8f248c89f993ca90eb43b75167f3b6050d1
SSDEEP 96:KVFsXTtDnr0XmaarrKiSahr2FdOPnYfnSx9nBhx0dksaVxKi4aHx2/X8VwaUKPK3:GH7SDK
TLSH
T1FB91F41133BB12503DBE354980A1962F464132B77018FA2BBFAD55628F6BE584CFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11da8940-ff23-4942-b282-52ebbddb1667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\11da8940-ff23-4942-b282-52ebbddb1667.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 689f4cd8f6f6e9b5df750ead5b915cf1b27b4d45747a22e6a6a83474d06056b9
MD5 ae93fe0a45eee403f4fd679624602fbb
SHA1 2554ba0f506f9c819e5405b9dc31a102b5cb604f
SHA512 b07a72a28e93ea50c05b5be2464cda8e99d980abe103587dd0bf5bc20e2a07387a9ab624369b5dd08b1a4597e74a23e2a8dc76cbfc8475b0e5e9820d833518a4
SSDEEP 384:LZcIXsNfU37fXpulpUS9iX5F1VNatgOIwZOyxLuod:TXLkUWaxaXsSKe
TLSH
T17F828D3668789C7B5CF6E154F44A36035FB89467E7C96F84C9FD672E01EA298030BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9880669dedc6659c3bc3070d48f42cca52da8daf5b922f84614e8fab843863f9
MD5 3811a3c73c84a15fde32ca4030b3bd72
SHA1 85d125730efc2712f039a381d25f03c7a665f5c1
SHA512 eb5533cd61ddd13a277cc91da72481d51ba58415d100a8958707ac16a1e7fae3d736e725c9736aa74f777b0f0bf3fa6fcca0c11a4add398d00d0002ec2423566
SSDEEP 384:YZcI4sNfUj7fXpuepUS9iX5F1VNatgOIwZOyxLuod:m4fzUWaxaXsSKe
TLSH
T179827D3668789C7B5CF6E154F44A36035FB85467E7C96F84C9FD672E01DA298030BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 19083b7e7e22a4cdc1097343626d1928889cf1c079e8f4c72c966e01a34a0320
MD5 bb989a38c1a3e3719f8b05684ccfe4a4
SHA1 12bcb4dc1f6a1d3f35e4ecac61a43e02a1f1a60d
SHA512 8f550497afbaf9699fb259f978294e95fac59c28667d5e29aeff9bb05ad4448eb89393cd60d468786f080d68546468d5b33ed834dd2ba3ef1f91decec0d01ee0
SSDEEP 384:2RiFbZcIW+sNU8TUNTUlIlG7fXpuepUS9iX5F1VeatgOIwZOyxLuod:24FDPJwgGzUWa6aXsSKe
TLSH
T134A27C3758A8DC7F6DFA9A54F54A32038FB450B7DA95AE90D6EC5B2E01D71C8030BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80457ef2fbf4bb7d860b5c6cf8dc76521ee5c4076872e0403f2962a33333eb70
MD5 59c2fc46df5884071328e4c3281ffe70
SHA1 3d88ca333c771d21d97d7cee96243b2d6c6dfc93
SHA512 b662f2135c77d56c45d7be9ba22cf163c0da87bd88230639fe277fdc41a3da56fea5aa36217025dc0cb8cfddfd828f358823b2f6c5332d766184b2096455565b
SSDEEP 96:gqONkGQsjpfuMVwptaL5ih/cIPURHl8h4otop5xiCDzBIPuva6zx8X5Fxux++YvI:LONS6AmwprQmiUyzt6siX5FNHkJi1YU6
TLSH
T18B02EA35BD686C7B8DF3AE58F44737239FA5116BEA942F84CAE81B2D01D764C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6bf8ebf1b2baad2a98dbe6332b00cdc7df8b4d24b5fe4d523a1ef03a637da36e
MD5 adca1f12f36dbb75c844d0d3724430a0
SHA1 61b8179f5e97add40539bfbdd26fe1fcda6f020a
SHA512 365198e2ce6e90bc011f7bf3977087d6daa45d1d78bf5fa9d331876d6df7dc86f5246e0e0baa9ccdff3621c57a6d788ff0d2f1ade06bdbf5de0f99ccb35abbba
SSDEEP 384:KZcI4sNfUG7fXpuepUS9iX5F1VNatgOIwZOyxLuod:o40zUWaxaXsSKe
TLSH
T11B827D3668B89C7B5CFAE154F04A36035FB85467E7C96F84C9FD672E01DA298030BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d75c16a1f2b54fcac68c7eca71e10f4c7705288e96072e3a4b37d1911971763
MD5 17278264d33f87d3c51e53824f24bda9
SHA1 ef474de1697a8e84fbf755301472fe71a2c4e65b
SHA512 4769c8dabb48195626d7f5e81a6aab018481c960a1f528158050edb60de4c1f61c0b5bde745edb3d745b1dd9da2af349ab943a63ae3e03ccc1018eaff8ecbd36
SSDEEP 192:LON16Amwp2QmiUyttOsiX5FNH7Jd6nlRa/hU6:LON16ipSCOsiX5F1VCaU6
TLSH
T1EF121A36B864AC7B4DD2E964F04736139EA55267EB497F84C9EC272D02DF29C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d649389-cd2e-469b-b716-2ea4be7c4bd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d649389-cd2e-469b-b716-2ea4be7c4bd4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c79a793396e19350d311f15bdeba20ea34c050e69858faf7b9599d7003e21d57
MD5 d730bcddc89988d39f99f31376ab37f2
SHA1 999677b6aab1911f784f786b82cea61026639edf
SHA512 3630dec97431344ab46d09f7a380873fb80d53676456315d5077215039b1a5bf5377eefb09c20412296079b7b621206df6ade9752bb415374b795e7b0574967a
TLSH
T105412548A6E91148B7B77E56ABFAA86D447FB8372E46E5AD00050D4F0A73B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 fda10dace9c5b928baaf06150d82ca507e14e391b02f3a7f6017d31c4ff6290c
MD5 8efb08dbf417196ec14ab9213b5ca5a2
SHA1 51b52f451c1bbbdab785f9bac0ac8fa916423b39
SHA512 3e26ff81e47a15f201291f9758f6440640823d020172d62654a4f1e5c8fc37bd46c0a3e009c10a51dc3285ac3af7de8de549cf700c664c1e5b0a7009f07c6a4f
TLSH
T113516D58B9FA1158B3736E569BF6786D487FB9732E06D4AD00010E4E0A63B00CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

