3a91ffbbfac1b97c883e88f43f07fc2a14fb1bfc1903c26b12009a4244421cd3

Analysis

user interaction
yes
max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Limpeza e Higienização de Reservatórios de Água_322_06-11-26.pdf
Size 453KB
Sample260804-rndcjasepa
SHA256 3a91ffbbfac1b97c883e88f43f07fc2a14fb1bfc1903c26b12009a4244421cd3
MD5 bbfb36df517471337fa7828e662529be
SHA1 1274fb20723e9901b02d2157d512c2987a7e7d17
SHA512 7011518d4bcd3322b037bae4372920c5bb31773cb8a499d659ec37334ae2a3f437e1de82529a037dd4ca4dae549ac9762887cd10a8c086a4751ba0a196bbc41c
SSDEEP 6144:TeGI23jcg2PzLGNuesqWGUU/DLdB8YBWZYdGXvoLDE6FfsoXj50Gu0u6wwTEvQqX:x3a7gu3LGNLdB7BWZBUDLT5zuLvvrkU
TLSH
T1C3A4121FCCA6F2DC5BF90BCB2E5B6076E6AA760248B423F175F80B065A60DC55D9D02C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2436	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{0998FCD1-98CB-4EBF-A347-C3FCAF53AA68}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3352	AcroRd32.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe
3352	AcroRd32.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4944	3352	AcroRd32.exe	90
PID 4944 wrote to memory of 1944	4944	RdrCEF.exe	91
PID 4944 wrote to memory of 4260	4944	RdrCEF.exe	92
PID 4944 wrote to memory of 4260	4944	RdrCEF.exe	92
PID 4944 wrote to memory of 816	4944	RdrCEF.exe	93
PID 4944 wrote to memory of 3356	4944	RdrCEF.exe	94
PID 4944 wrote to memory of 3356	4944	RdrCEF.exe	94
PID 4944 wrote to memory of 4728	4944	RdrCEF.exe	97
PID 4944 wrote to memory of 3104	4944	RdrCEF.exe	98
PID 3352 wrote to memory of 1780	3352	AcroRd32.exe	103
PID 1780 wrote to memory of 1288	1780	msedge.exe	104
PID 1780 wrote to memory of 2436	1780	msedge.exe	105
PID 1780 wrote to memory of 1860	1780	msedge.exe	106
PID 1780 wrote to memory of 1860	1780	msedge.exe	106
PID 1780 wrote to memory of 1860	1780	msedge.exe	106
PID 1780 wrote to memory of 2408	1780	msedge.exe	107
PID 1780 wrote to memory of 2408	1780	msedge.exe	107
PID 1780 wrote to memory of 4916	1780	msedge.exe	108
PID 1780 wrote to memory of 4888	1780	msedge.exe	109
PID 1780 wrote to memory of 4916	1780	msedge.exe	108
PID 1780 wrote to memory of 4916	1780	msedge.exe	108
PID 1780 wrote to memory of 4888	1780	msedge.exe	109
PID 1780 wrote to memory of 4888	1780	msedge.exe	109
PID 1780 wrote to memory of 4796	1780	msedge.exe	111
PID 1780 wrote to memory of 560	1780	msedge.exe	112
PID 1780 wrote to memory of 4796	1780	msedge.exe	111
PID 1780 wrote to memory of 4796	1780	msedge.exe	111
PID 1780 wrote to memory of 560	1780	msedge.exe	112
PID 1780 wrote to memory of 560	1780	msedge.exe	112
PID 1780 wrote to memory of 4780	1780	msedge.exe	116
PID 1780 wrote to memory of 4780	1780	msedge.exe	116
PID 1780 wrote to memory of 4464	1780	msedge.exe	117
PID 1780 wrote to memory of 4464	1780	msedge.exe	117
PID 1780 wrote to memory of 4464	1780	msedge.exe	117
PID 1780 wrote to memory of 1432	1780	msedge.exe	118
PID 1780 wrote to memory of 1432	1780	msedge.exe	118
PID 1780 wrote to memory of 5376	1780	msedge.exe	120
PID 1780 wrote to memory of 5384	1780	msedge.exe	121
PID 1780 wrote to memory of 5376	1780	msedge.exe	120
PID 1780 wrote to memory of 5384	1780	msedge.exe	121
PID 1780 wrote to memory of 5760	1780	msedge.exe	123

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Limpeza e Higienização de Reservatórios de Água_322_06-11-26.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7F9B93F0DBA2047AE536D23F35B518F5 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F07CAFE21B2826F3D137E1ACD5D05304 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F07CAFE21B2826F3D137E1ACD5D05304 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=00D5204A66FBE75CBED18341D2F50E02 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:816
