d6681eabadd815a5629041ddb5fc3df05f0f4c75b14199e1310524c725350345

Analysis

user interaction
yes
max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83a9dab4-e9ad-38b2-f842-dfa59c5dbeca.eml
Size 20KB
Sample260930-b665kasyaz
SHA256 d6681eabadd815a5629041ddb5fc3df05f0f4c75b14199e1310524c725350345
MD5 4893a1f100da9dca64ce57ef2ee7e7f2
SHA1 008b790706d6ca62f433088f77305aeb2f64d8b2
SHA512 bbaa66ab016e69b28c340887a91c402d764f2932a80a23f56a06bab0e94f64d22f9eca04faf748e0087a23f0c5771ac6c953d38b2061741c6bdbd7a2a69669ea
SSDEEP 384:xQVA92e/3XGNlVx6RhoeDXR0E28JZ57TkhglAdKqDnSJNGy1khbqnN7:B92omNv0R8E28
TLSH
T1C892D600EB510022D577115EA8223A99EB76FC37D36748B0387FA17B4FFE0762A61D89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	28	[email protected]	764	msedge.exe	1

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1202433484\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1202433484\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_546058076\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_546058076\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_2036026795\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_2036026795\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1202433484\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1202433484\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{DC65D069-78F3-4060-9839-60916BBC5E43}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
4032	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5312	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE
5312	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 4032	5312	OUTLOOK.EXE	81
PID 4032 wrote to memory of 5896	4032	msedge.exe	82
PID 4032 wrote to memory of 764	4032	msedge.exe	83
PID 4032 wrote to memory of 2856	4032	msedge.exe	84
PID 4032 wrote to memory of 2856	4032	msedge.exe	84
PID 4032 wrote to memory of 2856	4032	msedge.exe	84
PID 4032 wrote to memory of 408	4032	msedge.exe	86
PID 4032 wrote to memory of 408	4032	msedge.exe	86
PID 4032 wrote to memory of 2060	4032	msedge.exe	87
PID 4032 wrote to memory of 2060	4032	msedge.exe	87
PID 4032 wrote to memory of 2060	4032	msedge.exe	87
PID 4032 wrote to memory of 1544	4032	msedge.exe	88
PID 4032 wrote to memory of 1544	4032	msedge.exe	88
PID 4032 wrote to memory of 1544	4032	msedge.exe	88
PID 4032 wrote to memory of 5384	4032	msedge.exe	89
PID 4032 wrote to memory of 5384	4032	msedge.exe	89
PID 4032 wrote to memory of 5384	4032	msedge.exe	89
PID 4032 wrote to memory of 420	4032	msedge.exe	90
PID 4032 wrote to memory of 1552	4032	msedge.exe	91
PID 4032 wrote to memory of 1196	4032	msedge.exe	92
PID 4032 wrote to memory of 4100	4032	msedge.exe	93
PID 4032 wrote to memory of 4100	4032	msedge.exe	93
PID 4032 wrote to memory of 3444	4032	msedge.exe	95
PID 4032 wrote to memory of 3444	4032	msedge.exe	95
PID 4032 wrote to memory of 5100	4032	msedge.exe	94
PID 4032 wrote to memory of 5100	4032	msedge.exe	94
PID 4032 wrote to memory of 5792	4032	msedge.exe	97
PID 4032 wrote to memory of 2484	4032	msedge.exe	99
PID 5792 wrote to memory of 2720	5792	msedge.exe	100
PID 4032 wrote to memory of 5412	4032	msedge.exe	104
PID 4032 wrote to memory of 5412	4032	msedge.exe	104
PID 4032 wrote to memory of 2184	4032	msedge.exe	105
PID 4032 wrote to memory of 2184	4032	msedge.exe	105
PID 4032 wrote to memory of 2892	4032	msedge.exe	106
PID 4032 wrote to memory of 4864	4032	msedge.exe	107
PID 4032 wrote to memory of 4864	4032	msedge.exe	107
PID 4032 wrote to memory of 4804	4032	msedge.exe	108
PID 4032 wrote to memory of 4804	4032	msedge.exe	108

