6802124eb5ea5af2f0e86ae300958500c7917d1ee3e8ce6103026d1559cd477f

Resubmissions

13/06/2026, 08:48

260613-kqn4gsex2x7

13/06/2026, 08:46

13/06/2026, 08:41

13/06/2026, 07:43

13/06/2026, 07:11

Analysis

user interaction
yes
max time kernel
81s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/06/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6802124eb5ea5af2f0e86ae300958500c7917d1ee3e8ce6103026d1559cd477f.pdf
Size 75KB
Sample260613-kpmt2aex2w
SHA256 6802124eb5ea5af2f0e86ae300958500c7917d1ee3e8ce6103026d1559cd477f
MD5 b130a7f61207942cb82f4b0ae381fc57
SHA1 c3b54331338882ef3a3d8ad8f814fc35ca107b9d
SHA512 2b264d095e27f0f9f870e46773877f324cf604c795fd4b8430b8ed3f9b38a6c528fb9a05b66318f0ac7126db1554defc68a50f87d749790e186eb08e11d28e3f
SSDEEP 1536:97gx0ih5DZEEEEElSMIarQfJVW/DHyJOQbIdBF:o0ih5DZEEEEEofaA3c/QbI7F
TLSH
T1B673AE638C044787A4648BE8BE131F9C5E0E3B1D9AC235FF44221F9B7E749255C8E96B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6072	msedge.exe
4600	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134258140561390212"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{CD861415-4B78-46C6-9A96-732E9F888DA5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BEEABF0B-7F81-4AC6-A781-67A3DC7CBD85}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4392	AcroRd32.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1628	4392	AcroRd32.exe	87
PID 1628 wrote to memory of 2368	1628	RdrCEF.exe	88
PID 1628 wrote to memory of 904	1628	RdrCEF.exe	89
PID 1628 wrote to memory of 904	1628	RdrCEF.exe	89
PID 1628 wrote to memory of 1052	1628	RdrCEF.exe	91
PID 1628 wrote to memory of 744	1628	RdrCEF.exe	92
PID 1628 wrote to memory of 4084	1628	RdrCEF.exe	93
PID 1628 wrote to memory of 5980	1628	RdrCEF.exe	94
PID 1628 wrote to memory of 5980	1628	RdrCEF.exe	94
PID 4392 wrote to memory of 1060	4392	AcroRd32.exe	115
PID 1060 wrote to memory of 1052	1060	msedge.exe	116
PID 1060 wrote to memory of 6072	1060	msedge.exe	117
PID 1060 wrote to memory of 1176	1060	msedge.exe	118
PID 1060 wrote to memory of 1176	1060	msedge.exe	118
PID 1060 wrote to memory of 1176	1060	msedge.exe	118
PID 1060 wrote to memory of 4016	1060	msedge.exe	119
PID 1060 wrote to memory of 4016	1060	msedge.exe	119
PID 1060 wrote to memory of 3108	1060	msedge.exe	120
PID 1060 wrote to memory of 5180	1060	msedge.exe	121
PID 1060 wrote to memory of 3108	1060	msedge.exe	120
PID 1060 wrote to memory of 3108	1060	msedge.exe	120
PID 1060 wrote to memory of 5180	1060	msedge.exe	121
PID 1060 wrote to memory of 5180	1060	msedge.exe	121
PID 1060 wrote to memory of 3224	1060	msedge.exe	125
PID 1060 wrote to memory of 3224	1060	msedge.exe	125
PID 1060 wrote to memory of 2860	1060	msedge.exe	126
PID 1060 wrote to memory of 2860	1060	msedge.exe	126
PID 1060 wrote to memory of 4168	1060	msedge.exe	128
PID 1060 wrote to memory of 4436	1060	msedge.exe	131
PID 1060 wrote to memory of 4436	1060	msedge.exe	131
PID 1060 wrote to memory of 4364	1060	msedge.exe	133
PID 4364 wrote to memory of 5608	4364	msedge.exe	134
PID 4364 wrote to memory of 4600	4364	msedge.exe	135
PID 4364 wrote to memory of 5432	4364	msedge.exe	136
PID 4364 wrote to memory of 5432	4364	msedge.exe	136
PID 4364 wrote to memory of 5432	4364	msedge.exe	136
PID 4364 wrote to memory of 5412	4364	msedge.exe	138
PID 4364 wrote to memory of 5412	4364	msedge.exe	138
PID 4364 wrote to memory of 2004	4364	msedge.exe	140

