hxxps://acrobat[.]adobe[.]com/id/urn[:]aaid[:]sc[:]AP[:]d524d89b-1811-4bd7-9842-e082d640a598

Analysis

user interaction
yes
max time kernel
100s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://acrobat.adobe.com/id/urn:aaid:sc:AP:d524d89b-1811-4bd7-9842-e082d640a598
Sample260424-t5ctfaev9z

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4464_1788588825\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4464_178851456\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4464_178851456\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215223286886627"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{867AA584-141D-4AD4-B3BF-B38B2DB8032F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1872	4464	msedge.exe	84
PID 4464 wrote to memory of 3804	4464	msedge.exe	86
PID 4464 wrote to memory of 3956	4464	msedge.exe	87
PID 4464 wrote to memory of 3956	4464	msedge.exe	87
PID 4464 wrote to memory of 3956	4464	msedge.exe	87
PID 4464 wrote to memory of 772	4464	msedge.exe	88
PID 4464 wrote to memory of 772	4464	msedge.exe	88
PID 4464 wrote to memory of 4740	4464	msedge.exe	89
PID 4464 wrote to memory of 4584	4464	msedge.exe	90
PID 4464 wrote to memory of 4740	4464	msedge.exe	89
PID 4464 wrote to memory of 4740	4464	msedge.exe	89
PID 4464 wrote to memory of 4584	4464	msedge.exe	90
PID 4464 wrote to memory of 4584	4464	msedge.exe	90
PID 4464 wrote to memory of 4268	4464	msedge.exe	91
PID 4464 wrote to memory of 3844	4464	msedge.exe	92
PID 4464 wrote to memory of 4268	4464	msedge.exe	91
PID 4464 wrote to memory of 4268	4464	msedge.exe	91
PID 4464 wrote to memory of 3844	4464	msedge.exe	92
PID 4464 wrote to memory of 3844	4464	msedge.exe	92
PID 4464 wrote to memory of 2596	4464	msedge.exe	95
PID 4464 wrote to memory of 2596	4464	msedge.exe	95
PID 4464 wrote to memory of 2336	4464	msedge.exe	97
PID 4464 wrote to memory of 2336	4464	msedge.exe	97
PID 4464 wrote to memory of 2336	4464	msedge.exe	97
PID 4464 wrote to memory of 4396	4464	msedge.exe	98
PID 4464 wrote to memory of 4396	4464	msedge.exe	98
PID 4464 wrote to memory of 4644	4464	msedge.exe	99
PID 4464 wrote to memory of 4644	4464	msedge.exe	99
PID 4464 wrote to memory of 4260	4464	msedge.exe	100
PID 4464 wrote to memory of 4260	4464	msedge.exe	100
PID 4464 wrote to memory of 4260	4464	msedge.exe	100
PID 4464 wrote to memory of 3732	4464	msedge.exe	103
PID 4464 wrote to memory of 768	4464	msedge.exe	104
PID 4464 wrote to memory of 768	4464	msedge.exe	104
PID 4464 wrote to memory of 2476	4464	msedge.exe	105
PID 4464 wrote to memory of 2476	4464	msedge.exe	105
PID 4464 wrote to memory of 3948	4464	msedge.exe	106
PID 4464 wrote to memory of 3948	4464	msedge.exe	106
PID 4464 wrote to memory of 2356	4464	msedge.exe	107
PID 4464 wrote to memory of 2356	4464	msedge.exe	107
PID 4464 wrote to memory of 3192	4464	msedge.exe	108
PID 4464 wrote to memory of 3192	4464	msedge.exe	108
PID 4464 wrote to memory of 5560	4464	msedge.exe	114
PID 4464 wrote to memory of 5568	4464	msedge.exe	115
PID 4464 wrote to memory of 5576	4464	msedge.exe	116
PID 4464 wrote to memory of 3972	4464	msedge.exe	121
PID 4464 wrote to memory of 3972	4464	msedge.exe	121
PID 4464 wrote to memory of 4172	4464	msedge.exe	124
PID 4464 wrote to memory of 4172	4464	msedge.exe	124
PID 4464 wrote to memory of 4852	4464	msedge.exe	126
