c0c12e973e527b189ef7e0241970c9cca7cb4f1d65a97e345dd454abe0018351

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potential Phish (27.1 KB).msg
Size 54KB
Sample261020-rlg8psex7m
SHA256 c0c12e973e527b189ef7e0241970c9cca7cb4f1d65a97e345dd454abe0018351
MD5 d404715224786c3edbee0b391e0ec0a6
SHA1 c09e145c41839cd554353ce896cce82413818433
SHA512 270e3f0d9987c1bec9553f5e2c5ee7084fe3a8be294c26ddf512b80ac126110e158ff95417179821d4b86f3574b7b24a0200ffbcba1f40035c360696e4af797c
SSDEEP 768:/z/ynwGEACdJiRTBhZeajpaDNh69406QtJofGCP6ewJzOUeF0/aMQCMA5J:PG7Cd8RlfJkyXtM
TLSH
T16A4334152AFA0225F2B3AF7559F650A3993A7D52AD35D94E20D0330E06B2E40ED61F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3632	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1500	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE
1500	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 940	1500	OUTLOOK.EXE	93
PID 940 wrote to memory of 4920	940	msedge.exe	94
PID 940 wrote to memory of 1252	940	msedge.exe	95
PID 940 wrote to memory of 3632	940	msedge.exe	96
PID 940 wrote to memory of 1252	940	msedge.exe	95
PID 940 wrote to memory of 1252	940	msedge.exe	95
PID 940 wrote to memory of 4460	940	msedge.exe	97
PID 940 wrote to memory of 4460	940	msedge.exe	97
PID 940 wrote to memory of 2216	940	msedge.exe	98
PID 940 wrote to memory of 3620	940	msedge.exe	99
PID 940 wrote to memory of 2216	940	msedge.exe	98
PID 940 wrote to memory of 2216	940	msedge.exe	98
PID 940 wrote to memory of 3620	940	msedge.exe	99
PID 940 wrote to memory of 3620	940	msedge.exe	99
PID 940 wrote to memory of 4728	940	msedge.exe	101
PID 940 wrote to memory of 4728	940	msedge.exe	101
PID 940 wrote to memory of 4728	940	msedge.exe	101
PID 940 wrote to memory of 1064	940	msedge.exe	102
PID 940 wrote to memory of 1064	940	msedge.exe	102
PID 940 wrote to memory of 1064	940	msedge.exe	102
PID 940 wrote to memory of 856	940	msedge.exe	104
PID 940 wrote to memory of 856	940	msedge.exe	104
PID 940 wrote to memory of 4024	940	msedge.exe	105
PID 940 wrote to memory of 4024	940	msedge.exe	105
PID 940 wrote to memory of 4024	940	msedge.exe	105
PID 940 wrote to memory of 892	940	msedge.exe	106
PID 940 wrote to memory of 892	940	msedge.exe	106
PID 940 wrote to memory of 2176	940	msedge.exe	109
PID 940 wrote to memory of 2176	940	msedge.exe	109
PID 940 wrote to memory of 4752	940	msedge.exe	110
PID 940 wrote to memory of 4752	940	msedge.exe	110
PID 940 wrote to memory of 1092	940	msedge.exe	112
PID 940 wrote to memory of 1092	940	msedge.exe	112

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\Documents\Potential Phish (27.1 KB).msg"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ff9b391c188,0x7ff9b391c194,0x7ff9b391c1a0
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,17809554353286703803,10956054828067645211,262144 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:2
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,2598542285575986340,4894953675807156848,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,12446945938283659401,15360618132970732903,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6866544284360349335,267904660016997343,2097152 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,853439434904132784,12060225596214882713,2097152 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7889250877601764996,55200396940146331,2097152 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,14776395592919827188,16034744604478243716,2097152 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,4031466497254660422,509804494543039445,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5260,i,11011676060525821564,12544829426845911289,2097152 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,16259737901450865139,6345478945123734118,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,11673123154524103325,13349428561664916355,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,15722480195429929015,13114934242575348164,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,13074182806065882158,15714736525810187463,524288 --field-trial-handle=2196,i,12300035574831954504,505425360360775989,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0227fcef-5431-4491-8991-deaf2839ca85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0227fcef-5431-4491-8991-deaf2839ca85.tmp
Size 8KB
SHA256 a3960dfaa4a4548789d1a8d5bd9912dd418fe0f5af044b2a3e51d6b87c13198f
MD5 41d204eebb514dc63e0cdedb44c79329
SHA1 49f76173b1162870a28826962181a312f7de3965
SHA512 572440ddead6e6927ae8984e8cf5708086ce7a5470806674bde2d500144ee16b06372ecaea351a078291ad10a9ac835792d761379991a0335217d9443d048c6b
SSDEEP 192:1ONx6nnHsQmiUyFtOYcX5hQDP1HjzorMoLFX4SJr49g3irq86LU6:1ONx6ncmONX5+Dtv8XLFXPJr4CxLU6
TLSH
T1AA12F930B9A8EC674DD7B545B0C632A39E942077A9856F84E6F85E2C00D6B9C270AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