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6802124eb5ea5af2f0e86ae300958500c7917d1ee3e8ce6103026d1559cd477f.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FC0B89D4DE09721EB4944981488D3F83 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=287DCF391BBCC92F775325DC32A2D7DB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=287DCF391BBCC92F775325DC32A2D7DB --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:904
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40C8FEB7D9BF6ADAE4356BFEDA1DA94A --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=05CD289888E4F863E2A42B7881428A7C --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:744
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6988FDA899F0C664F5D64D3A719F094B --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4084
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D6073E8A200C4E81E0DF1A67AE366927 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D6073E8A200C4E81E0DF1A67AE366927 --renderer-client-id=7 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://servicepmimongoliachaptersystems.siyatechbtyventures.vu/[email protected]
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffc7310c188,0x7ffc7310c194,0x7ffc7310c1a0
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6701101470461793849,2351468646830118251,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,1033480688475478640,9397298038763767958,262144 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,12940514787900858879,10961799395826331081,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,14189813361915586019,10427455350908188972,2097152 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,7173530668798930382,17660040172643590768,2097152 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,4222799672416578208,15894924819803460167,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,16488929235107553346,5967491722189096055,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,10679528581537498319,5532685448385550073,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,10679528581537498319,5532685448385550073,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15042688893638185731,15412719893375469299,524288 --field-trial-handle=2304,i,574717367526249213,16555488235477999804,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc7310c188,0x7ffc7310c194,0x7ffc7310c1a0
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,169064084498699803,5414675894778633543,524288 --field-trial-handle=2256,i,3319774067108107362,4387211666466179696,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      System Time Discovery
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,17478233634532104735,16699503681077034024,262144 --field-trial-handle=2256,i,3319774067108107362,4387211666466179696,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,7690691696622232707,6955922838768697599,524288 --field-trial-handle=2256,i,3319774067108107362,4387211666466179696,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:8
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,15989155513515325747,11764319309637609207,524288 --field-trial-handle=2256,i,3319774067108107362,4387211666466179696,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,15989155513515325747,11764319309637609207,524288 --field-trial-handle=2256,i,3319774067108107362,4387211666466179696,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
