Overview

overview

4

Static

static

3

Saginaw Ho...n..pdf

windows10-2004-x64

4

Saginaw Ho...n..pdf

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 03:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Saginaw Housing Commission..pdf
  • Size 300KB
  • Sample260730-dsqa1aycja
  • SHA256 c4abb70126f9971f263e360453f8a1aa0962ef1e8cf91c58a70255404df8ce22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
adwarediscoveryspyware

Malware Config

Signatures

  • Drops file in Program Files directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Saginaw Housing Commission..pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BD26F8C1B67B59347BA2F76A915457D1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3868
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8DACC1FBC516E1ABBB0622840D7837DF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8DACC1FBC516E1ABBB0622840D7837DF --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5072
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF1C32496C57F1EF2A4133BB234C81F7 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1592
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BCB6B530E29EB260F7CC45060FD1CFCD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BCB6B530E29EB260F7CC45060FD1CFCD --renderer-client-id=5 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:1
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2636
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1377C0AB4EDA080CDB7AAECD587754A0 --mojo-platform-channel-handle=2888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2776
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AF90A6A85DC1EB66D0F5DF4219E8A02A --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2200
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://saginawhousing-my.sharepoint.com/:o:/g/personal/finance_saginawhousing_org/IgDieRUmmanaR4IgQa65soJXAeuwSyzye4Jsrv7YQoEobU8?e=08FBXu
      2⤵
      • Drops file in Program Files directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x314,0x7ffd330ac188,0x7ffd330ac194,0x7ffd330ac1a0
        3⤵
          PID:652
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11316126701109605066,7680438646144320089,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
          3⤵
          • System Time Discovery
          PID:3260
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,18145904988130050151,10205882137232194155,262144 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
          3⤵
            PID:4224
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,5008509234796998075,13755649423549448268,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
            3⤵
              PID:4276
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,10855009945988278856,825771505178634216,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
              3⤵
                PID:4592
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,13113701354746903131,5081930858219612075,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                3⤵
                  PID:1592
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,9165885329103245259,210795227605531708,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
                  3⤵
                    PID:4080
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,13774626934596544889,4442902526726640888,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
                    3⤵
                      PID:212
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,12955912874079777711,13359163196208389613,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
                      3⤵
                        PID:4040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13981729662876179120,2148873152535007784,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
                        3⤵
                          PID:4932
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,6924178053315322781,9633186968111158878,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
                          3⤵
                            PID:2076
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,159187722696328905,16736976775324592114,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
                            3⤵
                              PID:2008
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13727681298165033326,15996831265285225547,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
                              3⤵
                                PID:3676
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13727681298165033326,15996831265285225547,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
                                3⤵
                                  PID:4356
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14216574422591358804,7712276643655182138,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
                                  3⤵
                                    PID:4820
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,8810077192805486041,12347131392422606566,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
                                    3⤵
                                      PID:1748
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,711279152945509214,8152901167093045615,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
                                      3⤵
                                        PID:2604
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,2721319845687664163,610888984746491628,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
                                        3⤵
                                          PID:4820
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9221164486971605259,775168062770528055,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                          3⤵
                                            PID:5496
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3648,i,694180521425413660,1815017717886567349,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
                                            3⤵
                                              PID:3376
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3704,i,7222292159986698436,11150843344174477626,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
                                              3⤵
                                                PID:5704
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4384,i,10893480446986137288,4111180328339509283,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
                                                3⤵
                                                  PID:1748
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,17827013622314206879,16441699166315929514,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
                                                  3⤵
                                                    PID:1232
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6320445036394838531,7699864259397428409,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
                                                    3⤵
                                                      PID:4356
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,17277971341770475219,18036736136521230878,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
                                                      3⤵
                                                        PID:5176
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5116,i,7435574278406134757,13127415963009821644,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
                                                        3⤵
                                                          PID:5860
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6836,i,15899039354859611501,1916449787634003,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                          3⤵
                                                            PID:5936
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6772,i,8924293158811636423,6393216050408720575,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
                                                            3⤵
                                                              PID:6064
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6688,i,2626209132343649641,6571059600268847576,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
                                                              3⤵
                                                                PID:2604
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4344,i,3930897895590580791,7920058636848298553,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
                                                                3⤵
                                                                  PID:5128
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,16974831930703442303,2289689381258413709,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
                                                                  3⤵
                                                                    PID:3924
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,10326613873061236252,7697443729351550222,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
                                                                    3⤵
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3620
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7920,i,7738948715460206535,15511825458552126608,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:8
                                                                    3⤵
                                                                      PID:4348
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,16569355786175103848,5901905944246263492,524288 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
                                                                      3⤵
                                                                        PID:3920
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5480,i,473859101195680971,8996575334127579113,2097152 --field-trial-handle=2296,i,6826819557555374285,3572842202983431834,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
                                                                        3⤵
                                                                          PID:4836
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                      1⤵
                                                                        PID:1456

