db82e1274e446d7b63a718789f51e3971e50066d6372653918c29a6cefac3ff9

Resubmissions

01/06/2026, 03:38

260601-d7d7aaes2n3

01/06/2026, 03:34

260601-d46gcsbz513

01/06/2026, 03:34

260601-d4skhad19m3

01/06/2026, 03:22

260601-dwxjgsd18k3

Analysis

user interaction
yes
max time kernel
60s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bajuxufebafelaj.pdf
Size 205KB
Sample260601-d7d7aaes2n
SHA256 db82e1274e446d7b63a718789f51e3971e50066d6372653918c29a6cefac3ff9
MD5 a1f4b05f693581e113562d034a3fe45e
SHA1 34a43d3da2e9504fe7ad3b5b18558664e1f3015b
SHA512 9693ca9cbed9f219426854cd1489d6b302b8851f5f31374fd8cd0e28b2baddecbe566a961b303923550fdd9a88d02ba682ecd994fe45d45d4d12265d54c42ef9
SSDEEP 6144:oerZUO33HtyXM/lur1ROU3ZqOvs8ujyDLZR:1rZUedeM/lufPJJ7umDdR
TLSH
T1BC24E127A8454D8BE4F9C365BE37BE6C520E3B12ADCB35D711308DC6BB34541998F28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2404	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247587749170509"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{079B3D19-5CFB-426E-8C2A-4E2CE248693B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3660	AcroRd32.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2348	3660	AcroRd32.exe	92
PID 2348 wrote to memory of 3088	2348	RdrCEF.exe	93
PID 2348 wrote to memory of 4440	2348	RdrCEF.exe	94
PID 2348 wrote to memory of 4440	2348	RdrCEF.exe	94
PID 2348 wrote to memory of 2888	2348	RdrCEF.exe	96
PID 2348 wrote to memory of 4412	2348	RdrCEF.exe	97
PID 2348 wrote to memory of 4412	2348	RdrCEF.exe	97
PID 3660 wrote to memory of 2540	3660	AcroRd32.exe	99
PID 2540 wrote to memory of 1196	2540	msedge.exe	100
PID 2540 wrote to memory of 4308	2540	msedge.exe	102
PID 2540 wrote to memory of 2404	2540	msedge.exe	103
PID 2540 wrote to memory of 4308	2540	msedge.exe	102
PID 2540 wrote to memory of 4308	2540	msedge.exe	102
PID 2540 wrote to memory of 560	2540	msedge.exe	104
PID 2540 wrote to memory of 2620	2540	msedge.exe	105
PID 2540 wrote to memory of 560	2540	msedge.exe	104
PID 2540 wrote to memory of 2620	2540	msedge.exe	105
PID 2540 wrote to memory of 2620	2540	msedge.exe	105
PID 2540 wrote to memory of 3936	2540	msedge.exe	106
PID 2540 wrote to memory of 3936	2540	msedge.exe	106
PID 2540 wrote to memory of 3936	2540	msedge.exe	106
PID 2540 wrote to memory of 4156	2540	msedge.exe	107
PID 2540 wrote to memory of 4156	2540	msedge.exe	107
PID 2540 wrote to memory of 4156	2540	msedge.exe	107
PID 2540 wrote to memory of 4144	2540	msedge.exe	108
PID 2540 wrote to memory of 4144	2540	msedge.exe	108
PID 2540 wrote to memory of 4144	2540	msedge.exe	108
PID 2348 wrote to memory of 5452	2348	RdrCEF.exe	110
PID 2348 wrote to memory of 5532	2348	RdrCEF.exe	111
PID 2540 wrote to memory of 5720	2540	msedge.exe	113
PID 2540 wrote to memory of 5720	2540	msedge.exe	113
PID 2540 wrote to memory of 5824	2540	msedge.exe	115
PID 2540 wrote to memory of 5824	2540	msedge.exe	115
PID 2540 wrote to memory of 5860	2540	msedge.exe	116
PID 2540 wrote to memory of 5860	2540	msedge.exe	116
PID 2540 wrote to memory of 5860	2540	msedge.exe	116
PID 2540 wrote to memory of 6076	2540	msedge.exe	117
PID 2540 wrote to memory of 6084	2540	msedge.exe	118
PID 2540 wrote to memory of 6076	2540	msedge.exe	117
PID 2540 wrote to memory of 6084	2540	msedge.exe	118
PID 2540 wrote to memory of 5624	2540	msedge.exe	121
PID 2540 wrote to memory of 5960	2540	msedge.exe	122
PID 2540 wrote to memory of 5960	2540	msedge.exe	122
PID 2540 wrote to memory of 5772	2540	msedge.exe	123
PID 2540 wrote to memory of 5772	2540	msedge.exe	123
PID 2540 wrote to memory of 5288	2540	msedge.exe	124
PID 2540 wrote to memory of 5288	2540	msedge.exe	124
PID 2540 wrote to memory of 5436	2540	msedge.exe	125
PID 2540 wrote to memory of 5436	2540	msedge.exe	125
PID 2540 wrote to memory of 5440	2540	msedge.exe	126
PID 2540 wrote to memory of 5440	2540	msedge.exe	126
PID 2540 wrote to memory of 5068	2540	msedge.exe	137
PID 2540 wrote to memory of 2400	2540	msedge.exe	138
PID 2540 wrote to memory of 6112	2540	msedge.exe	139