      4⤵
      PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 12c60f7c1f9fd0fffd67f66f1b7fecbd2872a8ae17af7eb6be4b54260a34d2c7
MD5 c1cfcff7480595fa5726161e89d1ec0c
SHA1 f4663544e2e99225f5d6394628feef0909642344
SHA512 d425cccf59c193e00f8f420f035f089607046fca94e292aaa5ffaa6f385daed78fca62f6c41193ee702eef7442c17e3e902f791efdbb923520750532e64894ab
SSDEEP 384:ye8dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:3+eUZsLQCZsL3hUS4
TLSH
T1A653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b3a2850ace9ae15d027763406e0c26f2cf9719828c340d623c60aff0e7831f16
MD5 1c635006fc5083ccfb69ca354dd091c1
SHA1 1979f6967488347c612f8ae430e0fbd428f2e3f1
SHA512 86854d932eca823cc9b5e82902b96b5cf01c5d8c241526ec2302d8c98f473140a4c1651eb3518f970e87664f96588115acdff2073c258c3047b8c2dedfa4a852
TLSH
T101D0A7A4391AB8D1E03D1932A4244610B65C47836A62D30AF6695409DCAE05176C6AC6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc1a9957acf18375a872182dce8230626d3d60e36bc190f5f113d18c9c7d0255
MD5 a0e10b41102961e57ee7b39392e46cd4
SHA1 0fec889ef77f3abf10fcac3868cae419d60481b3
SHA512 ce1daab1853900af9d670ce5d477c39b4aadde0fe18496d71c557887893841673869e1d444448205ad9c6ceba28aab8549c997038a1ab8fdfa51158c6cc6e039
TLSH
T18FD0A7A9360A7C40D529257168144610B25C8A876961D35EBAA9944ADC4F060B6C9186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 80d9481a1828b0e8703551d0f3cb36c65f75e75256126d2c4a3f03666bc02ea1
MD5 70cfc06cfb17935fb0443a9d09658304
SHA1 9f9078f5189e8fcb95272e8241127ca60d5aaa8a
SHA512 a94f798dbb21e0cb8dc78689063935fac879cfaedd8fc03223fcb7b692b449297a695ef4c1e7ccbfa28b5cf9ce210c89901fbe8f2c938a4aa4e24638eb8f794e
TLSH
T13CE022A6CC22EC2B09FD0728A009875AE70513173A40898F3B3D92098FB0B3A46C5C9C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b302c71801a99f0d1e29f2bfa468218e925aeae1333c8bc9fa30b33c0da9d971
MD5 b1555cdef8c74b1c1add3515814385b9
SHA1 0b6e0517bee4d610678d612c0b16ec2b46872e1c
SHA512 f9fa0544e9669691c12704a00bdf8bb707170379c349b13e2b3c0b31d41ed2785054719a8205d9617aca18a8ff6f47cada2bea99d622513c06c6153dd5f65dc9
SSDEEP 768:u5GZpiYq6clbFOdJVxrJgsV/62LmNpLo1XlwBKVJo:u5GZxVxtf/IpE1AKVJo
TLSH
T1B213C57C7B568DE2DADA413C592B6A3A273ED574F2C923C33732359A13E270A590DD08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 47a0ee540a65c94380eabb2a6457f986585078452db35e2891dbfba2f40efc52
MD5 67ad8287a0dd8cfdecc909c99be9f4e9
SHA1 dcada42445fc605e246ef9604711943c0ee5f0c0
SHA512 a8ed2014ef3ccfafc020f29dac49eb3fb75a04e42008f55baea4270c3ad1604f64212fcfae0fc3b6211e028a31cb3fbb0412aa23270b54a1541072b42372a3cd
SSDEEP 1536:luL/cl5L/+1bezJWLUY/gbL/C8L/Cb2nD9zzuIf13jYDvAqS:oL/uL/HzJWTIL/PL/rnD9zH0vA
TLSH
T1E4445EF70951A05BCFA812F5E2023A3DD177056D7DE1F8E9E6780CD12825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 4927aff9de7bb9f92776980046553896e258d33ef2190d89ee04be8d7d7508d7
MD5 c33331816747f0a2434fdfa78fe346d8
SHA1 cc0ffcb33e5cac31dbb5ef3c3309926fb191e55c
SHA512 050bc765d182fe51f9aca6fb9bf24438417a399a43acb3ed50fa620d37bedf694c808dc3c71aede77c1c7489ba949ae5e64686daa5ddae94e8199009a0b24cd4
SSDEEP 3072:XDf9y+HI5/uCBLFX2b6aJN3QnlcZcY4WSuhyrZf:zf0v52gQhN3IcGYGuAZ
TLSH
T1402508EECB682C82CA6B877470E0D9077E712183B68DC0D39944C5D997D6B8176F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 b0302e3d349c247f62b878c9c283af978b4ecee152f14a40efeee49335e0bf9f
MD5 e2b448c6c644731d9eb02c510669ae28
SHA1 a3ee024fb5e94a416e2504140fd42a1c6514408f