PID 4464 wrote to memory of 4852	4464	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:AP:d524d89b-1811-4bd7-9842-e082d640a598
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffbdc2c188,0x7fffbdc2c194,0x7fffbdc2c1a0
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,5017337492853840993,15505002659816452285,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,3590116630647499036,16311260695104250646,262144 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,15019476674666375277,5486009653162603728,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,6396090849916990650,12775287829785172747,2097152 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16323434653061452112,4186904770225708339,2097152 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,11255974930760424624,2154762789459840373,2097152 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,15755380710108050618,9570182819557947703,2097152 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,1302742408892841281,13787566090181180512,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4992,i,1316842063628452351,5046774226282876642,2097152 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,13855851279661307253,8828081637679910707,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,1498178465210929161,12124862499523900356,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6432,i,14542246322290809949,11727022365347049443,2097152 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,13510630927457792568,13409749295199881545,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,13510630927457792568,13409749295199881545,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,17515149163024696552,16331931959463202220,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,13633317420226317413,1094126498042740236,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,13095797463155694873,1787760222516463098,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,1799209182553289051,16192807219145808064,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,9924921673324875243,12260242297662786969,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,3303245572868843084,8733186427706840251,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,2220496473505315926,6561198380416285651,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,17222894355045014065,6088497335579783598,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,4833092229413816762,6134800621436717631,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,253270518392134254,11531113372216674100,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,3463772945788544525,6167784236052223002,524288 --field-trial-handle=2864,i,9303915053358715432,17092828231688504789,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4464_178851456\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4464_1788588825\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 499f1baf84ccad9aec7e713f14831c28ec8ef6c26551e081f63481da9e10b787
MD5 0b7b7a3907c43b76a43eea92605bfc69
SHA1 b3d127433999df0affab0fc41fa6d73226ec079b
SHA512 67d637e6bb845665c58d6f0a256303841a077e8a03562447569857bb2f980056eb08233e2e8f7e3c0c468adc11695b7c60631f1f3f77f122b5344c0ccc3b2c7c
TLSH
T1D3D0805C9371AC70C7CDC9B1585777453D1AC5629A4247252C732D7D1C4258174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a68569752b554830bdaeb1e8a10446a2bf48a5c40d9055644b0ff7d12eb909e