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\83a9dab4-e9ad-38b2-f842-dfa59c5dbeca.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://byprosolutions.com/payment/eportal/?email=ZGFuYS53YXJlQGhhcnBlcmJyby5jb20=
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2b8,0x7ff87238c188,0x7ff87238c194,0x7ff87238c1a0
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10089958513876610942,4401394575392528281,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - A potential corporate email address has been identified in the URL
    - System Time Discovery
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,17867211199197714998,5150598101946257834,262144 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,10017093356110088978,10976245247227142421,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6873525862716192295,17489039379339999770,2097152 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,870596364917459907,6881286631831708394,2097152 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4944,i,12023889958928228605,7016700119116917245,2097152 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2797951490680793010,3565646332211912651,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,17273159306695453636,8167544657253279068,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,16478129531491129703,463621735212814097,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,5202868691844450454,2302337522296132633,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,9518124409594246720,12206319122837528221,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,15159765278996558949,12818408286232982924,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,15725468889342704082,12206772105619964797,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,18371285842075913319,7136167610464073703,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,18371285842075913319,7136167610464073703,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,16071172492747270106,10189332620489570519,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,15315337298261776354,5591191899965694927,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6348,i,7176259200091818684,3764608750101060824,262144 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,15691919613149471196,1025975380806507944,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,4105531238803665738,17534808684051095583,524288 --field-trial-handle=2160,i,9684411921724175811,17974151765132274298,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ede9d7e-a895-46df-b36b-85baa344ba86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ede9d7e-a895-46df-b36b-85baa344ba86.tmp
Size 25KB
SHA256 32d7144e27449b44717fe672585cee60aaae621f4760d916f0430005ac94d35b
MD5 26db8f6753c10a5057a659d31dcb1019
SHA1 66b4a144d574e015c5b67cc45b284e6d13f3900b
SHA512 62a06c32b08eaf88957dc98ca15fe68d1159697119fc04a10cd55098813ac9555ce7a5a2e3ceab85bd1c7e56261dd1fcf4283a4258fe2848a7e1a7d33acd19a0
SSDEEP 384:nFiFZ3yFaeO8j38Nm8TUNTUlIxBCC7JF0cxzyfoBj+TFNXbspLTQpMyP6qBLIgLx:MFZ3Izhj3BwgCCj0WdB6LspwpMyCMR
TLSH
T16EC26B35ECA4D9BBECEB4ED6AB0A7A03EEE01157D49C5AC4D5D94D2E00870DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cbcffac2e7458a5e1ced966e5d0329f07bd0b7dbe08f010058a985bf43149639
MD5 952d3863cb787cc48d4552e913c60f8f
SHA1 060bef557a916546866801200e493120f842193f
SHA512 72cbd1d69a298826fab88eef5e9acc32c16f0b67f69c8a9889b2fb4b4661788bb2a34689c3337726174a3e5aa837fde1b1e928ab64d935b9ce4e100f59a5e9ac
TLSH
T117D02B64BF564280C7541073406686947B079185E1538201A59D84033DC00000442649
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a6aa29f9533823871b35469a60a6284de772364fc4e5ec821ebd924d0a0fe891
MD5 90e34a3f88d4c0dc76476c13d84070f6
SHA1 d849664e57ea5eff8c2f1a27ec410c6a399d9dc1
SHA512 62e70432c14dbbe80e7876827d1ad074f91307348b4a8765447fcb9ff6511579c99156a566bc04ef2d9852bb0faf277d43829668599713e6972655d452b9947f
TLSH
T113D02B68BB5A4280C7681073402686947A079585E1538201A55D84033D800000042649
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 55d40e6440921fe7db923ef944f992b94fa117ce074a9b2610f9ef638705bea9
MD5 ccdb81858a32b540891d6ae53126afef
SHA1 d29b6e0785beeab7c5d63eb32561046f4dd05888
SHA512 718254d3c81b5ce0556fbbc60dec13a1ac3a682496fdabe8631d381b4bb1b2fc132a2ce72e6a9b8d33805164f48ebb4236d2f27e73aab8cb87af51d013f1c9fc
TLSH
T126F0F4A9D831FC7B18FD1B2D20940B4AEB5013672B90985B3B3D811C8FB163B8685D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 820151fbf7b89561ff97bff04de99f44266f34461f99663ed2b98ebe9dd942d1
MD5 10f86b0b1446959743ed6c15bcc2654f
SHA1 8bf61287e17dfe5956a097afa18b4b5179caf853
SHA512 95ccb79f0fa5d5ea1c0ee212de1aae5218fbc8011757c12ca05264b80dd075954d29728e2f1e979a42eb107fb2bd60b8a696d22f8fece20978ca532cafe19a91
TLSH
T15371D77986C26CA0DF71583D9DE118C63E34E5D0B1C32F0E9098E9B9BCC2BAD6247274
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c84c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c84c.TMP
Size 3KB
SHA256 41c86c5eba0898e33bc22c869999074dc24400bb366adada7059eb6db077cec8
MD5 89d28865bd45f4b2906cd30dbbb478b2
SHA1 f59d048bad1ce0e4dbf97d11bef9cdec370245a8
SHA512 56d49cb99023da0fa7d53a39717f257599bb28d9098a1746f394c3d16aa37b2ef0c88cdc5ae8915cdd1b80c1dba9893a75c27d5db0a8a08ebfcbff4c8c6887ae
TLSH
T1E1610AB986C28CA0EBB155359DE520833E34D6E1B5C36F1E90D4DAF8BCC6B2D6247050
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