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B0D23C7093D934085ED2C61155958D10 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B0D23C7093D934085ED2C61155958D10 --renderer-client-id=5 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3BCFCCD25D5D13ECF42F9D3015D0BB4A --mojo-platform-channel-handle=2780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0047ACFE3138E828FE24D67584079107 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ddtecdedetizacao.com.br/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffe3b2cc188,0x7ffe3b2cc194,0x7ffe3b2cc1a0
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,2960302253049499351,11874857264542246748,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,10814364967251690504,9834316079279622811,262144 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,2014386160175775310,16561453767590901336,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,4440749367024508075,13609979213140033827,2097152 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,14408450508492894181,14634703451579689250,2097152 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,14501406335288867446,16593759698711847358,2097152 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,392029644499183879,3801923738277708894,2097152 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,15013307408524801735,7782490834190886291,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5292,i,16591982299363855083,6570103397506602750,2097152 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,5430665543242959965,9858861006908433682,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,17659247918012361520,13481839433915404962,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,17905043491935194523,16107913067433362740,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,5792586518128612946,11807806080580895227,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,5792586518128612946,11807806080580895227,524288 --field-trial-handle=2336,i,14440296403332158671,1527683341397599202,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 da9ce1893cdebefea98f89ce74f5bb223e0e48db99408f410aa67aa473959801
MD5 278c803c21f3ede99ac993ea40641eef
SHA1 5ebe92692ef0102c3cfd9549e5eb1ae49e7d3c95
SHA512 2681ae445af18346639ec96ee8d57b3706a8b0ce93907d419451ac89cb48afd4ee86ad4ed919a470422466f3e24a3eb43804fbdad085083c9171981cf73e8793
SSDEEP 384:ye+dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:1+eUZsLQCZsL3hUS4
TLSH
T17B53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b04b81daf58a92a06d27387a7c3327f34cc4ac0ef63a7dbb0d6d174f22600f0e
MD5 80340a4fec2129a85867ef78d24840e4
SHA1 81b48612599755c3310e67f354ed9aa97da520a1
SHA512 8b8fa11dbdff6d5558bf6c40baa5e486dd9212e58f2245876a80ce6a497f52c3918a2a14b82bb26868073daff7a7e4353d2e6d93609d42cd7892e835731ece8c
TLSH
T1CDD0A7223A2974C1E32E4170E5138B4017AE54B625864706B314C81D9DB90C696CBAC3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 1024KB
SHA256 e9b466d2481031af2ccce002a286caff539b0b3e95d2f8a5ff2efec2bfe0c79d
MD5 848ac845a9cad22af331ac9abfc7d8a6
SHA1 bb4f56bedaeb9fd8e8abfbbba66490f2d8b7badb
SHA512 13e09f8689b85f8987119f3518dc8b31afd08fdadb7057680e4172be0a6de24eca4cdd80c2f7b3635491d2bd718177432938c2e555e6c6b49be21b65200da1a8
SSDEEP 24576:5KBEspiB7RfZH5Y6qC5n4nt7xXHWQis48pe7OhbFgSvlPVP:Q2lhZUun4nt7xmQP487n99P
TLSH
T1022533FCE7C50671E005E97D74DD821CDB4497A22A2A70B35E9DE22E5413F21A98F3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e3b38bd6de378c7e30882143d40a4a800960dafccc173b2e3d1c690e958a63cd
MD5 f4525e25c4c906241b678a2dbbbbf22e
SHA1 8c1389983757046b80c330380c934f8e5399929e
SHA512 de07a6fc5ae7c9ad38b7d922aa1d51f09ff70d4725ee9b6e4d69750e33b8d8795cc4d00f2dc34d71d4f9d4f4a4c48a3a42ba1e127f7475aebcc5a10be25fde6d
TLSH
T10671B734013500ACE36041B1A4ED66457DF481E8FD375F02A1CC79B76E0EFE4A769C49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e5d5f171ee406d0375f6e929008e57227c3d9e17763bba419145b2723d17b26
MD5 0eaaae8884a1d57f3e5815c8a0149764
SHA1 3824c3b043c002c8085f97b9ec3e6702fb6caea4
SHA512 d68b7f1607f761903105af6c3d91a0adc9cbfc7f875914e4f62f09a38af30d56ba1e3c23d5189d73edfa6473970879a2c32c26593da8b64f283fdacdbfbdb6c4
TLSH
T1D571A434013500ACD36042B164EDA5017CF481E8FD375F56A1CC7AB7AE0EFE0A76AC49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 79675ff3ebba7a64506b5b41ddf08d23c89cd7969a5426c751141512952d7ca8