MD5 619aee87184943036a7fd0a470ee34f3
SHA1 f2e0d05b802871a84b6abab52ce17fbe477f2644
SHA512 618e8ac028bfff63cbfb3dc8165970fe8da37fa98ba9c72a9b4a3b3eb9d922078cf4371b48f699b16e64d0205ac715cb0a1b9fccd6953e5bda90f6d945b76ad1
TLSH
T157D0805C53B1AC70C7CDC9B1585677453D1AC5629A4287252C732D7D0C435C174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 2.9MB
SHA256 d0249dfa8aa176d1d70e1efb3cbaa1d1d0098494c0909a2ad8e46084d08fd5a7
MD5 a3ab88687b53ac63cde7daa2b857d314
SHA1 c2eac149374bc239b790928e43502f99387c13f2
SHA512 bcf52d18fc7c6f1cff9ba8bbbfe766a18c53d0c22dfff2fb5e1af1ce6adc64cc8df9dd480a5c4daf550e9b8dd9196e3f8f40d9a7bd3e457963a401b689b59990
SSDEEP 49152:WpgTYyd3HbsXBQjDnReGuyJcZYTwfmwcVHwZGemn0bdwqSGSVYiInaBsJZIox3K:Fl1AXBQjDnVuy7iZGbn0BJSTGiInXXNg
TLSH
T135D533C7E0541E1A1CB3063BAF934AFA867DAC059D2E35951D0F1B08BE80B161BB6773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 28KB
SHA256 3bdc99c4bcdbd3473549f9f3a3c75c0235b99795d99a19c2dd88a1b2299647ec
MD5 46412899b0a36632a1a5fb9e33943170
SHA1 725e755073bf3a6b1e099e35238bd8e2320570d6
SHA512 d8d50f44dfbabcd11052f6aff8dee15696bec6d89c188c98ae327b713466295d6e9e01a92366e058d730df23a508da483a3865682a78ddde95d0ba9be59ca7da
SSDEEP 768:ixYxVT6+LJVKK18sRD7h/0MDe1fPvOxQeJ3jBIaRYn:ixYxVu+lVFyQDWMy1fZWjBQn
TLSH
T176D2F1DD97B876EC86738D13686D6AFC0A52288A42B33459D5C10FB70886644F713BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 62KB
SHA256 4496707f2b16c52c603303fa6286205ceb294b342711e25324bcdf12fd60f556
MD5 40f0ec369ed5f5a0889d9aac4f626508
SHA1 5a2aa9339f3603f3c5792fff90b7ac0f3d22316f
SHA512 a666a352a986476e8e514a560e8e0674f36532919eae3e42adf28705ad6e1446410c923be54375ded7afc89b84fda7e31d5ec742d893a79e8d5933f2c0827536
SSDEEP 1536:Kfw8JQM7przhLYfw4GLG78pr99LYBjm+Mv5TK9Izia+i49HD:wQiPJf4q99L6mDBTK95iY
TLSH
T1F85302147882E256F6B1F388CD3355521E988263E55A33D24F914727AEBE5BB37C32E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 0bd2e1f9422a988c41c726b1c29896df30f303923c261c9f8c8db02c99ad8c53
MD5 a3fb6f6d23456c52c46ecb8fb9d37e0a
SHA1 b94de428cedc72e995bd416c3e0b155690aa3b65
SHA512 e41bd3df186de7915bb242185072f68d8368b7365246a10bc9cdc1358a7a7141ee244ea9136da9e8d1de496e5e4be84fedde97cee43e0c436c0e8132db2b1dd7
SSDEEP 96:OK/UQDBcgcBaTE3vWcRLRbr71HAmpgwxxfFg1lMOri+8LbnGkBXV7VrV+NRgLK6x:OlmSBecRLR/2BUolcZjbJNwR01lEQ
TLSH
T1B8324D0AD1E7F984FBD914F6ADE91E68757A83844C1B8F2B35F1413D89637C3A8960D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ff2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ff2b.TMP
Size 3KB
SHA256 6892de23efbcd36162b68ef4e4db881c99e52297edc4bf278fa7b2557f93a265
MD5 cf3cfc637755a92955535e0513fc645a
SHA1 8445ccdff354f3a13779ca1eb85de5dc5ec252db
SHA512 06ff8210e6ecd558cf8159d52b4caf797b7c9b6cf5a05929c55c9b16dddee510081f70c6e5684d1716dfd5142272dcaf2176f0808a439ebd4099d6701c1c9f55
TLSH
T1E561408CE73B886CF7E501F4BAE9048676704B4981971F3A36F2467DCB16F154CA89E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 3bf30e422b9ccaf403e2dda1f670bf6651aae7efbe12bfb8d43f74a2ff17c4f3
MD5 c306a728a7cfe472867501a430ce744f
SHA1 48cc53e75d3eef222a5b50d81f1dc396fdb04e5c
SHA512 c0198e2184356b497660d5504f10801ebe27dca0abb1d1e128c74bacb62d2ec60934ba1f4252b4b466a5c08514c2e30542cd8c6271a601fb52bf21c016375d10
TLSH
T184B01213C150E012FF0C03F0598904416514CF110E4341CB24C04C11C9E23B45220041