43655918-ef88-4b55-a595-9d1450ef3fb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43655918-ef88-4b55-a595-9d1450ef3fb1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 869f94c499e0bc8b16d5c03fe3886202fe84242190574ba88c196ddfb6f087d6
MD5 9cbe74399407f5d9c0727478212da28d
SHA1 7fcc9988feee77f7ed5145341868a7c18d64db8c
SHA512 ac32623f21241efd73384f9a5c5b728238442c9f4a313c9b0a50d3875ef2d0818c507c06b65836b9b6e47bc09f7f4ab2bd9680a29f4e544ba19b71277d0dbea9
SSDEEP 96:D1KO1XT5uvaXzBrVFtV8xQt4B3IAk4xwUg+:D151XluvaX1rVFtV8xQtcYAkS5g+
TLSH
T16291BAF7C7F8876ED94192F0EA146E1BDF2D0525432C3C4A85E89E1BA3E2470E151A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ecd3e70c952b5b056e62f1923fa9cb1bcc98e44bf298c20ac7952357e798a8c2
MD5 01d7e095dfde04cc01a6f30608cd6e1d
SHA1 36744482b1dae7674725d2d1f956f15c320327e3
SHA512 cb888bdb5816903375d0a1f22b7600d13769d0f7f073e67860ca04f1afe9ec9985545b3a5790359e651ccb307609174b0521c4e53f429b4a846ec7257a641b3f
SSDEEP 192:sxZwRYc//fss0I1ZqMqO+/IhzodpXQ/W6+WNE9S/eoDbd0gqtzuREdIgjYWJ:sxZwp//fssR7q++/Pg/bb/eXfx4WjD
TLSH
T19A52D956AD38A97B9CC7D619BA55BF53E7F9103250D01E88A6FCCA2C10E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eb50fdfa7493120ccdd51c762524d43a9e962fb6d20534f6a7bea5b5b37992f6
MD5 879790e8b89c41cc353b55722aa905f7
SHA1 406ad539049752f263827249c0088795a507e7df
SHA512 9bf14c457296142ee26047a14915aa69a025cf6e6850afaa54dffa2cf5e4039e0405fa3d5fbb9bdfbabf0ec412679dcfc5cca975a160a11a2a2f09d84025c0f7
SSDEEP 192:sxZwRYc//fssZI1ZqMqO+/IhzodpXQ/W6+WNE9S/eoDbd0gqtzuREdIg5CYWJ:sxZwp//fssO7q++/Pg/bb/eXfx4WkD
TLSH
T11B52D846AD38A97B9CD7D619BA55BF53D7F9103250D01E88A6FCCA2C10E76DE220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e31ee27ad1b807b7476f52407cf5f14fe82b8608d90f97c93dc4b4bf99a5d9c
MD5 bf49c4a74143cd9e82876bf7b72542d0
SHA1 053b644916f3ca6586d7542fbeaa29b599fc239c
SHA512 1fc66f5367a3ee88fe6a207c2bc167382d9ab1995c01248243053cd323d2859730a52e6c8b516e7b77df0c2940a83582e64a6a1cc9d836812283ae5a1dc9c5e5
SSDEEP 192:sxZwRYc//fssOI1ZqMqO+/IhzodpXQ/W6+WNE9S/eoDbd0gqTzuREdIg5CYWJ:sxZwp//fssH7q++/Pg/bb/eXf/4WkD
TLSH
T14652D856AD38A97B9CD7D619BA55BF53D7F9103250D01E88A6FCDA2C00E76DE220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 7bcf8b031d7e549bfdaa895bd9f4b3611e3a888c5a0d274d24e71005d0a15fc6
MD5 c789c38f3aa2a07498f94d8978577ca9
SHA1 076baeb37fbbc03347f79fbe77e6f164dba6b848
SHA512 91dc2b81a02fe9a9dd488a94ecb0285287ca34da6f2f78da5e940dcde04933dcdf28a669d13ec084c54bff00632f9bb0da61c1ffc06b175fe1d748f31c515de2
SSDEEP 768:AvmgC8Ba2P67pLuLbdtWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HHRgLlE:AvmgC8Ba2PSEbdtWRmpbQPLu1jaKHHRH
TLSH
T183F20A7B680CCB7E4FC04E9DDD267F9A6DA802CBAA98C94447F9845C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c75da15548e258770edaa43e2deb9595dfa22c21244eb60c1675e0f8236ecbf4
MD5 6743417b9f0085fd59380391db0dc1f8
SHA1 76ada9896bcb890bece27a8c43087b85a4cfe9bd
SHA512 7217bb3194e2413ebd35a7c7423da80410d9e33e020ecef85f88c9ceb785a4565a57f42263940393bfdab9ecdc53a1ddde7f547fc0b92c28cfdc46991fafea32
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAg8:ohdNdBzXXFPXgRbKvtp0JlznyKzd
TLSH
T108B2585031BA12553CBE390890B59B2F528231B3711CE62B7FFD10A68E6BE485DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2bb060b4202c0f00fdda1c3be0ef6666739c82aa63cde9be635ced23a53d9af1
MD5 2c1d18abe3a09310d401547b2098e31d
SHA1 59aa4f5738d411b9719b168a5e1581ef6da7f373
SHA512 83157b56d488218838e8476ce470c6f4f5a24f26d69f21a093658b1475257b09bfb3b41d24eb13c44d808ccbaa57a89db090958db1d48d5bfccae99cb76539cc
SSDEEP 384:nBiFm3yFaeO8N38Ng8TUNTUlIRqCC79SjxzyfoBj+TFNXbspLp4vBXogL/7Izos:oFm3IzhN3zwgzCUxdB6LspkBXA