SHA512 acb2b33234f1737ee14f9fac48a738848b5d1b7560b0b80989980dd9b1bb07815a89c26ae0d901a2b7a67de7fcfe361c120b7a5691c40508db3ce7aba0809c1a
SSDEEP 24576:wYIollXHYmkVoA59FxLlPygYWAM9PJhe49JVs6uYYwM/rWnQchsD+LT1OZm:wY14mkjLlPTY+Py493sIYXrWQUVt
TLSH
T18B867DEDCA6898C3CD639970B0F0ED477C7413C3F5A5C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f178932fafa89ee666d5ade1a96ca3bdc2f64c8e6906808e3edc11161a457fc1
MD5 7565df81d509dc72cf738d29f1e3779b
SHA1 bc9d4ac33370efe8dbda8760d2987afe6d7bbaee
SHA512 da29102e4492d707c0cea9a7ab7e5a09b1f23bb5797c634ee11591dfa07e07df35a2378b9c9be872935f8d6b5fe9cbe1806a3f96b5a1d355836ee19e9275b4ec
TLSH
T17071E7F4EA03D9A2DBE90E3783C1F270397185D8FA534D8D226784BD2E5A759C10EB04
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 1e37e2ff9d15fd0b88fbfa5416918576bb4c3debd3fbf03cd3f647e9b363ec8c
MD5 f5cd7cb2d1755363ea0674486829d877
SHA1 3ff09c71613073b55273b660b37f3024624c0264
SHA512 eeae300b31d8751387edc16c05993095c3b2d0459203f31548d4d65eb2f7774052fd9e5a88c33bef75a3d13620552f5dd3ab933cc626b2cd9e58e261f1554190
TLSH
T19FE0D8A555C7E11D555874D65274570CD181349BD6876DC767418CC47693002B782D47
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 a126f3490ffd08d7cc430c64f6b094cabfab71eb7eeba44cef7491852f9d6c35
MD5 654d24c3afafb3d49b56d7c87769049d
SHA1 c544e3cffd7ab9892d3499d45ff819dc3e0c120e
SHA512 4578db690f7d8fe885146d0c35451b8fbcc750983fc8cad7ebe5f26b311edacd2b9a346ec19d57b3111820f7fad1a53667a3801781df9159ec9e0c8f48aa9be3
SSDEEP 48:Tyi+7f+UZD4jJ/BxYWxnSCKFOBzuBTpBG:GLnD4jJ/Yj7OkBTps
TLSH
T1D7E2E08D3B11F512D4ED733EA0C2C9F05EFC687C464E7171923C99768C52A66F49E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9416944f78c611bc88fa1fd136de885ab3ebccd2bb67078b4ef9f46636bf1aba
MD5 baa715b4e38a17654295b20e157f914d
SHA1 a89fe866b8500e9687b7846e3e929148202441ab
SHA512 f5e4dd0e74e9b32347c52e971e64ab4b4b45053b85e3788aa933a595f719a844f8803e39c1cc5b3a419096d78fa992a3d54be4959bdcbba93cf9c46ebc386885
TLSH
T16BE0260846CCF22D905C78D3876C430CC7D034CBE38B3A46278AC8C4B143341ABC6680
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 4e6a9480bc81ac0c09e2fa459f7e8f0f44ea5276106b4091cf91dc483d830b3e
MD5 80c0c8960d8c9f5a34de0441d1d15c8c
SHA1 c6f8378b025580b85ee579c5f8a6186ed8c5c5f9
SHA512 489cd50e4e59252c37261b8434f3c846ae4a275d8084cc9f55461253d93fb4985f60f40e094704f7f275a8c7ca0526495ae34c880fd4ac6aec750e44f1a22733
SSDEEP 192:Sxf+G83uy3Ct7XBBK2n0e0BMH7DXspU3if:Sx/83uICtTBB7n0e0Bw7DXspU3if
TLSH
T1E014424E5F342721CDBD81762CE754B36C7DF03F8B5266CA686614B4CEE2652A02C87E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 9905bad4c3b58e2beacf97c1ccc6f764e52606b834eb9579d69891ca4eba19de
MD5 a87bf425365212918e3754fe27834d78
SHA1 bee04dfcc88480ab61b080cbdc91e9eba1102ac1
SHA512 1aa587f2fa4a1ba40f80bfb8e15362f60c03c7e78c24d071e8887c5463b42fd51eefa3e0c063b2196e707a8b23c113859801a062427a43676e87f3b03ee0cf53
TLSH
T161E0D8654ACDF11D528C205743246B0CEBA0344BE68A2E496B8598C9B043144A3C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 ce1785612f338c5d8ac650c4e793ffbedc750e712f1f921f43bc99040dd432e3
MD5 92e3dc20a3ffddab60a943f739c4f1dc
SHA1 9cd1f41d1bf8b49cd57d018a65804f5dcd651d27
SHA512 f0d38801dd6b96fa3e178f390582e58a68ec6cf46d28eb2cf8456625fa0a40cb4e25fff089a7dbdb57add3fef4b67f0eebf8d69dfe9877529cec26f0de28f036
SSDEEP 48:T2SLopFMatSaw/auUOt8BRo5Zz3YoVoCwZyJGlpmSYwH:iSeMatUaAK+YkYywmSYA
TLSH