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2bcd235fdfa696dc16eb385532f40a71c2a31bf9e9ae05c50235509a9518ce22
MD5 02132d29787df17493ac300ea6db0e8e
SHA1 011ea264370246e6f2b69c2d25687778da463b13
SHA512 86b82271a20df58106744d4780a23d3598d40385408542f52f8b5c0ae65b25e5179ad0ef750ba364eb8923589b75c5082dcf0f0bf8ccdc68e2d7868fe1617e16
SSDEEP 192:DFJn5z+1451UGiSos7rkj6uFmsuA07ngxk23RaeRFs07lrT:DFJn5S1451UGiSos7rkGuFmsuA07nSki
TLSH
T1A7E15CF783F9852D892291F1EB19EE1FCF591915832CB93AC9D05E57A3E24B1E100B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7659d08fdd0c0ee1fe254dc240f2c88fd080f8725d8ab5de95c2997248f11faf
MD5 8120cecf23b58974e30d83145943b0bf
SHA1 f51f1ee2141991352ea4b2d01efc4c0a9d462f3a
SHA512 4cff46ffd56e7fc88192c055c82387e63a5e346dc04681b389f34cbddae20ad448ea4ddac8c839473e9ccee121d5034c9addb63232e0e220e5f9f57018a05f1b
SSDEEP 192:sxZORlyM//K1Ml8Mk1/fGsQk6EdpvRHW6+WN8mF/vXPW1deIgyJ:sxZOpM1/fGsQkdJHbL/vHO
TLSH
T18942E9166A34597BCCDBD209FA55BF53D6F5056392940E48AEFC8A0C04E6AEC3217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 990229097a944b80fccac46a49f9f142530f1518b1a5345a0d38a3f3c1537cdd
MD5 32796c5d2e60af0eb7b3e0a164228a48
SHA1 091aaa9d4205c36ae3705934c19f285561c5cd78
SHA512 5f493e741e2d34fcea21e65d6f8256253235550718a2bed3f7ae2014622ed2b14dba284a3c5ce9b31f9c614c7230e4a83f921ee727f46f105c761e857af6cfe3
SSDEEP 192:sxZrRlyM//K1Ml8Mk1/fGsmk6EdpzgRHW6+WN8mF/MXqXPW1deIg5+J:sxZrLM1/fGsmkdgHbL/M6HY
TLSH
T14452C7176A34597B8CDBD219FA45BB53D6F5056292940E48AEFCCA0C04E6BEC3217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5f4ac45dc4af2d4001ead21792776e7a25d85d6b8b85065e8532bc36494e4c9e
MD5 c08fc623f786d6837ff959738e5da9e5
SHA1 7e5eb0489fc2f9e76f2212262286903e5aab5dea
SHA512 1436787cfb88def53c5b0462d6d19ec13fdd81dc505175106c0fe812257dc10e57de382e1218a36d6db6a441674600af865585e28bc644773418c3c0b1be7c8a
SSDEEP 768:lR0G9QJWvFnIP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVB8LlSMdFWro/B:lR0G9QJWvFnIPu1jaG8LcEFt/B
TLSH
T181E20A3B280CCB7E4F844E9DEC2A6F966ED801CB96984D4447FA484C02C77EF551A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 294207a67fc8901a8f9a3b3dd8efc88955807cdf61c644232467cabea87d4a2e
MD5 b300898e5d5204b580dc3f702633c31d
SHA1 134e405b20475e5f9a112a33534cc29f9efcb9d6
SHA512 aa7caba59fd182dc42c6ff29b32a3d9e1f2fb60af3f1b7a7d6dd8d0f6e8afce2c6ce43f8223b3ad39dfa5a32efcbf0925c56591595501a7b402dc22d6308bd0f
SSDEEP 768:lW0G9QJWvFnIP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVB8LlSMdFWroUf:lW0G9QJWvFnIPu1jaG8LcEFtUf
TLSH
T140E21A3B280CCB7E4F844E9DEC2AAF966ED801CB96984D4447FA484C02C77EF551A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\36aef1f7-60ca-44f9-9ee8-53e4e8cf7d82\index-dir\the-real-index
Size 72B
SHA256 be58f8928468900824edbd42f60b025b1d8176e103fdbb7d0c7fb3a7a2fb6ec9
MD5 fdd936c44724972144327f1fcbd59abd
SHA1 0f8f780ace3dd471d442b5ab0635b117582fa202
SHA512 93ea185d17f2dc545de1715e75dade69f50b088555497daf28ed804808a96e521184c519ce1409e743b82e0fabe41584c8c852e970e802b8a46658f552bf439e
TLSH
T14FA002700A8251D2DB892774A9DD414023189C164A0202264190544588A3343D113574
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d85a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\36aef1f7-60ca-44f9-9ee8-53e4e8cf7d82\index-dir\the-real-index~RFe58d85a.TMP
Size 48B
SHA256 f287a5512792a570b4b2b3353809b5efb2338a63b9e8fe39343fe44b167eb191