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            manifest.json
                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4448_1580293917\manifest.json
                                                                            • Size 135B
                                                                            • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            manifest.json
                                                                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4448_1766868405\manifest.json
                                                                            • Size 43B
                                                                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            ReaderMessages
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                            • Size 36KB
                                                                            • SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ReaderMessages
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                            • Size 56KB
                                                                            • SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ReaderMessages
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                            • Size 64KB
                                                                            • SHA256 ebffdfacc4eef92bdd197e2cd949780027da93756bd3a2d34b567762a5225988
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            blocklist
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                            • Size 105KB
                                                                            • SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            protocols.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                            • Size 3KB
                                                                            • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CrashpadMetrics-active.pma
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
                                                                            • Size 16KB
                                                                            • SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            BookmarkMergedSurfaceOrdering
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 3KB
                                                                            • SHA256 1e5e6b73e2f845537933e2a8118eb0b8a3148d30e1ceca89e8aa316ede2f9123
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 5KB
                                                                            • SHA256 80ad28fed9feafab0086673aafbc8a33e13d64e1a3753bf5cb6566fa7e315530
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            SiteList-Enterprise.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                            • Size 2B
                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Edge Profile.ico
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                            • Size 70KB
                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 9KB
                                                                            • SHA256 545846961f165aa56831de2a8b5051cddc817519feda0ddd1802a97af927c344
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 111B
                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            SCT Auditing Pending Reports
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 c441468bdbec9fd80c965caf152ba7127bba3d61c5cf18683188cd2892ec2e2e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 14KB
                                                                            • SHA256 cf02843a437a37f27edcd5266f6bc0a466f2a96ee84e6058a9e7951f56dc8c5d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 13KB
                                                                            • SHA256 796ce415cf39b3e65823f808ffcb448bfdfb904cb91294720b3418cb82fd8c67
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Secure Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                            • Size 35KB
                                                                            • SHA256 e851d1987e98e03eb903b1afbc6156be057d8c8a41499aaf438f0037856a1033
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            sync_diagnostic.log
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                            • Size 5KB
                                                                            • SHA256 95958aba8128d1bd430ceb635cd4827073c301f8199ecdad8f33a1c41b5d3366
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            CURRENT
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
                                                                            • Size 16B
                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            OperationConfig
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                            • Size 22KB
                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            OperationConfig~RFe598514.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598514.TMP
                                                                            • Size 3KB
                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 16KB
                                                                            • SHA256 a8066433874c68ec079b7e48dd3ecc648d316e1e08b05e10458757d59282cdc4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 30KB
                                                                            • SHA256 7b1cde1644b5089ff2788aa07d457baf4aa898a1e341779297a520f56d2ecd91
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 30KB
                                                                            • SHA256 b8fee56a6662437e77b3bf7e3df0b161815b9d38a8b6b956e0386291e0acc948
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 30KB
                                                                            • SHA256 3cc67f95120d40239bda72f098cad859b3e8fbc31264184b138fc27c39f01f76
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 8KB
                                                                            • SHA256 f6680ca0796d43bf021788ef1f78e78ccd53791c6e2d9a78e9466a309b857e8e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 20KB
                                                                            • SHA256 50f6744272b4ee9dca0b21f9303bcdc28f08a8aebf9dda6b0ce5fa79589e91e5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 8KB
                                                                            • SHA256 8befc2354b1739060ac248e210058f614d2aaa67b9aff36efa69cb673612c9d5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            RevisitationBloomfilter
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                            • Size 392B
                                                                            • SHA256 82dfe81d1b84741b0cacb69b32a994895d544f478b3758523ffe1b0c0233e0a6
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            RevisitationBloomfilter
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                            • Size 392B
                                                                            • SHA256 8c2ee157f9cd5f82aa86cc61378a307125edc78d81b6fff7126364f4e4a7d24f
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            RevisitationBloomfilter~RFe596edd.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596edd.TMP
                                                                            • Size 392B
                                                                            • SHA256 79b1f6fff61ec1893c9455710d199288228b359146356ea50703d3b1cf075262
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                            • Size 252B
                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                            • Size 132B
                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            c7da7336-d981-4635-9439-c3ae65dca4db.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7da7336-d981-4635-9439-c3ae65dca4db.tmp
                                                                            • Size 13B
                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                            • Size 2KB
                                                                            • SHA256 272313c8dbdf7467dc7828f371ee0084f1c054b75dfd1049f6790bf5025487c7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            608b8e46-bc2a-4ba7-a670-cb7593eec910.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\608b8e46-bc2a-4ba7-a670-cb7593eec910.tmp
                                                                            • Size 1B
                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            9bf9f406-045d-4ff5-931d-7831566ba46f.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\9bf9f406-045d-4ff5-931d-7831566ba46f.tmp
                                                                            • Size 10KB
                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            daafcf1e-5bc5-4796-b1e5-741a5050f9cf.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_1414601270\daafcf1e-5bc5-4796-b1e5-741a5050f9cf.tmp
                                                                            • Size 153KB
                                                                            • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            content_new.js
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_209025842\CRX_INSTALL\content_new.js
                                                                            • Size 10KB
                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download