T13192614D6F302230D1F0D776EDD0803B2E7C525D876335CAD91820F38E926ABE2065A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2594bd63212a2f4ee93a83b42d0fae0b24c10b1cc376821284c4d535737ee743
MD5 414224fe445a76c17c8276284db58f12
SHA1 cf0b7ed87caf352eaff434b464e3d477115e77e1
SHA512 6cbb06069e47a3ee226983ede2643b79099d96361caa3bb35d11abb69d4d9c5ec64a80535df985bb62a45ef0f1fabaf45256b9c698fb7de1f83f13c812162082
TLSH
T19551CDF7C2E4C62DC91196F0AF54BE2BCE2D0554432C3D5A88E4BF1B93E24B1E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 62e9754ee99890653e91cbd7cfc96a48078caa78c5aec0fa6926ab1911f512be
MD5 e6b65e680ebcbc994b920d6a84d0ed8c
SHA1 9e59631b436362b2be231cbef29a6e145a961ed1
SHA512 b71d3dd8734ebf1f702552a52cd343bb3c39d7a88922f816b3aab7f0a0d8a2898a55f1793145d231d5600d1f4615fd34b44c32bbd56c113d359d780db82df2d6
SSDEEP 96:OIEumQv8m1ccnvS6lEA2ZH2MJUQf4JU5nFfQMjZ4g:OIEumQv8m1ccnvS6t2hJsJ6
TLSH
T1DCF2FFFA07236105D99445F0A400ABCFAF1A014B47B2B2EC66D45BE3F3921E3F6B9756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 e7c59b78697fddb539ceb115ba61025301e3effda5e3d32fef97b4d0d34f8a04
MD5 9d3f6cf56fc084ad874dee05ef267248
SHA1 e4b10e90b8b558575c3b3ca8f31a24fa1abbd517
SHA512 7afcd62d223deff29aed1bf9dc13765048913def115244c3aa6440ce918a63b07e03492557c1b817941f995a4f83763d856ceffff4f0f94f953b2848f7776181
TLSH
T16DC0222280B8F036103489791E80E881AB35C8390100E4E5EAE4833CF0800B75A0202A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b9a8db25e8cefda51075953afc6e372cf6270168992acf98c1c9425fa9230282
MD5 d67e8183e1a020bcb99707cef8971021
SHA1 2bdc1e376d111df1a08288b66ba42c9ec7cb69d2
SHA512 5bb4cb1ab9c8b94e18faaa1f0259b4d74f1611a78405b09e39524468da640c97ed4212bbf09e4537ef8463dfc0b91563fc498aea1f668d2b88e92a2f58f8f756
SSDEEP 192:sxZURoyMqZjK1Ml8f1mt/fes6WpVV7aZdIaRuv1zodpzEHW6+WNFjDrXYPhukT+E:sxZURVt/fes6WvV7azIKYeYHbxX8+0Pl
TLSH
T10072E706A9345D7B8DD7D21AFA457F63D6F90522A2905E449AFC9E1C00E7BEC231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fea8bcb91a0bdb2122cb43aabfda5896f5a623298c9a00adf6539656d22f0b04
MD5 3c9aed36032a8ba963964ef256ef2000
SHA1 8234bda14eb15a69a8499718282ec971f5260edc
SHA512 2c773bc3d32db635208a93eff3d7d6386074979f1c3702ce049c386644e331bc00c310ea3349d76d99dcfd25e28f6a4a109cf9862714eb3f7b27eced2df8991c
SSDEEP 192:sxZURoyMqZjK1Ml8Mmt/fessY7aZdIaRuvbzodpzEHW6+WNM0S/Yvou4Tc2IgjzJ:sxZURut/fessY7azIKYAYHbe/j1jl
TLSH
T1CF72F906AA345D778DD7D219FA457B53D2F90523A2905E44AAFC9B0C04E7BEC231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 26a0ca76324ef512afe427ae7e7477d98400de2853d24f491b0ba05375400256
MD5 c621327c7d23023eb246ca7edfc6912a
SHA1 c866605a674da328b27fe9e0039b3efcf503111e
SHA512 ae24459aa7c356f333a373791d5f3095ed7a71ecb567cb840013b433c19844e1a8eff89070ccf25516056fa385062fe330ea45b5655a3f77a689fdb5be313d0b
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvysy10LlG:eY8Od/HEnFhWvFvmXu1jabt10Lm2NurR
TLSH
T18CF2EB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 4a8394352385a67408b981160098b4db2c7174d93c9713a692aa4c61d4cacc53
MD5 97c09a82817cc53fac3f2ab3ee3de8f1
SHA1 396d3ca5b3f9a43da8740a7a441e1e67d05187f7
SHA512 d5c8ff52755dc16664fa87dbc07c296e5b2ed9430d57228c8bf9c4684ac888e9f0c7da263ca748b19b3a15139d7a5439b59338abf8c03f4be69aad07d60d50d0
TLSH
T15EE0DF904BC8F17D605A30470724970CC2E4748BE2CA39466F8188C46543A05B3D2180
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 cf4a2b136c590df7f9daca72ce691313cbe3032be025503a02452cfc63965cc5
MD5 dee1b4c4cb799133e590ec6034f61aeb
SHA1 ddd66c89d0a6714e42797839c13b9a71982a2397