MD5 ccf0f7f9d9a7c7a949de1faac1c3c590
SHA1 170c6d92082deb9ecbf8a04917457c2b68fdd981
SHA512 d88b9c8cd1d352759e3b8d6b6267daebbbdf74ed44e00e220bcaf3da11d07ef93e2bb59d7ee34b33aa2feca8bba39fb74c42cb76d8052491e981d6548b36f801
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt
Size 250B
SHA256 3b82791c0661f5026ade186e7341670e455ae283cd5b2da9773318b56f7c048e
MD5 d121c90ea31be8c3052d7894346a0f4b
SHA1 82340f0bd90e211bef52b9dc05156572cbbb8838
SHA512 8347e9fb1c6d65e0cae6252e7921a56e82a926d96725ea6ff1cc136e03f56b9b276d06c6e9651e1cca08ce97fd760e85a953848509887b37218264ffa154e052
TLSH
T14FD0A7BB1672E264BB524ACD06DE652CF92F71847E50EE1DC12692470CB18633511ECF
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d889.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt~RFe58d889.TMP
Size 256B
SHA256 66c7ee2e39cc0acd94c6cba7947bd02c7625d46acf0c413987524e86f91dd159
MD5 f96f2776b53d221fe949235204fce3f0
SHA1 83fc33ee66c0169d6a21a65af35420f976aa8f49
SHA512 089dc93862a1395bd6c2a9e2498056208b0c32d3a9b2af3ea84cf18112c892090fc941f1cfdd9b6bf7fe965113a59a9275e64ecbf739923cc07906347794a106
TLSH
T1EED0957716715210671205CD01DD211CE53F79443E00DE0CC013B1030CB14631504DCB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 27acb5b24d0b370db0b3b270a697cf7e7b6d57ab817891366a93b0797bc8c805
MD5 c3820a1fd4fd9e46841c54214d6f6357
SHA1 543d6e250666c8a9fff61edc1027ed741d4de37b
SHA512 fa6b6e14c87d622b2e4f5d992b7d1a4f33527404c822af7e7ed8543b85bc856575f2d17a6b0a91556fe73ca2c070b225211dbb4dd2686c970b0d96669499a228
TLSH
T120A0021155689443F00682F49C4121D52399DD10850A133B41A40554DCD01E04912394
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d675.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d675.TMP
Size 48B
SHA256 33243fd518047f92f962a3b13bb37ed5267287f9daed8fac2d66bd0aedf1c092
MD5 3ce25a8475a47ee4f6c7f2a0a95177d5
SHA1 391f731cd5f9a51310dbaa1b6e62cf3f8bb6ead0
SHA512 4081dd0e4d3e01feccd9668708bf3bba8b633749d928e07029aa700d71869481ee18f31dd20a3438228c17e7e9b10a8ae479b4b2230a42189407243da4da9ac6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c8507005d05d82623197fd2cd7b0e5760ff45e1c35bceda272a80ed458e5243d
MD5 a9c3bf917de07b9926a134e917d8e2a5
SHA1 27d9781436b6a2053e626db827f0ee0b8691970c
SHA512 cfa6cbd52aac48044abe2c6b5177f03f6fecf3ee45738859016af72a5c3e5845990f114dd29fe77d871fb21dc1111ca07f477e5da25bfd16c8ea93fb2115811e
SSDEEP 24:KPhOlEtIXKpha1OSUjHyXOaIzazaCa9saiVacasa2uacamAa9I3a2a2K0aVhsaAk:KMuIXKvaYHyx6IfKv6YfjIpKkwEvyRz
TLSH
T1B6913910317786A2BB3E358DA655E53B038135A7305CF42F7B7A84A50E6BD208DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59308c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59308c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 909f0092c5a1ee49b19e7898735ba4664a788325653789d9cdd294f6f7fb6712
MD5 6a1dc35dd0a134ead36c4b226cd1c1be
SHA1 17b6be4145b9600e0ffa8470d6c341db444a9cf4
SHA512 dfb68e297b16ebd9b0715ad1d9421e23e319544d2fa0d8d6850468b9e2308e51dbf2fd7f842f981c807b63d605edf953df37126d9d080b20437872bc3a5191f0
SSDEEP 192:VONF6TZ0uQmiUyPj6ab+jD+FdF4orOcXArqNU6:VONF6TCqW6g+8dFNrl7U6
TLSH
T11F12F93568782C6BCEA2AD45F44736135FE4116B99C52B99E9D84F1C00D77AC2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9ed4953a346d73f5978314025e73af1d28a2dfcb6071a5327d49eb22621b1c6b
MD5 59f7bb423956f4effd92e5a16c4703ec
SHA1 8f024fdc491bef2ee43417c21d5df8d1e25fd339