MD5 739c6c25322979e8f129420a24f90919
SHA1 86e199dea7a90a0102410af94b5b3b1c3bbbde1d
SHA512 f3c0232372d4f64d6c7e3ecd42624dc856b1bc6c288c5b47ee3478c661900a409810d40420195fb91b141dd245e3191adb39d98720ab38be14daefc369487838
TLSH
T1A741DCF383E4862D89055AF0AB146F1BCE2D055183187C1A8CE4AE1FD3E65B2E245A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 74aee583145d1dc226918a4a5d428ae70c9584ef9d052c76e38c48a0be202e80
MD5 bc16237f5285506c527cc0cbba47df7f
SHA1 a99ee638535d76f97282e3d21fa8593f6faefb14
SHA512 5c2dcb29df7aaf83bea606506432c9b5b91d3666b0d849010dc95aef2d7befed5497e63ef38c90cfdc18747247e4e8715bc54c51ba5689b66587a4f0cee7659c
SSDEEP 192:sxZARqyM/jK1Ml8Mj3/fisFWpVFIyyvyEdpZLHW6+WNrRj9S/YTZIaIgyJ:sxZAwV3/fisFWvFIyydhHbd8/UO
TLSH
T11A52D811AA34A97BCCDBD209FA557F53D6F9586291900E54AAFCDA1C01F6BEC230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 235c57bfb65c3bd690409307acb0da9908ab68d0d86b48c8d1e6b951291b87f0
MD5 ffadbb051ac611189a3b1dac899b2b16
SHA1 10591188b69ec4a1ab687ae9289a68fd1d8d51a6
SHA512 c5af1527f6087ec30290d2cc4231a3e4abc0352e20db94ac8ea4c16bd434ee06e3004f990f8c933eb71b87063e06d52eb337bfc4062796b780150f7aa4fbfe04
SSDEEP 768:RMW7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVN5LlWYSjyroINrkY8:RMW7k+0Wvqidau1jaW5LA3jpG8
TLSH
T177E20B3B680CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 931e8e8a3363a6b74afa4896973b4252a6588fd32130e2f98897f1f165772544
MD5 6658e4db72029031dae8f282c377c930
SHA1 b0c53f4ed2babe61d09e7a6f4fb81b031178eec9
SHA512 7455e84373bd0b541685eab4dc210acdd85074b304f5f46a0e84a21558fc688d605d52f41955c956689d411957c9e9d2b71d8bcd47f721381d25abc84a0fcdc9
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTT4IHKVG8jyJCIfKLagvPI1K4cwLyD:KIbCKcT4wKVGKaCMKLaAPqK4c+g
TLSH
T12FA19752723B06013CFE290892AACE374E9236633408A8AF7BB955750E67E111DFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 358f8aaafaca6f2cd0a698722523fc4e35acb14d1aa7dc4d69f85d34801a05c2
MD5 bd5b5b896cd062928addd5bc21b507c8
SHA1 d614e76660c1f875a566bf2008969f67e6279800
SHA512 bf47b0d0b8c6797b5a72c352b15dd8975ec4400690f18189ed9405c7108f8e7516d23e31803a7fbffc71d0553b0cbc8455fcc2fc97a0f2d76f8972cea7a19c0d
SSDEEP 192:MONM64BAQmiUycq1nW5GBPKUq+FdGe5A0aD1xU6:MONM6eA3q1WUdVszU6
TLSH
T10E02FA396C796C6B9EB2AE45F48637175FD8103BEA946B44EAE85B1C00D765C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3788eb41c79a0bda201390f3b2bcac113880c93212c5b62283a6a28cb934a0a5
MD5 1e4f951a8cad4d6c98da65b6a46c320c
SHA1 b2e0e9af438787ef1dec81acd6edec1b44a52861
SHA512 e384d18cc66801ec43829d3de4cb18aec99b6432cd41fc99127a1585fccb44f1c6b718037ac87f1b126d2dea15ce340f8cd6ac215d5aa9ce97186b216bf5d3a2
SSDEEP 384:nxsNU6/vGIxH+bQTZ6rdV5+2q+0jAStO41srOK+Y4MkJkW:xIvGIxe4oVlq+S2qK+Y4MkJkW
TLSH
T1858219B4D8A6ADE74491E1C9D642F6236DB810378A8C8E0CE7F9F63D309F5F82716412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 655a7869dd22613eb44ac79849e2b2cb86c0cafb66b65220fdf7f0afb6ad7c42
MD5 b31f22327fdc94978e58e43fff53ac88
SHA1 6b2a014877a51a5b07b66f0b760862fd9e3a1715
SHA512 6f7bab70217ec8351acacafe4d99585983dff748a895897eaa4d69feb4ef2be427fbf4959839c9b6faa4e5d3dcc027cffacce6dad1c2a990acf794fc259ad017
SSDEEP 192:KONd64BxQmiUycKnm5GBPKUq+FdGe5AMV+2LWwJqj/U6:KONd6eP3amUdV5+2XOU6
TLSH
T15B1219346C79AC275EA1B105F08737539EE81077AE85AF44F6E89B1C00D779C3B0A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cabdd368-e3bb-41db-91d7-db707038bb5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cabdd368-e3bb-41db-91d7-db707038bb5d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 958bcbea031a75c26f189a6750ee6be08ea19f2f478e645016f55a3867272430
MD5 cfd56f8e36a586b5ddb686f0e9f2e85e
SHA1 1761018c07ea3e3dc5ea4ee3df35e73702ad79e0
SHA512 3dea0d3e403ab382ddb7d956812a495a8661fa135acedb80d9bacdfa68051345842133bef06a149171d1ccbd817f982bb3da19a03d67559e1a57822c55517745
TLSH
T1C1410758AAFD1104B3B77E5A9BF7A86E887FB9372E06D45D10110E4E0623B44C872B37
MD5 SHA1 SHA512 TLSH

Submit Download