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bajuxufebafelaj.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4397CBA0595CEA1572619165E17762ED --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3088
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5181AC7BB48D3F936FAD43D8A9078D5B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5181AC7BB48D3F936FAD43D8A9078D5B --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F1FA768152C93B91BC312ED1B22FF698 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4C1C74CD02A825BA7CF2B868C7AD082B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4C1C74CD02A825BA7CF2B868C7AD082B --renderer-client-id=5 --mojo-platform-channel-handle=1884 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FA17F7644BDED8B51AF2C6C71B2FDFBA --mojo-platform-channel-handle=2724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FD5025A4C25B3D1EB02A18F2060DB290 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://feedproxy.google.com/~r/MbOu/~3/Z3ufxtS7Wvw/uplcv?utm_term=monogram+bleach+sds+sheet
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x29c,0x360,0x7ffbf9c3c188,0x7ffbf9c3c194,0x7ffbf9c3c1a0
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,8362359671260737316,452592812777836754,262144 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,5862481888302608922,16365926501389813315,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,16100386138410607567,7865708156767915562,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:8
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3232,i,10274315903305076991,6798764545783340965,2097152 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3256,i,5562668410883141068,6321909409785317596,2097152 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,9777376594831840898,7040258279935775910,2097152 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,15212188568223648029,12642875142087200799,2097152 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,18286946449274886067,12192768830353897027,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5731280448976655220,10637561139548567869,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5428,i,1461953389230294533,10917018517265069343,2097152 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,6898570479646078478,5243630125857740663,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,4461138089475686682,16329036854753255385,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,8743488662823633867,1727246411486357051,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,8743488662823633867,1727246411486357051,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,97525923114574278,9967759340740105114,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,3679641242561541069,6386058104474473683,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,661220510174240250,6091638918925460774,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,2581838757383083255,14639196687825252142,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16188742019754415155,11797529034920958173,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,8850884422851817208,14193824414363040846,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,8746004831562273737,14762788329405205525,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,11035964871688620369,7236886081043323771,524288 --field-trial-handle=3092,i,3849012908327609720,14080225678899642364,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 3c10dbd3124774b0a532a8e232b21b718b298a235668403f600e8b4dcc9096d0