SHA512 80e0879cdbfce82edcd140df74a6cc7a04b126434e21e3ea8995d9191d48b984f28f5026b7bc1d2d56982ccb5b6a14514349d44095699f1c8b30dd9d1ce2c038
SSDEEP 384:nSjccCs+Bt0S3vsN0CJCT3fCZ6n8+X+8dFNrm7mTV5fP7Jf3w:8ccQPLrfCI8U9Y7mDBw
TLSH
T1F2826C361CB41C7BDAA6D905F54B36035FF451BBA6D52E68E9DC8F0D008B2EC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ed18888b472ea12366a4703a7061a5825eea0abbb71871beeb670d4d37304ccc
MD5 25a266a90d285baa667b65e488dcc092
SHA1 ed297626526d840e16d7f2df385310e77cf5e46c
SHA512 7ba688b4b1e35a1a4860d05cf0b9f6478b720aeafdcd2098d4e6c31afff26e2ff2e95e05582e122c01fb3211957f65161f31472636ea49e0756d23f38678fd69
SSDEEP 192:z6sN0jQkCT1ndzgEZ0Zv2QmiU1zp8xZ7b+jD+FdF4orHcSArqNqAbUdn:z6sN0jJCT3fCZ6/8vX+8dFNrr7qyUh
TLSH
T12F421B3A68781C678AF6EA45F40B36135FF451BB99C52F94E9D84F0D008B7AC2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1c844b0e4bf15e02190dd075ec6a984d0a8d91e1c78fe972c78b4e36861684bc
MD5 0ee79b8a2fa5104dabbc2e626d08ed0f
SHA1 6aee69ce090a7db08d708a17779dad6e4a9523a6
SHA512 ef6ca781ecdc3b7a785468672dc29cafafafa8e07c86eb92fc708d5398901c778f6be185de9386c6b3709e5f2db3eb1557d32b50da1b12ee5dcc9642aadbc12e
SSDEEP 384:nvjccCs+Bt0S3vsN07JCT3fCZ6n8+X+8dFNrm7mTV5fP7Jf3w:7ccQPorfCI8U9Y7mDBw
TLSH
T105825C361CB41C7BCAA6D905F54B36035FF451BBA6D52E68E9DC8F0D008B2EC270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed88573af4340456e0e83fa960c4bd2a51f0a33c1c8081315fb0cd6e1d7113da
MD5 329213e533a8d854d2b408097da01aca
SHA1 1b0b17b1861b7d8ddbdeb56b157217314b2463e2
SHA512 759bb6c4df760990f1b258dd3e5e498a3d7bb9481af8ebc2d7451548531323f854f2f995b337649094ac06383743944181bf9074d941ef0a3e583bf2a0429bb8
SSDEEP 192:YONM6TZ0qQmiUyBjlab+jD+FdF5o8xKsU6:YONM6TCmwlg+8dFblU6
TLSH
T11802E7356C7C2C6B8EA2AE45F48B36235FE4217BA9D52B98E5D85F1C00D775C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 98bc6d9f1ca2f1674f4ccd79b2f7b51b03d0fb193271fa1c5ad9b9076ad0b777
MD5 9ef300e806e792c624cd062132a67a4d
SHA1 b4f4e3c80f0c2a3e263209ee6f634f2bd73bb562
SHA512 878a17304defa6657be4e03bf6ea1d3a12657c12c1fffe96ece1b98f71be2c4326c8bde619c55ca404cf78444d37c830528718fc8432da8835d02ee38d3c789c
SSDEEP 384:nDiFJjccCs+Bt0S34zsN88TUNTUlIl7JCT3fCZ6n8+ZDfYL+8dFNrH7mTV5fP7J4:uFJccQk1wgarfCI8pL917mDBw
TLSH
T1A9B21A3ADCA49E3FEDE28B85F60A76439FF011A795D969D4DAC84E0C00872ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 97c04cb838751f2b47169288a9ef19a83ceb5f674afa55c7faf2328f8aff76b4
MD5 1051590333bf58ea184c1744d4e6c311
SHA1 5985b334b9e283f52d412d0de5441892f66f4fe4
SHA512 d21addcc7410420cba07cda5ffe3bb2dfe55ba5ef0bcc345ffc9bccb80513dfcf13724977cdecd2eb59cfe38217c5113074a68fbb2bd58c66a852d37702c339b
TLSH
T1AE41F858B6F91148B3B76F1AABF6A96D447E79772F06D19D00110D4E0A67B00C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

05b4efb9-ef08-4777-b288-d6b3675995f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\05b4efb9-ef08-4777-b288-d6b3675995f0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

853a98b8-c977-4c13-90dc-b9402dad0d33.tmp

Path C:\Users\Admin\AppData\Local\Temp\853a98b8-c977-4c13-90dc-b9402dad0d33.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_1710336938\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58b06499-bf41-4603-b255-f711f3f6f2b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_480732009\58b06499-bf41-4603-b255-f711f3f6f2b4.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads