6438eb7eb364670ace3c81413460bbd7939a64430d846979964c836105b6f16e

Analysis

user interaction
yes
max time kernel
298s
max time network
248s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
20/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
=?UTF-8?Q?Gmail_=2D_PEDIDO=5F_Nova_correspond=C3=AAncia=2E_Precisamos_da_sua_r?= =?UTF-8?Q?esposta_=.pdf
Size 148KB
Sample260720-plvgxsct7w
SHA256 6438eb7eb364670ace3c81413460bbd7939a64430d846979964c836105b6f16e
MD5 be5f30c027b5468fa3b247e9175f0030
SHA1 a619b01390061ee251b125b6f7ac5a955c070963
SHA512 11f0b33bbe0bb156c390063a29cdf9809764676f5a6833dd28b900c323b51758882558ffea69c26fc4a1885333b79b97905e920a2198ef4611cc1158164849b8
SSDEEP 3072:ogLiXMEbJvGorK+sFzHoVdptMowJZ0pz4apyFx6frMhCdN6e:oL8EJvlJkHy/wJWpsZ6WCf
TLSH
T194E3BF68B84E8C8CFC8AC24DCB3D395D5E5CB12B7ADC388511390B21F146B95BB5629F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5248	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290239684859346"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{6763E51D-2D0D-4DF3-9FFA-E8B89E7A618D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5104	AcroRd32.exe
3024	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe
5104	AcroRd32.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4272	5104	AcroRd32.exe	79
PID 4272 wrote to memory of 2168	4272	RdrCEF.exe	80
PID 4272 wrote to memory of 5052	4272	RdrCEF.exe	81
PID 4272 wrote to memory of 5052	4272	RdrCEF.exe	81
PID 4272 wrote to memory of 2472	4272	RdrCEF.exe	82
PID 4272 wrote to memory of 3060	4272	RdrCEF.exe	83
PID 4272 wrote to memory of 3060	4272	RdrCEF.exe	83
PID 4272 wrote to memory of 3632	4272	RdrCEF.exe	84
PID 4272 wrote to memory of 1512	4272	RdrCEF.exe	85
PID 5104 wrote to memory of 3024	5104	AcroRd32.exe	86
PID 3024 wrote to memory of 3676	3024	msedge.exe	87
PID 3024 wrote to memory of 5248	3024	msedge.exe	88
PID 3024 wrote to memory of 3276	3024	msedge.exe	89
PID 3024 wrote to memory of 3276	3024	msedge.exe	89
PID 3024 wrote to memory of 3276	3024	msedge.exe	89
PID 3024 wrote to memory of 2348	3024	msedge.exe	90
PID 3024 wrote to memory of 2348	3024	msedge.exe	90
PID 3024 wrote to memory of 3192	3024	msedge.exe	91
PID 3024 wrote to memory of 2196	3024	msedge.exe	92
PID 3024 wrote to memory of 3192	3024	msedge.exe	91
PID 3024 wrote to memory of 3192	3024	msedge.exe	91
PID 3024 wrote to memory of 2196	3024	msedge.exe	92
PID 3024 wrote to memory of 2196	3024	msedge.exe	92
PID 3024 wrote to memory of 5424	3024	msedge.exe	95
PID 3024 wrote to memory of 1612	3024	msedge.exe	96
PID 3024 wrote to memory of 5424	3024	msedge.exe	95
PID 3024 wrote to memory of 1612	3024	msedge.exe	96
PID 3024 wrote to memory of 248	3024	msedge.exe	98
PID 3024 wrote to memory of 3788	3024	msedge.exe	99
PID 3788 wrote to memory of 5060	3788	msedge.exe	100
PID 3024 wrote to memory of 2500	3024	msedge.exe	103
PID 3024 wrote to memory of 2500	3024	msedge.exe	103
PID 3024 wrote to memory of 2500	3024	msedge.exe	103
PID 3024 wrote to memory of 824	3024	msedge.exe	104
PID 3024 wrote to memory of 824	3024	msedge.exe	104
PID 3024 wrote to memory of 824	3024	msedge.exe	104
PID 3024 wrote to memory of 3924	3024	msedge.exe	105
PID 3024 wrote to memory of 1940	3024	msedge.exe	106
PID 3024 wrote to memory of 2436	3024	msedge.exe	107
PID 3024 wrote to memory of 4728	3024	msedge.exe	108
PID 3024 wrote to memory of 4728	3024	msedge.exe	108
PID 3024 wrote to memory of 4728	3024	msedge.exe	108
PID 3024 wrote to memory of 4600	3024	msedge.exe	109
PID 3024 wrote to memory of 4600	3024	msedge.exe	109