SHA512 93e6020d55b1f0307646f0d070080197e3eba24515fb70b2fa632f36a621077a170b47af03375d24e400002e467bd9ef95cc24f7fa3ecc390752f868e7e9417c
TLSH
T1FBB01248BF085225C08D59318A844780B720E00200508703C85A4F140D1D26DAF11C81
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 e12d6060cd5a63c4fffb6cab722b005c7018dd33045d9c9b029c47e31599792a
MD5 9a4153b36b974bddb809493fd878a10d
SHA1 b7778dce334ad6c03851cf33e4688e1fe577fc1f
SHA512 9114432f41869599f07cee6e72fdb39931e40f6c91f8111b599135e9080651082b2491d8f5e280106ad09067b9ea5346f5760ae3a6c5b37e1bab607aef726ba5
TLSH
T1BDE0DF2557C9E62E628D318B4328F30CC2E2788BE6CE29663B4994C4B207640B383280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 91adf2abe7ecddc7f8baeb70996da33449a9da64f7b87d2d7d97bdd59f2597e4
MD5 67b051f4d1e52c628a5bc95fc59352d5
SHA1 998b984539ad06fc9bf7e61b2ff3cf4c01591a25
SHA512 69593efaecf048c81e68dc04b83fc9aa6eb7fe69070690825b349877a8d7c113aba23f288c9871fc203e5339d70c9abc2a5cde4d13071c271c1faa9766286ee2
TLSH
T17CE04F70C7C9E63D505870C24364B71DC6A0784B978B3A9A674884D5B543755BBA6980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f3f137496527690e367bc513660984941da7e2c323f6ccd10b6029575d5b0ad8
MD5 89f3ca7c97de94057bae9e7fb958859e
SHA1 664a6ec2ac0efaedd7118056d363248d00ec5e06
SHA512 96d0e457537a188efcdfc79c0a2dafafceef6524f345f4a3312d896216c278cbb628709e7aca9f62c7380f71bfddf0d7e9eb11a6599777623ac4ef9cdcaaa909
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGB:05ppxnY753RNBvRJJdt7p5J9rL9/
TLSH
T121B27C5A713E0211397E298CB39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 e58527a93685a4bdde51501af0a7b8e7e39c808c0722d815c0bf6840b07a2014
MD5 51e6aca7c450a5708536ba57afd12cd7
SHA1 6e48592da249218f62679d7477d21acbadb76756
SHA512 a5b00d19ed9c604dbe2269c23a6cebe803b13eec2e2ac18074c278a22b5430be7f0e164247d4e62f8e5cac5794e6cc94e6361d58d5299b5bb453d7be78e4f09b
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9rL9hjbOVQhljXzafehNp1NbSdNO71tg:0LppY93PBZJPtN53rRh37g
TLSH
T144C2791A713B0211397E298CB3A696364F4235A37058E4AF7FB814A14F67E124DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9d9eb99ca3a7c8660f28155235295b593a5c7a4edab77d51f8be20dbc2a9e4e9
MD5 4ee81005e714caa2c56c30bc43fe66b7
SHA1 cea9cb02b954109e8d546519c6d84e554e345f10
SHA512 ba3034c02d1bc2a7389d5069506f4b800876d23d9cda2bbe18866d188281c08d1f428369b88fde3258a858d03486e2ba42c7ce66866cb7a359e9738b586811f0
SSDEEP 192:P+xWEOPfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxmfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T18924630A7B747001EDE6D9721CB080771E3CB16DCF22A6915DB664698DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 33c402781c3c295b37b890bac35d358c13b554573710807ba3115b0e6f3a6539
MD5 f1bce10c3cf04091a04059eeca3b710c
SHA1 055b09678ed77264d189a96f41cd5771a51c57cb
SHA512 1ff52950f845134f2faac5217ec33b3b5f34c4580098552da6f0646d1803efba8d210701b69c4dd06162c47eac139b0cd4e7cc0d232237a237d34337e1a258e6
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBghGyrVj/o0wHditFD1GyrVMW:DEtSyGhp22iSc1VTsdi/D11Vj
TLSH
T16A5202DFFB343242CDE943745DD151F2AD3E962D8EC0D61224E715250AB02A69B1FD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 cea99a1c1743270f706d98991c45dbccee0522796b4055b8bea5dfe6d1d3c90c
MD5 a455970d9255801bd72dc99eea45877d
SHA1 4b83930d1580d688526b385bb04fdc255a3e1e25
SHA512 da1b09454ce2d50396175e1ca219e64ac90df4b62e5f7bf69c31205e13807bf95b91517c1f489521ed418d5bfd30fa326992debb2a0352f618ecebed8de42602
TLSH
T10651A1C193A924996F89AD81E31A5513EDE13E6B230E58B6332E44F54F49C260B3FD35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 ff8f41459e25240881be762f34567153be743c6bc7d4582cdcaff7d258aefd3a
MD5 175f0eee764007f5fd0240234da939cb
SHA1 841fe93c06f255f80cb9f9639ef8a825a02ed235
SHA512 d5e82f53a51d9d937b1c611e4d49faba0a92e2adf0d92d550af3c9e6a54b6e6047e53e386cae6a4a910c5b242832a2de6eadcac3a255ad27a73eff79413d6fe8
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flOQUpIIIdb9MIMPWYcY1SeG:GAhsBJGscxQUpIIIdb9MIMeBUSeG
TLSH
T1DC52722D67017B3BC05EAF7713664A589FD5A8430277222E30221C6F9EF3A5386C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 17c66bf84d2ff836d85a36a6aa12062295d1b2559dfea1f9b5d4d56e3f416899
MD5 893f5079782ff081c245a0d6a82ef04b
SHA1 22e852a07bd2c21604adee26f92d4022057b092a
SHA512 25e2a071d2f07b592ada104ac07defb1a0c77364b8d5a4fe970b39c2b7d6cb0e59864fb6c83b5bb3cac4c81ec7821850a8e146fc182e0f8bf245cbd2628400d2
TLSH
T189E0806557C5F66E645E20871358474CD6D13547FA85394E2F45C4C8754324473D95C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 d5e72e18fe2d19b4c105862481c23088df72ee625325cf73136feb0d6ff9211f
MD5 f638c0c9d42ca34b8799203852a02b6d
SHA1 a5d85e16f1b75accacc81bf79e8e3d5c24694176
SHA512 4be364a6d15d289f353bed9c8dc56ee0f1a40d42eacea5245b068f09afeef21c272b170aea8037df25e894e8186e55396168f3fc68b5c78473fa60b0a2d3533e
TLSH
T1BBE02050EEC5F25F609421834264834CD3A2385FEA852E857F51CCC8710338173C7142
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 0ca36bfc49e9c0f2aff582decbdffd5c78293b083d65a426255ddb6310d84ac5
MD5 5343b3de4a30c29e6104f4f5b24c5ba7
SHA1 49dcb7346f07f359d68b7f0e55ffdf6f61bfcecd
SHA512 e05d69b96e807fdb104036c23a72cae277aecadb4642a427c594d242a3637f2e39c4b35b35e6885d7de815bf27059e2438cc88e8b28384deacae3882aa6998b7
SSDEEP 3:MsEllllkEthXllkl2zEfltvl:/M/xT02zO9
TLSH
T1B44404547FC00407CD0110305051C3503370DDD05731775334D104335CC77401C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 795c6c3ba91ae251e36c2c5106cd91ca3d9596859aabd6f1afa112cf73f764f9
MD5 4df501f7af4db99a0f35d87e431b861c
SHA1 1e52f740ed5adb7f30b4b2cf9376bb2d13aefb8d
SHA512 608514ea44cafee46486977323c0fb6f9c7d0c6c443342e4bf05714c169a0bdc486f64f768c2c4dfbf86053e98461ef61a42e11d8e8a2c95bcd2343f6620a782
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9ltKpvBftG0oDti/7vtpje4KV8p0+HFB:pVFccps3GwgbkUXkjG02I7vzI8p0or
TLSH
T1B0B25B36EC68CEBBECE74F99B70E6A07DEE0512785DC99E4DAD81D0D109719C030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6ec65e8fab7480e7cf454b5038a16a7b9cd04ed6aa81f22f60cb19d9e3eb60de
MD5 170e325d27ad6c41755a96ed32535430
SHA1 d142cff18958e8f0811a402d5ebc093c120dd4f1
SHA512 32453ceea6951d31157eb71a4949447bdb314b3b90bea87017f26b004565802f1695e40e678b7fe6beffc7e8f559130e77fbb29ac170dd1388f5ecc688765e01
SSDEEP 768:pfFEj+9QHwgPkZvjG02I7SzS8lCK4GHSG/ARRDvz:79QJE5l7AMjgSG/ALDvz
TLSH
T16AF23972D8549DEB98D2DEC9A74AFA066EF00133859C5A9CE6F87D2C308F5FC0306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f5c84f45b80d1b2f120c241bbeda2ab9a4ec0356e16d35536dc1fe33486d4470
MD5 94c1720ece4138587d7fc358f3d9841f
SHA1 a4c78cc81efa0535bddf842ef9ef3bec011dc79c
SHA512 19f53cbfc5935bfb1100abfa9cf05b3fc788bad1d00acabb2b34c797dd396d4282463d862088f0b0250f66b9f48f344bbdf47e595c6354eaba2204dc8a9b0dda
SSDEEP 768:pfFEj+9QHwgPkqvjG02I7SzS8lCK4GHSG/ARRDvz:79QJ55l7AMjgSG/ALDvz
TLSH