bins-25250.oft

Path C:\Users\Admin\Downloads\bins-25250.oft
Size 40KB
SHA256 640fe35a2c91ae47eda5aa3d4a85fc44c74c9e24a2588dfa6c2f0a7c42aa5462
MD5 9caf22f28b6c78b61ada81a64b1331b8
SHA1 dd93a203122b06c0a44da473d68adfc3bda242ea
SHA512 ac0ced8e318687e5c7173ded4c5162c7a6b9ad0833b99de6ebb44906770c90d65013f1ceed3bff43f73ce8150bd4bde53515d6afeeb4abf4d2cb574910c85e42
SSDEEP 768:g01GTb3B+iLYOc8+Yy4fCz0XH0NMuy4a0:goGTb3kYYOc8hwi0
TLSH
T1B113C71136E94605F2BB9FBA5DF685C389297CD6ED20CA8F3351738F0931A419870B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2816-277-0x000002167B730000-0x000002167BA00000-memory.dmp

Download

memory/2816-166-0x00007FF904D90000-0x00007FF904DA0000-memory.dmp

Download

memory/2816-167-0x00007FF903750000-0x00007FF903760000-memory.dmp

Download

memory/2816-333-0x000002167B730000-0x000002167BA00000-memory.dmp

Download

memory/2816-165-0x00007FF904D90000-0x00007FF904DA0000-memory.dmp

Download

memory/2816-162-0x00007FF904D90000-0x00007FF904DA0000-memory.dmp

Download

memory/2816-354-0x000002167B730000-0x000002167BA00000-memory.dmp

Download

memory/2816-163-0x00007FF904D90000-0x00007FF904DA0000-memory.dmp

Download

memory/2816-164-0x00007FF904D90000-0x00007FF904DA0000-memory.dmp

Download

memory/2816-168-0x00007FF903750000-0x00007FF903760000-memory.dmp

Download

memory/2816-246-0x000002167B730000-0x000002167BA00000-memory.dmp

Download

memory/2816-416-0x000002167B730000-0x000002167BA00000-memory.dmp

Download