551361fa-20e3-45b8-8f97-d90c196dbdd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\551361fa-20e3-45b8-8f97-d90c196dbdd4.tmp
Size 16KB
SHA256 235881ade9e646c63e409ae98b2c5aea832ab0567e7086a158b840f8952018b4
MD5 d2cd07716b788812857d4291c29829b4
SHA1 fd8c10cc50a5644bd243e084591ae96f8bd8e8df
SHA512 50e9b5c0a65d6d319bcfd60c857e6c39d71bc6c90352952f36190ab1efe27f53adcf93f71fa37615d942338b51bc0ed062326133f644bae17b4ec1181cf70750
SSDEEP 384:zSFsNIcP8sizGxZQX5+Dtv8XLFXPJr4Pph5AStNk7oikLM3r5:828srxekDuRPh0MSpikLMb5
TLSH
T16B721971E8A4ACE744E6F4C16585F213AEA8203799492F4CD5F8BB3C309F6F81316C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dfac735-bbff-48e6-86ab-337d0a92d727.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7dfac735-bbff-48e6-86ab-337d0a92d727.tmp
Size 8KB
SHA256 1b07f2d1ba01a825638cec8634916ceccf24ee6266d1f9f790851a54443c0d85
MD5 b5b6868f4604cace6a6ac7e5d11ebbb8
SHA1 bade3786fb4d65f15f276a5daf370d77f3b95671
SHA512 e65919ee56d16f71b75b9c7d73cf1f27494bb89365949268c00924292af7c1d4116951980f3b42450420ff7ea24b22bbf87426d714188716887e7e565cf62bee
SSDEEP 192:EONw6nnHGQmiUybtQYcX5hQDP1HjzorMoLCMcGzU6:EONw6nCiQNX5+Dtv8XL6YU6
TLSH
T15C02DB35BCB87C7B8EF36D46B48626139F952167E5952B84DAF81E1C00D769C2306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9d0b119d98287c16c65c2dba7faa5a76a1f5933a072816f37ebc5c3b7aac2463
MD5 3f3d57df631ef5011d39ce9b9a5f2b74
SHA1 407859bf5e1ff7e93b45d642deb5b2e6437a1a3b
SHA512 e5ce0a512e78b02165f04f6882d3221e2474f50ec2181afc5ca1f16b2eab12db41ed470aa9ffcf08c9f7951e3abc4ff1b7ad458b90427c759657a7aba24c1ad1
TLSH
T1AFD02202FE228AE8E0A008BA023880080A88B2830B802280A220280ACC38000A82EEC8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

2074252b-4914-4f1e-91b3-8e516f3c5b05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2074252b-4914-4f1e-91b3-8e516f3c5b05.tmp
Size 10KB
SHA256 881d051316fd684f8701a94e3788a247440c336ff89cf90191d262a0244eaeb3
MD5 a330c133e39e12c5fb1d37a1de512052
SHA1 90c2e0b745021007ba57ab0428177f50f37ceed0
SHA512 9bc88a95aeab7bb20f7926303c21480f795a6b04ecb0c2eaad74b996cc9777f0005430f3b9b20b1d328df58bcf3a65d4f3d6da325b1c98066424cdf08a11e75c
SSDEEP 192:sxZLRLZ1/fFs3WpVqQEdpWIHW6+WNiS4An/B/8wBhNVIgEJ:sxZL71/fFs3WvqXrHbvH/NnpI
TLSH
T1C832B7526E38753B8CC6D21DBB65BF13D2FE5032A1D11E58AAFC862C04E76DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a130328-922f-4bc4-a673-2bd4d0e47650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a130328-922f-4bc4-a673-2bd4d0e47650.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45f31d21-f533-48d8-a90e-4f876bd2d7bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45f31d21-f533-48d8-a90e-4f876bd2d7bc.tmp
Size 27KB
SHA256 f1a018b7096f0bde19aa6c807b3f40c1d5e87d467ddf940f3dacd5392643fdff
MD5 d4b3b44e95a24f79357f9bd875000e5c
SHA1 9b01852619f155883cd1e1f2ce28ff168c8a99c8
SHA512 0e7a035c694268aa240c7af120964444fd7af352232ec1e90ffe1574601e383d3eca2529b32a5dcaa840aee51bce7b3ec387485273ceed5c9daf404d39271380
SSDEEP 768:XEyYRcjWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+CLlGcvXjropu0K:XEyYRcjWv3NRBu1jaBCL8OXQG
TLSH
T18EC2E93B640DCB7E4FC01A9DDC5A6F9B2E9802C7A6548D4047FA994C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 170d8a5ce48c4e819a96920c253ac21e108a35a7c0848bb9f000b96760a49f0d
MD5 91a9d0cefdca776dd67fd40b247056f6
SHA1 5bce44fc7604816618fcd38e90607cad7ce3ce78
SHA512 159b2286ee9590308dc1144131e784330d9776ac3d57cb065b471a4487965984ba527b35c9370004a22ecfec69f8e6e2ac9d000209d7d5a5040848f8f89de0c0
TLSH
T130512301F9D02592FF9749FD888C5D4636308D41FEA28B570296E4ACFE77AF14D10318
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c120d6dc8de27a7084838e8c9f0f3aedad1e59f8958dd1f17af4c4c38ccad57a
MD5 90c077266e43bf0d71e3b021467c2265
SHA1 efe6de4c7b15085922a5252f1f01048fb8b919dc
SHA512 d6e1e9f887f3d1ba184d4d0ce23a04a7e72760c5ce7ebf4765185219a9ffad443d3a4b926fc19c270543ea78e796f921770a72b066408344672b9e82a08cd762
TLSH
T17F414342CA5028A6FF9485BDC9D41E8B3B709D91ADC3CE1703A7C4BDEE76F724604258
MD5 SHA1 SHA512 TLSH

