hxxps://cdn[.]resusama[.]org/pro%20executor[.]exe

Analysis

user interaction
yes
max time kernel
143s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.resusama.org/pro%20executor.exe
Sample260629-s9j8msg15w

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
15	4164	msedge.exe
33	4164	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
2180	pro executor (1).exe
2500	plus_1_computer_exterminator.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pro executor (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
55	discord.com
51	discord.com
54	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	api.ipify.org
51	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\pro executor.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\pro executor (1).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4164	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272217907845033"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{A2330486-A520-4F60-88F5-B79D9E811466}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\pro executor.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\pro executor (1).exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2500	plus_1_computer_exterminator.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	plus_1_computer_exterminator.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4488	1472	msedge.exe	81
PID 1472 wrote to memory of 4164	1472	msedge.exe	82
PID 1472 wrote to memory of 3144	1472	msedge.exe	83
PID 1472 wrote to memory of 3144	1472	msedge.exe	83
PID 1472 wrote to memory of 3144	1472	msedge.exe	83
PID 1472 wrote to memory of 936	1472	msedge.exe	84
PID 1472 wrote to memory of 936	1472	msedge.exe	84
PID 1472 wrote to memory of 3700	1472	msedge.exe	87
PID 1472 wrote to memory of 3700	1472	msedge.exe	87
PID 1472 wrote to memory of 3700	1472	msedge.exe	87
PID 1472 wrote to memory of 4016	1472	msedge.exe	86
PID 1472 wrote to memory of 4016	1472	msedge.exe	86
PID 1472 wrote to memory of 4016	1472	msedge.exe	86
PID 1472 wrote to memory of 4140	1472	msedge.exe	89
PID 1472 wrote to memory of 2672	1472	msedge.exe	90
PID 1472 wrote to memory of 1892	1472	msedge.exe	91
PID 1472 wrote to memory of 4140	1472	msedge.exe	89
PID 1472 wrote to memory of 4140	1472	msedge.exe	89
PID 1472 wrote to memory of 2672	1472	msedge.exe	90
PID 1472 wrote to memory of 2672	1472	msedge.exe	90
PID 1472 wrote to memory of 2108	1472	msedge.exe	92
PID 1472 wrote to memory of 1892	1472	msedge.exe	91
PID 1472 wrote to memory of 1892	1472	msedge.exe	91
PID 1472 wrote to memory of 2108	1472	msedge.exe	92
PID 1472 wrote to memory of 2108	1472	msedge.exe	92
PID 1472 wrote to memory of 72	1472	msedge.exe	93
PID 1472 wrote to memory of 2980	1472	msedge.exe	94
PID 1472 wrote to memory of 72	1472	msedge.exe	93
PID 1472 wrote to memory of 2980	1472	msedge.exe	94
PID 1472 wrote to memory of 1424	1472	msedge.exe	95
PID 1472 wrote to memory of 1424	1472	msedge.exe	95
PID 1472 wrote to memory of 1796	1472	msedge.exe	96
PID 1472 wrote to memory of 1796	1472	msedge.exe	96
PID 1472 wrote to memory of 1796	1472	msedge.exe	96
PID 1472 wrote to memory of 908	1472	msedge.exe	98
PID 1472 wrote to memory of 4500	1472	msedge.exe	99
PID 4500 wrote to memory of 2164	4500	msedge.exe	101
PID 1472 wrote to memory of 4480	1472	msedge.exe	102
PID 1472 wrote to memory of 4480	1472	msedge.exe	102
PID 1472 wrote to memory of 4480	1472	msedge.exe	102
PID 1472 wrote to memory of 1072	1472	msedge.exe	103
PID 1472 wrote to memory of 4136	1472	msedge.exe	106
PID 1472 wrote to memory of 2508	1472	msedge.exe	107
PID 1472 wrote to memory of 4824	1472	msedge.exe	108
PID 1472 wrote to memory of 4144	1472	msedge.exe	109
PID 1472 wrote to memory of 2780	1472	msedge.exe	110
PID 1472 wrote to memory of 2780	1472	msedge.exe	110
PID 1472 wrote to memory of 3792	1472	msedge.exe	112
PID 1472 wrote to memory of 3792	1472	msedge.exe	112
PID 1472 wrote to memory of 3792	1472	msedge.exe	112
PID 1472 wrote to memory of 908	1472	msedge.exe	114
PID 1472 wrote to memory of 2456	1472	msedge.exe	113
PID 1472 wrote to memory of 908	1472	msedge.exe	114
PID 1472 wrote to memory of 2456	1472	msedge.exe	113
PID 1472 wrote to memory of 2180	1472	msedge.exe	115
PID 2180 wrote to memory of 2500	2180	pro executor (1).exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.resusama.org/pro%20executor.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffad901c188,0x7ffad901c194,0x7ffad901c1a0
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5545300478970141082,17567721500003238895,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,6523033777844826203,8615486115094225282,262144 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,12781204179355975497,5663845816788441954,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,15396471607668382437,7094737211812466533,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,810920895572441474,16047076118370422522,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,3492403795684128443,14101917520322854929,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,8768178560077208889,6257572042629274355,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,12342426233132818084,1107718226258399177,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4396,i,17865903349010581277,16395957770896778324,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:9
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,1370150011986412514,3501131941610504279,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,5778479160036466258,6401859572290880663,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,12687030456335869541,8595862482096612344,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5920,i,325668320214996280,1316860234493712929,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,12411861630440774442,4836340260927242026,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,12411861630440774442,4836340260927242026,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4972454189560082060,15421097493597042458,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7000,i,9279561817782880169,3028758780681634313,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,16090158724020601836,15390819924517668725,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,13717547962560012542,8611956116349696338,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,5077017202368586213,6404654840020735269,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,17265794421413121927,4442061765424850501,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,13691909175530118631,9693388167405217321,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=1576 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2586516177822404344,8142310642169221197,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6160,i,4903269418336041963,7761116024131385825,2097152 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,2281775161507016842,2263392403213147013,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,4457246029223453792,14853688076332228874,524288 --field-trial-handle=2228,i,365786448524998652,12788187121296409571,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
  2⤵
  PID:908
- C:\Users\Admin\Downloads\pro executor (1).exe
  "C:\Users\Admin\Downloads\pro executor (1).exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Roaming\sgrK72pSU3I6LKab7aEYx4\bin\plus_1_computer_exterminator.exe
    "C:\Users\Admin\AppData\Roaming\sgrK72pSU3I6LKab7aEYx4\bin\plus_1_computer_exterminator.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4696

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260629-1650.dmp
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a073f6d335a6972e19c41cc8dc35b5fbf31ee9a7bec96032a9a403598f6a5ccb
MD5 8b89df85ba88d10f1b11bb979f3a97a6
SHA1 f4180bae23900a542332422db3dfd93551644810
SHA512 1ed832fd8891ec7d4307857adbbc55f2d8509a3dfe2d71b8b7f464c8ea7ab70e43385cacc8fa87d5fc10ce04ca30d7fc38fb3b9030a39187f882d1480b67a980
TLSH
T147D023A03D2DB4C1C23930F1E9210700B11882333216B123E5C0840C6C79CC103C75E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 742765db2bd75caedccf0003e719b71a9cec06647ab6a026dfc94f10a61d5ca4
MD5 0fbd3177eb442ff8855ebdfcc0b0fd26
SHA1 accb0f64f2681395016a8e0fcd238359dd5c505d
SHA512 d7371a93dd4cc47b129fb35be0565889e8a04d82a3fc4afc603293d279d0eefeb2b5b3156514a2b424c9914a579cdfd6b08bc59332981f39f9391e2117ffb785
TLSH
T1FC6180AD03336F85F35325F3B1DC0D84F57284791AB70DA612C258B6690EFA36E96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a9e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a9e7.TMP
Size 3KB
SHA256 7d703cbf1da831e6177f7599b6949ed02ab899120c2410e9c30e126006aa1860
MD5 f3ed01a390cdbb949d849864ecc9af92
SHA1 6cba7d83bf446a7b5c4b3c78c3c4eabdd796a438
SHA512 7ed31fff11fd6d37a7edfebe59e4e351d868939a89afc111517acb90e27d7b2f51e2182d396b0bf0abfe523dd7a644de1454bb690a7293c381553d2ac15a355b
TLSH
T140617FAD03336F85F35325F3B1DC0D84F57284791AB70EA612C208B6690EFA35D96238
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7be143ae04eebcc42665a7bf76576191e789761fae1eb8dd2fefe57fa127c64c
MD5 8235c502394464d0c5ae347443923d19
SHA1 d95e04c16b11936a322061faebf8f0407167f617
SHA512 f2f7b0beac56c4a265e13262c49e836eb34ac62235ebf36449dd2aac94552b01a8d2b0fc956ccf2ec9a739da1c5569c2f24c7735ccd29307329f3c7b7c93efea
SSDEEP 3:MsEllllkEthXllkl2zEit:/M/xT02zN
TLSH
T1BB4404057FC51D05CD011030C033D3500370D5114511D74335D114135CC75F00C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7185859244bf8adea2baa5089315ad2e831302aeb2d9f676cf4f5c879683ba54
MD5 142ffa8c982c2d3e0d407b6b30069cd1
SHA1 a19d131b688c11c00aa39ffc51a55534df034e74
SHA512 90206bc5d374c93eb43c4657358a53175f05c2382c2477742dc26209002aea143d0171a50ababf91385109647ac20a2dd074357815198198563adfc5b292b4c2
TLSH
T1BC218AB7C7D5866D8D0556F06A24AE2BCE1C0A15832C3D5AC9E4FF1B93E3075D10194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 021eed02aa0fb972ad6b4bcd3334014793bddff5aa768869e12768d99cdbf088
MD5 65975625d90796e0bd481e949d614e52
SHA1 27b8baf5b5c7405b33a873d241e150e188e34f38
SHA512 34b8f6ac41f0031f671080e024d9cbe236dc44c76a2285b072dc09b04d9f9ec001cc4423a6527fa0d676fe4c957710c23b952d3f998627ae3030b1972c28bbe5
TLSH
T1DE218AB7C7D5866D8D0556F06A24AE2BCE1C0A15832C3D5AC9E4FF1B93E3075D10194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c0d6ce5169adfa4ea9cd9518b5d906858e04c5b86033aff8469c0f237693a6d5
MD5 85502ce530d50342712b29cbe86ff147
SHA1 dba72339746f73e33c7291906454c7022561ff1f
SHA512 1f48b328c0a2b7c64004ae117613af5463988de2cbe86c95cc9aee4b372ac09b1eff2890d57c61033a615524da046f356144a0a4d19c1b3f8d5a72d2b6ec05f1
SSDEEP 192:sxZOCRSyM/jK1Ml8Joo/fbsYWpVTBU4IdpW/W6+WNGY05cyc24IIgbOJ:sxZOC8To/fbsYWvT6JW/bG5uKm
TLSH
T18F52D7126A345977CDDBD20DFA55BF53D6F91463A2900E44A9FCCA1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a54b0d74efecf74d053c25cfc05f4cac5c7c190e47f480bf21701c45f5aa32c7
MD5 dc058c09f1992f7a065b302398f480cd
SHA1 6dadacb37b45928ffa50ce0a5715249db83e8287
SHA512 180a43b3149b778321d5ccf67279ab94a505b091ca94c619e341a410e543f768b854cd0aa93dfffb1505ba8092e1c9f81e99b0ef999c7f12998847cf707b6212
SSDEEP 192:zZOyRSyM/jK1Ml8Moo/fbsABj4EdpM/W6+WNGY05Dpu+aIIgrJ:zZOy8Qo/fbsA9PM/bG5iM9
TLSH
T15042E9126B346977CCCBD209FA55BF53D6F9556392940E44A9FCDA0C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c015b1e036dfb6b31f90f44fd8afaa8a158c799694a521d34cef2b0a3f77cf1
MD5 d3bc09ae6026aeb1dce127d59eadcb55
SHA1 e2f006cfb593478b0f22db3306fdbf03597efb3a
SHA512 11460ae91e287c6aea31f85c532f250c2f0e7eb46e272d9ce82c3c3d42d557d8f1216ee511dab362f2fe4c49e18a8fc4ce666620990f73d6af7e10b163b26a88
SSDEEP 192:sxZOCRSyM/jK1Ml8Moo/fbsJBU4IdpM/W6+WNGY05nfY+aIIg5OJ:sxZOC8Qo/fbsJ6JM/bG5+Mo
TLSH
T1B952F7126B346977CCCBE209FA45BF93D6F9556392900E44A9FCCA0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ab75324811f2fa8ccb537e171caa819db11f74b6146d94ec8c8616442484bb82
MD5 328f9760acd9f7ce5833b357b739b13c
SHA1 18b4fe9c1baefc128e2f16990e10d77441dc2a6e
SHA512 db9ae16fa1a12a07cca16cdf5a295f4c5467ca636922ea79fe4232f42a88a249c4d98645d3bab0a0fbea7d7eba59717ddc4206327309a59bfa64c5f41c85f161
SSDEEP 192:sxZOyRSyM/jK1Ml8Moo/fbsJBj4EdpM/W6+WNGY05Dpu+aIIg5cJ:sxZOy8Qo/fbsJ9PM/bG5iMa
TLSH
T1BA42E7126B346977CCCBD209FA45BF93D6F9446392940E44A9FCDA0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 5beb044bdd24b2bc8ed6e1f24b0c1d63ef39b97084af2e85745d3d0321ccfa45
MD5 e82a65019dc00c81333219232c61ce54
SHA1 a86e83420ff2861608a0bf017cd416a7974ad6ca
SHA512 2e0473a207fef8770ec3d5e3c0e964f94aad1e6f3bd1820b6386a44ab7ea12d225145c0476aefe5a89999f6a485a157f17fcac120f8de8ae1d4b44855fa74ed6
SSDEEP 768:gXzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hb/ro0h:gXzXl8pZ221WRmsYQL0u1jaKu/Lpd8hD
TLSH
T190E21A3B244CCB7E4F844E9CEC266F966ED801CB66984D5447FA494C03C67DB522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 837c4fef5056abb227e39c47345ae74dbdf2e92205ac99de1e824b773d333a26
MD5 82f9886a46628b6ceb45f926c319b38b
SHA1 26941f3239c257ce06834a299c877ccfd3e64cf0
SHA512 08afabd11660a0c3561cd51d8738e139229f546dfccbe0cda3eabe40084dc7f5ebabcd14bb85e244cf2043e98aa514e0a7f16f16acb606b834035c9aac4bc739
SSDEEP 24:KdXRfXcXHXuaXLdXzXfXn4X3Xb+xf8nOardT/H4X7+eIjbHKiQhalH1ExXSmpMcV:KUGOIfKXK43yhgI3KlWclBI9K64wU
TLSH
T1A9911A1230BA17417DBD79198275DA1B098175E73069E83B3B7860B22E67E112EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 54d79e03cd1c9d190627a84ffc3bb5d7824e6bb3da0e7967f451c3a86c5e5ede
MD5 9716ffe6ff80a8e5f984ae437fb12b3e
SHA1 3ca29f8181598b992c21c9f93e4bd3a17fdfd1d6
SHA512 302f7e4e5759ba01454ac0fa306ff75e95d51bc9d2328b15b2593ecf92da6d360b72d9a004d7396e90a38f96c1bbbd16ea395f2e89634de93e9ae91e73e615d2
TLSH
T1C12167C0B3FA29447E8DAA46C32E940764E17E57114F5872631D90F46F85C240FAFE69
MD5 SHA1 SHA512 TLSH

Submit Download

bce933f7-4d94-44f8-a702-1257f01e4ac4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bce933f7-4d94-44f8-a702-1257f01e4ac4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0d505ce8ebd7217e3e0bd6c2176617ca95b34eae5be1701d0fb0869a94198cae
MD5 de09e700277d262218e7824d437d0a05
SHA1 fa0934a1e758a1d03e7562d56be9d6b787137cd0
SHA512 e3b765249046a136ae853f161be7f9b3cd8525aff3829f2596ad6c2e8b3d1c39a7ca4db6ff8b91f508ee3a07499f000c8803b313bb213c28aac096b3ec3f1269
SSDEEP 384:4iFPtNn/s3n9Sz8N28TUNTUlIlQa5ELoHZK/JDf4h2oeMmn15wbAjEJya:DFPj+9+Vwg50/xfRoeMmn12bfJya
TLSH
T1F2A26D339C989D3B6EA39E45F50A32179EB440B786D56EA4D6EC5F0C01DB2CC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e8fff16d9825eb46a65bdc351244fc24239f6f0a7ee6668cf1b1f72f16cf0a6c
MD5 a28306ea815c42bc385282c3db4dacbd
SHA1 cd10f545309b13e20c1c5c981a2705283336ac3e
SHA512 f7d67a22a7d709041fbb26d1b4baa2b5dcd3f4807e749df6fbd7333d8fb20323eafa5d495b3a554c73d0a0981bbfd5226a3472689429d5a4030762bf9e82f2ce
SSDEEP 384:4iF1tNn/s3n9SD8Nd8TUNTUlIlQa5EToHZK/JDf4h2dZMmn15wbAjEJya:DF1j+92owgx0/xfRdZMmn12bfJya
TLSH
T130A26C3398989D3B6E939E49F90A32179EB440B786D56EA4D6EC5E0C01EB1CC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 994213d605cc6fe7b73f2a4c0942c568ea8248c4107b389422bd30f6d8c15097
MD5 a68c5417b60bf50e3121f10a0a07a96e
SHA1 dc6b6d4bbd4845fa7240159fcd815a06eb209ee4
SHA512 78b7e056d6c7d1f6a06847f148b205414767cb21dc01cbac1d8b2f56a93e7db7fc27054b918e8e3e3c403e6a21f9ca9b91c0450d6d32ee5cc64384e62db84554
SSDEEP 768:DFwj+9iUwgC0/xfRkeYNeTV3mn12bfJya:J9iLxiV30yJya
TLSH
T124D25B3E9C548C3F499EBB48B64E26279D74417BC6B559A8E3E80B0CC1BB18CF306D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8fbabcf50860039c1153b18edfcaeb9cde88973d23602566746b215d2ff272f4
MD5 d83d0174b7e55ef33c92302d945945d7
SHA1 248600bfdac25a5fdee6d217c929cec607af9790
SHA512 e1f571ad11d7d5c45e674d805911d810e7e11770d8e97f51bcfe098b5999392f1a72b430819459b9601335eba9540f122776c44679a0f260da6783c3c3508c57
SSDEEP 384:1tNn/s3n9Sf8NcUQa5EToHZK/JDf4h2ztMmn15wbAjEJya:1j+9UM0/xfRztMmn12bfJya
TLSH
T1E1928D32A8685C3B1ED3A949F507361BAEB4807793D51E94C9FC5F0D02EF298131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ba06b48116e9b8e76961bc251c5c59e2022c4e0b1b48e53d4e25842c49370db
MD5 9fe67347ef4cbb10ab04d210fb2da81e
SHA1 a40641210b4475970f0bf44e6d5734f8e72d4b65
SHA512 b71990f0c5d7bdb455260e81900a6e858574b2cb1dffa00072f83f1f144b8694349a68a6935e18fbc3bc60eb6b3d3eddb4f2d7cc6c9349b982747d4f4179286a
SSDEEP 192:FGNm6fNmQmiUyPS+bL/GPT2AXRQf4h1EkV3ZGqYU6:FGNm61C0PbL/JDf4h2kLMU6
TLSH
T189121A31A8A8AC7B4ED2A955F4433617AE605127DBC96F85D6FC3B0C02EF59C5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ccbb81c6920835b66dd8f0908d3bd9951e02a37b93df7c15855ef9036187f7ba
MD5 24bf27917fc668ee435cf2106b4f3d11
SHA1 5b2d961dfe92067358c638aeaf10038a1abccb12
SHA512 6d42f6d3b219eb8f3d4b7674ec00adbba0d53d288f4febf80b9048f0d650f0c184b0fcbdfcbc8e42d472339c5416c88a0f43afcfa831cae1e7c02938d929c9f8
SSDEEP 192:uZL8NcU3QBDuCb/NEQclQmiU1Sf124K/GPT2AXRQf4h1EzVsAGqYCY0WC:S8NcU3a5ETo9ZK/JDf4h2ztMjk
TLSH
T130422932A8B8AC7B5E93A955F4073A13AE74506787D51F94DAEC6F0C02DF19C5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 581a84f78cbab8ab85f1c07bf65bd209962c363f5934039d6a4c83a2d999a82e
MD5 b9e8d03afd35dc683333033207bc5898
SHA1 9226ad76c15591418ab69b55ba36f0e174869da0
SHA512 cdbfbb625a5789a8c2fe57112b178bb866c5f490426bc6143f3703cec1d4478fbac2ef531853242bf535ae69225927713f7d6145c6154f46fcf7af9462b07dce
SSDEEP 192:7GNd6fNNQmiUygzH+PL/GPT2AXRQfMV7qVFU6:7GNd61LjzePL/JDfMUvU6
TLSH
T1A5020A35ACA86C7F8EE2AE19F5477B175FA4106B9AD51F84D6E82F0C00D759C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

449587ae-acaf-4492-9782-ff1f3bc3089f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\449587ae-acaf-4492-9782-ff1f3bc3089f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

pro executor.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\pro executor.exe:Zone.Identifier
Size 79B
SHA256 bf55fb3c377067cd44a0181acef36ebe8cf8f36186a15d5c0fe88f0e14fa353f
MD5 2c374053de727766fedbd6acd566dbca
SHA1 2938e7348488afaf73ec48951b6ef9a08ca6e9c2
SHA512 56a68391e3aa7b5bd186bc9d1ffa39ddff665cfd14cbfc0fb573d829470b034b21b618d72d2a3caaddc697ff0c2f48fe57521359c3a2a8bf102ce3d93ff86f0e
TLSH
T196A0124F850448000205309461CA409E500F60404A490240EC441093B48004C0255706
MD5 SHA1 SHA512 TLSH

Submit Download