MD5 d043a407fd1dc35b6d6cc00ea82643d0
SHA1 cb8f8fc45b26e12e6b9a3455667984f3ad3f1d39
SHA512 cab56c9f41bd2fe81c34c31cda3960c49ac8f61ff9631b50a58074d90d1c843bae1b69f51d0f193bad775c38d1e99d3f90e275745782acc731b97e87ba87f90e
SSDEEP 384:ye3dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:6+eUZsLQCZsL3hUS4
TLSH
T10F53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61e43e48-8706-4741-adac-321f20ff8aa5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\61e43e48-8706-4741-adac-321f20ff8aa5.tmp
Size 8KB
SHA256 bc753a767bcde8c77092b64d34c912e458447d40196826f336096064d5ae52ff
MD5 6136cfaa1119ff422f1037862c833b23
SHA1 9ad0f8aa10eb6a25851e6cf2ec00b9c38f686811
SHA512 3b952266fd0af805274ac02d079b2cfc14d8b1fd4d2e845b9222c932b1b2cce6091a0d696870041c00c5a01a4f36eb17671d3bad77306b43b97929ca13da893f
SSDEEP 192:JONk6v+YLNQmiUyYUZh+CGQO9UousvLU6:JONk6vz/uZh+CxO9PzU6
TLSH
T17902E835A9381CBB9EE2AE45F94737175FE8213BE9912F90D9D82F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6855aabafd9614bc456a4306ded6000d376bd4c413739bc51d1ae06fdf70bf0
MD5 78a541d2c7f480978c3e3c4ff1a93735
SHA1 828a1a23a8cc2dfceeb92e30f3810cade4552c5a
SHA512 f203a7511b4872ef6e7ef49bd505a484abedda780aadc7cf0778c9babf38991fbfac2b741f8d1df0e71dc3ae69699703c3acdbbdd85946f26279c5a57e3987e1
TLSH
T1AB6194781B720756E365113FE0F0860C7B73C1EEF92B1E3D439028B9650D7940144D07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591d33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591d33.TMP
Size 3KB
SHA256 6d28e5376324a01556f939e010a0bb817e2ec761db196dc87e4eda7553b3fb69
MD5 666f97d4d2fef664a6c68021c347625a
SHA1 942c2fbb06ed5f4ed17114fe8be3a04e37a8f329
SHA512 d8939d0653023d9061a19508625694807f4ce3527e17c4e39395bb2f02d1091f01c70cda7f81ccfb414082b3ded95e0b4c771b2f3b82d9ec59e8bce8a584a668
TLSH
T1C36192781F720756E366123BE0F0860CBB73C2EEF82B1E3E4390297A650DB940184D47
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 24db2ea507baed9648eedcb9070c3520d3d1d057d629117433f6279f15c7e7bc
MD5 95f8a3ca45d52b2e0b90296905b26898
SHA1 27649093ae3fbd797523bd68ec71c2f49f1f9676
SHA512 87a5c8feb58cfc69e873cfafb1096937e0b5fb9b72d73c32bc46333d72270c80bae93d108bd002ccc48c46b4984429da9a030af2182c3f67f99fd62f83a89a9d
SSDEEP 192:sxZcR9xyM/jK1Ml8MiD/fNsl1sjum95IdpXsRHW6+WNGUr/Y9INjQIg4J:sxZcLDqD/fNsl1sCm8oHbN/ic
TLSH
T14852EB026A389977CCDBD319F655BF53D6F91572D2940D449AFCDA0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ec99c2aa6bd10b10304c337b5ce62f193d5b232900effc4257ed437f0d90f95d
MD5 844d94703ddd8d2d7aa8218421d36609
SHA1 a76d14e4de93fbb1b93fe3ae86b3459f3b385833
SHA512 eb8094539270df73c3bd605a96ce829032a8b3ed652fcd4ea43e7a45eefdc98e41a97db25c821338fadb7a7f0316a81610f832e42361bd5b7ea88160f0e82f99
SSDEEP 192:sxZcR9xyM/jK1Ml8MjD/fNsIJ1Fjums5IdpXgXHW6+WNGjRfYMtmIwjQIg5dJ:sxZcLt7D/fNsIJ1FCmvuHb4fVbh
TLSH
T19152C806AA385977CCDAD309B645BF53D6F81572D2941E449AFCDB0C01E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9d5df31d17f5ed945bd8b086dbe6a51e6d96c2f1a1dc3c1dd41b3d873fbb508a
MD5 93f4f8132341a73a1abac00072893f2a
SHA1 582053be86e80ff02be10f8711e073d8b2722e87
SHA512 45ebabbd4befc214fab2de79212296a11868ff2f1bd88ad343082dcf928c8f3fee206a6604a8b2c5c2fd74dc5802608793667273f91faced7119b797dd4b760a
SSDEEP 768:xGcv2ud7pLuLXowWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtbeFLlwmWNNrom:xGcv2uLEXowWvu+Z+u1jaUbeFLeRNmcH
TLSH
T182F2FB3B2C0CCB7E4F845E9CED2A7E8A6DE8018B56D8895447FA484C03C66EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 47477ea1f202b8b74d2b3c7ea6f47c5ccc9d02e2e4cfe914fff2a7ea75e863e5
MD5 0a4626520de2e746353743ab59d98b6b
SHA1 6372a5cc0e4b39f62d9420173dbed8e1939bc693
SHA512 034519aae430dfc3d204b7948143cc8925d889db1fc9d71ba16715e744ca443821b83391c165bca67aa8b22021b0e16bda338dcf29df29ef6f15094770aed294
SSDEEP 384:y5HtNnNnb9CsNRPKdWPAOUziNijOe+CxO9+RFdBagoMgIEHVi:ajZbQjnn6qJ5OoRFdBanMJoi
TLSH
T134926C3669399DA35AE6D249F44B33475FB824A7D4C13F84D9D8AF0E01CB79C330A929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e45ebba71c0bd48603193b6d47a9a9cf485e1e05c1aaaea0f64f683eb017bee7
MD5 b8dc017616516550df214ace4e99678b
SHA1 266d66350892ccd0aadaa1373f4a38316ae3531e
SHA512 dc175e100faf39705e5057560a9939f60bad139728c602ec8c6ecb17822ecf0f713fdf33844e1f5a123e4a451713bab875a71d51113bde1c9246984f615eaa9f
SSDEEP 384:y5UtNnNnb9+sNRTKdWPAOUziNiFOe+CxO9+RFdBagoMgIEHVi:PjZbEDnn6IJ5OoRFdBanMJoi
TLSH
T195926C3269359DA35AE6A249F54B33471FB821B7D4C13F84D9D8AF0E01CB79C330A929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 791d079589cbd5ee1887841137cbb5488bcc46740ab98f4acd1571a36a681d95
MD5 5162808b45cbbb1143ee8c9465c4f61e
SHA1 bd28c4232a4783d66c8f385da00e24b2c10d90ff
SHA512 37bfe8f764a28dbf01f5a734bcae09b6f5c09f6f52b0f2c8a0f2547b44b19431501c91bd401e59d18cea0a0ed24b4ec9533ac5c1748ca1eca78bc8c6ab4dbffd
SSDEEP 192:JONk6v+YLHQmiUyqUqh+CGQO9UNRuCHIq85cU6:JONk6vz9Sqh+CxO9+RvdU6
TLSH
T130120831B9789C675EE2B545F48737975EA820B7D8826F80E5D82F1C01D778C330E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 96de8f7f748c658e720ef556dcf1aadc8605de70763c5e30dae392f2d93c9d50
MD5 97f9eb2cc8a0fabc21b18246e2602b0d
SHA1 d73c6c33007ab92ce2f7a5bd683586e5baa193d0
SHA512 e949d6eb660c9d0dddba580f54ad05d029119fd5b8d0e86843c1b609a21eb0d79891bdf790ea68bc9cd76aae34dee4b2c7431b4e4e7d9d972c3186e20c03592b
SSDEEP 384:yvUtNnNnb9+sNRSKdWPAOUziNiFOe+CxO9+RFdBagoMgIEHVi:FjZbEqnn6IJ5OoRFdBanMJoi
TLSH
T1FE926C3269359DA36AE69249F44B33475FB825B7D4C13F84D9D8AF0E01CB79C330A929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41699cf9-8984-410b-ac46-77d08d25fce2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41699cf9-8984-410b-ac46-77d08d25fce2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 49b30b11ecdb46a286ad7b03f150992da82010964323030cb57b7bdfd8aa69bc
MD5 83e3cf1147b74b0940b7d3ac49760b52
SHA1 4926ebd81aac2ab84e3add07ee1b91dae2b5754f
SHA512 db5ff48eab4029e3b41a517413c98ba7c564dfa1f8aedc1a014dbd8fd5cb6f7e0e3dc75396e4834516baca399545a19240bd96fc60ea2a3e01c59f8af537c29d
TLSH
T1D4411A5CA6FA1158B3B77E1AABF6A46E447E78772F4AD49D00010E4F0A72B00C861777
MD5 SHA1 SHA512 TLSH

Submit Download

52dc6051-fb8b-4570-8997-ec86c1ba479b.tmp

Path C:\Users\Admin\AppData\Local\Temp\52dc6051-fb8b-4570-8997-ec86c1ba479b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fc8eb2d-7e3d-4d9b-aa3c-a9e6e1b9f6ef.tmp

Path C:\Users\Admin\AppData\Local\Temp\9fc8eb2d-7e3d-4d9b-aa3c-a9e6e1b9f6ef.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5710b8e7-fa03-4afb-b393-33e2b5ff9eea.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2540_1840880567\5710b8e7-fa03-4afb-b393-33e2b5ff9eea.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2540_214498106\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3660-582-0x000000000EF60000-0x000000000F652000-memory.dmp

Download