TLSH
T143C23975ECA5CDB7ECEA5E95A70A3A83EEE01163D88C5EC8E5D94D1D00831DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5387543733eefb7ef5ed9b6472483af9f026dfb935d14183bbe27dd737e91787
MD5 9cebdea07a71a7e9caef61b9ccff046b
SHA1 1c5cf3eabaef6282ab208b5b9625c982286a45f3
SHA512 9350aefa0fef08a2a4ac37c7fd5784e5995d042402f45be02d691f293fcd637164bc5d6f95f17f94b42053570d233fc4be3807c7a1dd94a8c492e6a7e7437a61
SSDEEP 384:nyiFjZcI038Ng8TUNTUlIRICC79SjxzyfoBj+TFNXbspLp4vBtgOIwZOyGoZgL/u:5F703zwgZCUxdB6LspkBXsiE+
TLSH
T19CC25B35DCA5CEBBECEB8E99B74A7A43DEE01063988C9AD4E5D94D1D00831DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e39ca2c21fcbcf02e3df4bef279dad92cece75655678f616beca9a3db57f2f63
MD5 bbf440c931ea657789f638975472524d
SHA1 980df696ff20ad889c81f74224986e41cb4020a4
SHA512 f367c597d01475665474db1749d8524a90578438ff348eb74afd8834e24d6bbc58ece66e3224033791f1ae3ea83ce706c2c7a3cce7068ded5fbd63aa5fc631b4
SSDEEP 384:n6iFm3yFaeO8N38Ng8TUNTUlIRqCC79SjxzyfoBj+TFNXbspLp4vBXogL/7Izos:xFm3IzhN3zwgzCUxdB6LspkBXA
TLSH
T159C23A71ECA5CDB7ECEA5E95A70A3A83EEE01163D88C5EC8E5D94D1D00831DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.29.1\typosquatting_list.pb
Size 1.4MB
SHA256 ef35f1b1c075ce0dd292baee3f7aaff8f0f0527a849d1112d4a52dd354221fec
MD5 4833779ff2e1a78f96ecf13fdadc44b9
SHA1 a5b98ec675ad8756ca1519c3b90591299f7e17f5
SHA512 38dca6b0a91d9621217668787ad591b54d06e7f47d26446004fa2e5a7d5cad924bb8bbace62614e7cf2e6d5b016d526e7f24834ea20a6de06e7f10153a4ecbbd
SSDEEP 12288:3NH1o/AtTKm9uuIE8WHZhnVniHSYKhDJcyY:MgKm9H8W5hnmSQ
TLSH
T10065B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E45E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 732bbcc387a64116c3d56d5e2776f55d0abb9aa1a59114818169f78d9bad65fa
MD5 4c4b4e9b6b1c6510eaee35636e6208b0
SHA1 47c3814f4d85513066de0fc5bf0c7f0ddb91aefa
SHA512 72ceb9ab884954fbccd1ecb3bbce96ea34aa2f8593c4b4f84424025180da2c5322cf831bde0458d9c974f2e67bffe48a0b2bd5f57e7076fb8776b7f112d722cd
TLSH
T1FA5121E05C795AC1D4FD0E7EB49739FC84E89211F8E4347D6858E958897A62E308083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 38f4af9ba7fb28f7c7755d29d615f9bef27306467a59174b8846239011be2100
MD5 30c3089d16f3319605ef667c7e408c57
SHA1 a38864628867f0da29728e910cab41bc356075b6
SHA512 9a7b1e325b369937f84cf0077c582e7023fbe4d32bd17c493ecedcb7f17e9c4f09495da93de2d8e4b460c15c1b6b28acf292a10c889464b83ca4b790db9d0afc
TLSH
T1BC5130E05C7D5AC1D0FD0E7EA49735FC84EC9211F894347D6858E9588A7AA2E3080C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0c1c1f6793ccd4ca594a81df275c01a7550909df56e1a79768b6b7c54a0162f3
MD5 eb580ed06a82e627307a34a3b4f867dc
SHA1 d0a2f75db7600651db1c36cff2418d7443043bfc
SHA512 55837de3710f576040101eb9139218bdb34368aff588ef61d7371b68886748475d27bf8eda61dc2df83ef19554e1c05200201796c4aeace872d529c3325a85c9
TLSH
T1BC5142E05C795AD1D4FD1EBEB09B38FC84E8D211F8E4747D6858E9584A7A62D308083F
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1202433484\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1202433484\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_2036026795\manifest.json
Size 118B
SHA256 272b7391992a4fe4d1c67d59adf02e7d8c42008c5bc943b8bf812bbfe6774f8f
MD5 0d1129793136a291c7cf24f07dc0152a
SHA1 6b79935e4987489abf3f30e979d25cb6abc0b40b
SHA512 039b3159681b473efd497101ae57c5f36b8d8351b9a3d9e36292504e827d1f70a8da10a0cac03b200e7a2d1aa21da40f402d3a24022a0af06ab6721ad617add6
TLSH
T181B092B00C1AA03B22809760EDA0668283F81219E8025B1A088036482F8827881362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_546058076\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5312-10-0x00007FF89D360000-0x00007FF89D569000-memory.dmp