PID 3024 wrote to memory of 6128	3024	msedge.exe	111
PID 3024 wrote to memory of 6128	3024	msedge.exe	111
PID 3024 wrote to memory of 6128	3024	msedge.exe	111
PID 3024 wrote to memory of 5088	3024	msedge.exe	112
PID 3024 wrote to memory of 3484	3024	msedge.exe	113
PID 3024 wrote to memory of 3484	3024	msedge.exe	113
PID 3024 wrote to memory of 4820	3024	msedge.exe	114
PID 3024 wrote to memory of 4820	3024	msedge.exe	114
PID 3024 wrote to memory of 4820	3024	msedge.exe	114

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\=_UTF-8_Q_Gmail_=2D_PEDIDO=5F_Nova_correspond=C3=AAncia=2E_Precisamos_da_sua_r_= =_UTF-8_Q_esposta_=.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A5C8302CA9C1842B336A73A437A8391 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=52CECF294313745CFE5A2D9E385580A2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=52CECF294313745CFE5A2D9E385580A2 --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3FF3E14B21EC3A368CC8D6E195AE3424 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F3F4BD311D9F07CE306E08799CE6E2EF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F3F4BD311D9F07CE306E08799CE6E2EF --renderer-client-id=5 --mojo-platform-channel-handle=1976 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52DAA7465747F503EC0A64BB7B150A23 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F68F08B8E5B4B0C6533AA54185CBD95B --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mail.google.com/mail/u/0/?ui=2&ik=7d598b0946&view=att&th=19f45e9fb51dcb3c&attid=0.1&disp=attd&safe=1&zw
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffb9beac188,0x7ffb9beac194,0x7ffb9beac1a0
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1816,i,7645268852769483963,10845727427055615446,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,9578177214558728260,16063395672860468658,262144 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2152,i,13450632375201307585,16223015958206142787,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6022726996081156628,11604278305580836080,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13423114316536793523,10964348047868809693,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4980,i,9682085656443892639,3635559427095774039,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4996,i,8057382930070064045,6268063392500041224,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5868,i,12252280580929377938,5523910939471298316,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5868,i,12252280580929377938,5523910939471298316,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5952,i,9692811117079740479,8407517518589980318,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5992,i,7929105539497216185,480093935150262329,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3744,i,16382894305250794863,94807783413535961,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6492,i,7885317546399721036,8499448013763920723,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6500,i,17455599193788947836,10982099735040151233,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6496,i,2119799662213806360,1671334990469415618,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5996,i,18215286015204829701,3884615357584923143,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5308,i,14072471328338689383,9806485436422108121,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=900,i,4613641489140141530,9904232927551953133,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3564,i,7533056439017200130,10982951230586915825,262144 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6168,i,14073040941524900186,11448013725218456494,524288 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2308,i,15270545336924883835,3913237430135619227,2097152 --field-trial-handle=2576,i,4356357926181052588,12822265299724645068,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 32303cc60a61c54695a10e22e5d4927afa9f3b317f38a1948b3d06b9908ad31c
MD5 fa1d2c7d03afb864bc0f0aeb5e1cf53a
SHA1 4193d63e49c8c734df72c75bc3bc68ccfb747550
SHA512 18e675c077e47d9f348de8d1e8289d3e14124bc45c1080067ad25b834aba4faa30eb3894a3408fff992d86eea6faa72110686428608635b48f56f06f7836bca8
TLSH
T12FD012273B0DA054E7A9C2729613C7921BB6646174434B05E315C95CA9B44E412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 332B
SHA256 2761deb04cd43ed9404e7142cfda35f15b99c0356824d06c08f5fafd7b1da061
MD5 a890378ddc99b209585997626a4ded17
SHA1 f2c2090aff1dc1a262615911ecaaeb17b39b925b
SHA512 fe2f81ae5185edbef9cc2b9666bcef19361f0fb4dda3ae21088b4799d33bc68fa30ae7d88443fd03a0a04d423f9f22ad377a37c83594dea616032525e6d26e36
TLSH
T1AEE026D944C8C25FE644E84F82AD570C8290360AE3C87D8E170D8895B1C1941A3B65A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d185f2f436b0aa222e9d7f64b18af4a7d7561d10e236ebcf91e295b544fcbb5
MD5 9217d0a9fd7b9770f1b835bd7a67f4fe
SHA1 6b46448ee6b565287d3aaa01b197c721c738632d
SHA512 875be00052322c047d6b3f1d39d11440c8810906676b276b4d614f140fbe94ee8be5482546e17b70edef53ba995a15dde346529df8465078a064e2df7528be91
TLSH
T133E0E5AAC861A93B08FE1B1850606746EB4423976B814A1B3A3CC10C8FB463A468589C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53a4070aef0df27909e8484ecda8fee56da81355fd0718fafb7b52f5b626db00
MD5 714b10344e6b56a715edb98ad7780ed9
SHA1 97cd962e694ba08feb0c86bb4c8ceb5f69f6ac4c
SHA512 5aedd8d0328bae025f838e235edcc6987b9c36fff339186b16b572cc181fba44471150498de2fbdb30bb2c9e79d11e4d534bf5790cbb631cb553e709f1296ffd
TLSH
T16D418FF783B4856E8A1195F0AB14AF1FCF2D0514432C7DAA89E4AE27D3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 65bef58e6df2c904f12130d1a9f8a381f1f8385df98770d277cc5d3ad6dae904
MD5 3a016526234b0bc4d21e3fabbfee4f6d
SHA1 a6f2e7b4c5c79ba29241e1ac406427d08f31ce82
SHA512 41d974df82581526b5cc549587e664839df56380b462a55e61cf5a7ac5ed0c3e5fdaee00c517f8cb8166e5873b1cc92b9886c86e4ed0d4b9b2ce5419a13b2ec0
SSDEEP 192:sxZtRJywFXNKOMl8UQscF/fUsOiuKTG5GN2ywzzodpaIN/W6+WNGY0hKnBT8Ig5y:sxZtwqrF/fUsOiuUei2SX/bG52scBx
TLSH
T1D772D806AA6459779CDBD319FA557B53D6F91532A1504E48AAFCCF0C04EA6EC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d38ac83802ac0f649fea8e07d9e52a3e36268d4be2d45ee18b59452f98385c43
MD5 391420d82d81366e39ae34882baa7d30
SHA1 107dfeb1c984337d2273905f90a3a587f8f74988
SHA512 1263130b322d9eeb770f8458f0f4d6abcc8c7c82105fd52a44921f6e82d39e54e59fe84c7dbcc3167339637149dd771be7ba023e5a56c14f0f2c50222c02a9e7
SSDEEP 192:sxZtRJywFXNKOMl8McF/fUsKiyKTG5GN2TwzzodpaC/W6+WNGY0hbyUT8Igj+9RJ:sxZtw0F/fUsKiyUei2h3/bG5Bsj+9b
TLSH
T15C62D8166A64597B8CDBD319FA55BB53D6F91533A1504E48AAFCCB0C04EA6EC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c3231c2e7a16df18f915f868ef684d838bf316e40145b17a88ccbd839a06e4e1
MD5 a09ed37a2b5fc58a99f58400f2070cb6
SHA1 88489d5f44ef97223e46254118eaf668b9126e05
SHA512 0478a3262fc572a47328e5084c16c6eb8267ab18fa5112d8464483a0644258bc2cd679145d6d842af496460ec2ce03e90fd37531f9f52c4853436e92bd6ccc8a
SSDEEP 768:wQAKq8y02yS7pLILZjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Bzx4Llr:wQAKq8y02yq2ZjbWRmj1QWTu1jaKBzxg
TLSH
T13C03FA3B680CCB7E4FC04E9CED266E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 5edad9c17739c5888e76b3367ed3bfe4dbbc599720d69cb3e1249c128ee693bb
MD5 93cb687751f2c280c1704c684e6d85d1
SHA1 63f1be2079ca190e1674be8606e6ceeb4e8a8cdf
SHA512 262cef2ef997db4d4e0c823e391b2fd1d503f89b2ca42f0f1dc2f6fef07e93182be43993090a96c46876b6067ac60d9f8570b8b1cc7d0687574474449d3f2348
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5k:GZLVDJjEDPV0//Bm3Rrb
TLSH
T171B29C0232BB02423C7E390C9696CB674A42F1633459ED7B7BA940B54E6BE115DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4451a9595f31f2166275d8aa357201f204a6cfbf344f377490c4638c0873060d
MD5 723c6dc28505903f00e3b6bc6a003eaa
SHA1 8b466aa16143e5d9d5f104d5c0be34a6f4a5775b
SHA512 57236a1f4fb8c5c1423a96a739f2e4fcbad98979826b7cb26dec75a024c4006e2958eefcc66db6479ce49e27c50609266403808a60de29ee42d180af4c764a04
SSDEEP 768:dFccps3AXwgPKekmy1xGyORadio9UI8p0R:Js3AHk+adi6UI8p0R
TLSH
T1A1C25B35E8A8C9FBECEB4F99B70A7A17DED01167869C4AE4DAD80D1D00971DD170B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7cd345398a2b166fa1a5f850c53357435a91fc97b75fd9a9e317304f92e642f0
MD5 9c140cb658de97c631aba6bbce2b894f
SHA1 85ac303a9e187596317e68ea35c37976e80bc4dc
SHA512 f4ce1ccdb8cc253461a2a4de96fa67ae2d7cbdd644a64ddce19bce09eed36601e38a0c579844c6f1392e9285a2507e1884262bc75647fb0c3c31457bbdb0199c
SSDEEP 384:n/iF9CcmyWCd38NLX8TUNTUlIR0Pm3ek32nn9NYj4zpfbLGyzqLth0TxS73Z9UQX:KFccpd3QXwguKekmMmxGyORadip9UY
TLSH
T1E9C23B36ECA8C9FBD9EB4F89B70A7A13DEE01163C68C5AD4DAD90D1C009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a95650df8b437873b1b8dbef28b9e170fefd84bb1306d2e9a04a36f89a05330b
MD5 b38fd86c77d56b6461bc0d9c93f2818b
SHA1 403b0186f9c024020730821355c7aaa6d1d6dd2b
SHA512 6097883e1a9970cc370c9b322870929909b52d26769cfaa142470d06610c2c41843a423217390c03bb48a4d344ab4a8714e25f195f29fc2e88a99aca03e670c6
SSDEEP 768:PFccps3AUwgPKekmDdBxGyORadiP9TI8p0R:Xs3AWkkGadi1TI8p0R
TLSH
T1D0C25B36EC68CAFBECEB4F99B70A7A17DED05167858C5AE4DAD80D1C009719D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5d42d448177e6f54993e365dad55a7ec672e04068f360a053a2a8258fdbdc7a5
MD5 a3939236a4ed6f9d09106164f69f8109
SHA1 4b645e947c093b2d96ddcea7273dfc49d741444c
SHA512 fb6298a413523434b271337ae072d17952f4f575efb94da1bfcb3e4ad8326127bdf41fe64bad823c945eac440e0276a83d8f669c9bf8a43637e229832c708672
SSDEEP 768:EF8j+9P3QXwgGKekmvmxGyORadiy9U29Mo:m9P3QokGadi0U2+o
TLSH
T143D24B3AE865CAEBDDEB4F99B34A7A17DEE01167C68C1AC8DAD84D0C009759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 84a26c64e2b768ce1658633a3d9176bd5846505c16283a298067f50460141044
MD5 5204ae66d8830ae5427b6ab5291ec443
SHA1 f68f368a9895a0bd34856e66aed3f076eab08053
SHA512 d264f91b1e1769f462f1d23e2c98a61efa0a637e639c3596c8f85d294c4cf7cb3c2fecb59200d84c6e86fa2b1059980dd61272ca3049efbf1a0face7b3ea6540
SSDEEP 384:n/iFmCcmyWCy38NLX8TUNTUlIRIPm3ek32nn9GYj4zpfbLGyzqLth0TxS73Z9UQX:KFlcpy3QXwguKekmvmxGyORadip9UY
TLSH
T1BFC23B36ECA9C9FBD8EB4F89B70A7A13DEE01167C68C5AD4DAD90D1C009719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f5c051b096f977acf2cc69f6d1fde158256e8d5b19e72d30b82af063fe0d1a80
MD5 509e44c8b62a8841da1f771c518181b5
SHA1 db89b9b284c917ae3e05a08d6aa3453ca906e2b3
SHA512 337e1fc6559d2a8e71e5812e0e76d095acd94477b69fdd76161a767380c2784b7c8ba35d0bcf543f3982b411a968f65422bcfd91bc536028448277e1d0c56f22
SSDEEP 768:IFlcpy3QXwgfKekmvmxGyORadip9U29Mt:Ly3QvkGadivU2+t
TLSH
T1C0D25C35EC68CAFBE8EB4F99B34A7A17DEE01167C69C4AD4DAD94D0C01970DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-187-0x0000012D80000000-0x0000012D81000000-memory.dmp

Download