Submit Download

807d6a33-c304-42bd-8ebb-8fb09088e43d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\807d6a33-c304-42bd-8ebb-8fb09088e43d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

2bd6f44b-b80a-49f3-add8-d48326b720aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2bd6f44b-b80a-49f3-add8-d48326b720aa.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e39f7d5c-f3a3-48c9-b61b-d56003bd5e5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e39f7d5c-f3a3-48c9-b61b-d56003bd5e5f.tmp
Size 2KB
SHA256 40cfcfd6f394465353522c8b525ad65421a4fff5d707b20b7336389a7f078679
MD5 592cb61e461280c499fc945e12d84ab6
SHA1 7bf71ee1ffa498522f28657d27d4a131963f74f3
SHA512 3bf69f5930594ded3688680f4517b9ccf5e6970dc1cc19494961597c3e59f92a9d3a2af4fd83e9dbeb11c325d5f787da1f9661a3e1c6d7976c339d58da6120c4
TLSH
T197519BF3C3E4863DE90156F4A6186E1ECE6C1E24432C3C56C8D8AE1F93E2475E14069F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bd4e5586-c614-469e-b660-40decb091567.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd4e5586-c614-469e-b660-40decb091567.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 90bd0dedb53d80d71ae8b9c248474647f1837e0ebba8be4d117754dfd1255b77
MD5 17fbdd50cd7df32ceeaf19fff965b3eb
SHA1 8d2671bdbcdffe3ef4a8aa048005c2380fadedfc
SHA512 9ec892771a81f0e99a4dea6c1712107dfbf4d825d229b752dcf4352b92cfa1807e1171c02463cb12ec3adc04358172a838e23ade4422a77d5ba4491ca7120486
TLSH
T142416C58AAFA1108B3B77E5AAFF2A86D447FB8772E06D45E10110D4F4522B40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 687324f25489359ba06583bb4c7547a7f343b9cae1976c2f065490448ae39dc1
MD5 cb8d1d745a92c1a7b2ba733f400845c1
SHA1 2a522277daf80993a291356e4067496ff312a477
SHA512 9a9ff426153686647f94cfa05253aa9ed3c98b4081b996a65860649ae362c96604ee97834926ef1c02cc0ec8115f61f937c7179cdcee76980cb42d19451e577c
TLSH
T12D41E79CB6F91148B3B36E5AAFF6A86E887FB8772E06D45E10110D4F0622F40D961737
MD5 SHA1 SHA512 TLSH

Submit Download

f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres
Size 4KB
SHA256 b14b8720bebe60b8f8f27682aa1e0e165db81a3872cce5192d9a3746e8b045a4
MD5 d2f7d62622d361aaa5a57363838dc524
SHA1 2a1a14ce1e611940488ae63da85f45793d912ea2
SHA512 d6bdadd7104888906d7dda2e7bee6dd2515bfcae35196b0e94949d6668d8c8fca372b7d317475c5ab05b712aefa29d0c235237d2b122ceefa44fae987c91b4b6
SSDEEP 96:KYLfl06+tJS+iQ7ErGBb8WHVUIP6QbuBLbuWDJTc7Fpvnht41E:Kefi6v+CrUgW1Z6ucLnJQJt41E
TLSH
T137919E287AFA5158B3B7AF565FF1B46E987FBA333A0A905D10410F4F4622E40CD6173A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1500-126-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-1-0x00007FF9A0070000-0x00007FF9A0080000-memory.dmp

Download

memory/1500-12-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-15-0x00007FF99DB80000-0x00007FF99DB90000-memory.dmp

Download

memory/1500-14-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-13-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-11-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-10-0x00007FF99DB80000-0x00007FF99DB90000-memory.dmp

Download

memory/1500-9-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-8-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-7-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-4-0x00007FF9A0070000-0x00007FF9A0080000-memory.dmp

Download

memory/1500-6-0x00007FF9DFFF0000-0x00007FF9E01E5000-memory.dmp

Download

memory/1500-5-0x00007FF9A0070000-0x00007FF9A0080000-memory.dmp

Download

memory/1500-3-0x00007FF9E008D000-0x00007FF9E008E000-memory.dmp

Download

memory/1500-2-0x00007FF9A0070000-0x00007FF9A0080000-memory.dmp

Download

memory/1500-0-0x00007FF9A0070000-0x00007FF9A0080000-memory.dmp

Download