T1C5F23972D8549DEB98D2DEC9A74AFA066EF00133859C5A9CE6F87D2C308F5FC0306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ab465f53e34a36b234edc7d96537b3874f5e3e253a11b5f569a69c4785a35eb0
MD5 cbf28b5b5b8db79bb7b07585df5abd2f
SHA1 d0227a9cf17e664d68300a4a1def269233d7c605
SHA512 775c2057e8d0fe6aaa46936076fc0c2b8b0addcd57ce54aa22d91d1984e6b7c21194bb5cf30ec47fe7bc202c6e7542cdf11c6cf09f22e6ffa2c88c6fb4a6f6ce
SSDEEP 384:npEiF1tNn/s3n9Sl3sNa8TUNTUlI40QckCrAWRpvBftG0oDti/7cLDvq/Pb9oRdl:pfF1j+983HwgPk2vjG02I7Svq/ARRDvz
TLSH
T1C9D24B32D824CD6BADD75BD9F70A3A47AEF0017398C86ED8E6D95E4C008729D170BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 263ed75101990023b5df01c19810f0af49a28fb6ab415deed8c98cef390a8a5b
MD5 e2afdccdf1ef16f9ed89e5f1c929e254
SHA1 bd0ca52f5c880b4f3fc4686c2f21f14a6bd7a727
SHA512 9e34b1b0bfa5edcb4dbf487abaed7521b1dcb0cf2d4ef8c3f14c00580af6ffba31adc9ff65a5439f466e462213779cc4a00083a064662e256b85c0e14c224907
SSDEEP 384:npKiF9CcmyWCs3sNm8TUNTUlIm2QckCr9wFSpvBftG0oDti/7cLWvqe4KV8p0+Hr:pBFccps3XwgbkU4cjG02I7lvqI8p0or
TLSH
T109C26B32E868CDABECD78B99F74A7643DEE04173898C9EE4DAD85E4C108719C170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 20bb3091d75f25134768ad5a9df9de6baec4370710d535462df64a7f423f4c2f
MD5 c92394259993fecf78d1babc489ad215
SHA1 b8d3ea5ecdf54bba518ba9c5adea1fbb73717dff
SHA512 5122b98b41eb7be6ea2e7122507536b51e7af56ef0e1cdafe9b87d665ec2f274884d09f5490a461d1177df8cba79450d4e86a3da8bdddabd6400fa60fba1dc5d
SSDEEP 3:MsEllllkEthXllkl2zEfl+KXl:/M/xT02zLK1
TLSH
T13044041C7FC00405C50010314051C3503371D4505511575335D304375CCF7401D000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 fa63197a2d7f27d53748a688e227f337643c98844f34d0ccf09dd3a017af11ad
MD5 0780943c81c68b408f8cc74dc474c030
SHA1 1585ec91b1be22044fb7d23d65b0798eda107631
SHA512 51dee7e8131262bb1ea1844864f5e4ca38ec9dc41850b8bfdd87baf7e561b08f0d344d4e21142874536678932c37fb2c3379f8d0efbdea5daf7a937b4e3fd076
SSDEEP 24:VA4qC5fjOqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw3:tpaqp/IHRH34kWqB1kQnjhHmr6ITmU0
TLSH
T1BA42786EDA2CA9A2FEE00B3ED7D1E0127B36A60EC2E8D5F2095B905746C444405DB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 42aa7b64784f3b92c31d488d41f0b60850fdf702087ea6ca670dbd587195905f
MD5 6f270e7cfc4322edeb61ecce75e59b95
SHA1 35ddb8d226075a3453afab8a362d9d78779bb607
SHA512 0f42bfb4d82010a4aa3f20f5b26ad04966f94d92b0188c69fa7a8aeb4fa8bb018ce146040257690297030021650dd72ba46b009ec6c73c1e9a9ebb14e8fc28a1
TLSH
T18141F958AAE91108B3B37F5A9BF7646D487FBC772F06846D10110E4E4667A41C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 49976bf539ec73e16878422a5be2ddac2bfa41c473831a17dd31c1ba838d449e
MD5 81a1dc1d703b3fffc120401222d6f42b
SHA1 586fe7dcda91c97be7d8db834ccfc97c1310104c
SHA512 681be526b283f1e2caea91ff15ee1660e15755211b95a309fa2fd9b816671f5b2a370cb6a178ac814197b652c4179f27f44b486e5273be07c57640fb2335f90b
TLSH
T181515258B6FA1108B373BE569FF675AE847FB9772A47945D00110E4F0A23A40D8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 b6457fcc3bbaf59e1af1642ddde89aa33c15eb9e3eb7805c162fdb9862122465
MD5 9a6a3d443ad3684bc0d7bfac90fbfdd7
SHA1 e3882ae5b4d1f78c0ae10c7ad782b0627abf402e
SHA512 b931cb90000ea16f0f2a7f4758992723bbdcd776d2fa69886f0108469010e5f8d440a7782c15bf46e7fe787aeb43d6b1b54afe2ec8bf0d59d661e7085903cbd0
TLSH
T1D55158B53A25A23F6B8387C460754C84A571F280132E9A5CEE5AC434BD6CEE2671F7C9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4392-96-0x000000000C2D0000-0x000000000C9C2000-memory.dmp

Download