Download

memory/5312-8-0x00007FF89D360000-0x00007FF89D569000-memory.dmp

Download

memory/5312-7-0x00007FF85D3F0000-0x00007FF85D400000-memory.dmp

Download

memory/5312-3-0x00007FF89D404000-0x00007FF89D405000-memory.dmp

Download

memory/5312-1-0x00007FF85D3F0000-0x00007FF85D400000-memory.dmp

Download

memory/5312-5-0x00007FF89D360000-0x00007FF89D569000-memory.dmp

Download

memory/5312-2-0x00007FF85D3F0000-0x00007FF85D400000-memory.dmp

Download

memory/5312-6-0x00007FF89D360000-0x00007FF89D569000-memory.dmp

Download

memory/5312-9-0x00007FF89D360000-0x00007FF89D569000-memory.dmp

Download

memory/5312-0-0x00007FF85D3F0000-0x00007FF85D400000-memory.dmp

Download

memory/5312-11-0x00007FF85ABF0000-0x00007FF85AC00000-memory.dmp

Download

memory/5312-4-0x00007FF85D3F0000-0x00007FF85D400000-memory.dmp

Download

memory/5312-12-0x00007FF85ABF0000-0x00007FF85AC00000-memory.dmp

Download

memory/5312-98-0x00007FF89D360000-0x00007FF89D569000-memory.dmp

Download