hxxps://account[.]luminpdf[.]com/sign-up/invitation?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9[.]eyJtZXRhZGF0YSI6eyJkb2N1bWVudElkIjoiNjllZjJlMzQ4ZmJhYzQ5MGU2YTIxYjJlIn0sImVtYWlsIjoiY2xhaW1zQGFkaWNhLmNvbS5hdSIsInR5cGUiOiJzaGFyZV9kb2N1bWVudCIsImlhdCI6MTc3NzI4MzY3NSwiZXhwIjoxNzc3ODg4NDc1fQ[.]l9Fnkmsg8E5wrXws5Ppgsc6m8Y3s4iP4XjBHDQiZR7c&return_to=hxxps://app[.]luminpdf[.]com/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9[.]eyJtZXRhZGF0YSI6eyJkb2N1bWVudElkIjoiNjllZjJlMzQ4ZmJhYzQ5MGU2YTIxYjJlIn0sImVtYWlsIjoiY2xhaW1zQGFkaWNhLmNvbS5hdSIsInR5cGUiOiJzaGFyZV9kb2N1bWVudCIsImlhdCI6MTc3NzI4MzY3NSwiZXhwIjoxNzc3ODg4NDc1fQ[.]l9Fnkmsg8E5wrXws5Ppgsc6m8Y3s4iP4XjBHDQiZR7c&action=share

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://account.luminpdf.com/sign-up/invitation?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXRhZGF0YSI6eyJkb2N1bWVudElkIjoiNjllZjJlMzQ4ZmJhYzQ5MGU2YTIxYjJlIn0sImVtYWlsIjoiY2xhaW1zQGFkaWNhLmNvbS5hdSIsInR5cGUiOiJzaGFyZV9kb2N1bWVudCIsImlhdCI6MTc3NzI4MzY3NSwiZXhwIjoxNzc3ODg4NDc1fQ.l9Fnkmsg8E5wrXws5Ppgsc6m8Y3s4iP4XjBHDQiZR7c&return_to=https://app.luminpdf.com/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXRhZGF0YSI6eyJkb2N1bWVudElkIjoiNjllZjJlMzQ4ZmJhYzQ5MGU2YTIxYjJlIn0sImVtYWlsIjoiY2xhaW1zQGFkaWNhLmNvbS5hdSIsInR5cGUiOiJzaGFyZV9kb2N1bWVudCIsImlhdCI6MTc3NzI4MzY3NSwiZXhwIjoxNzc3ODg4NDc1fQ.l9Fnkmsg8E5wrXws5Ppgsc6m8Y3s4iP4XjBHDQiZR7c&action=share
Sample260805-akq1saag83

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3168	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303626138363873"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{2045B367-B0D6-4A50-B049-FC879042CA37}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1928	4376	msedge.exe	85
PID 4376 wrote to memory of 4000	4376	msedge.exe	87
PID 4376 wrote to memory of 3168	4376	msedge.exe	88
PID 4376 wrote to memory of 4000	4376	msedge.exe	87
PID 4376 wrote to memory of 4000	4376	msedge.exe	87
PID 4376 wrote to memory of 3148	4376	msedge.exe	89
PID 4376 wrote to memory of 3148	4376	msedge.exe	89
PID 4376 wrote to memory of 1632	4376	msedge.exe	90
PID 4376 wrote to memory of 1632	4376	msedge.exe	90
PID 4376 wrote to memory of 1632	4376	msedge.exe	90
PID 4376 wrote to memory of 1440	4376	msedge.exe	91
PID 4376 wrote to memory of 1440	4376	msedge.exe	91
PID 4376 wrote to memory of 1440	4376	msedge.exe	91
PID 4376 wrote to memory of 3700	4376	msedge.exe	92
PID 4376 wrote to memory of 3700	4376	msedge.exe	92
PID 4376 wrote to memory of 3700	4376	msedge.exe	92
PID 4376 wrote to memory of 4344	4376	msedge.exe	93
PID 4376 wrote to memory of 4344	4376	msedge.exe	93
PID 4376 wrote to memory of 4344	4376	msedge.exe	93
PID 4376 wrote to memory of 1692	4376	msedge.exe	99
PID 4376 wrote to memory of 1692	4376	msedge.exe	99
PID 4376 wrote to memory of 4408	4376	msedge.exe	100
PID 4376 wrote to memory of 4408	4376	msedge.exe	100
PID 4376 wrote to memory of 3424	4376	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://account.luminpdf.com/sign-up/invitation?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXRhZGF0YSI6eyJkb2N1bWVudElkIjoiNjllZjJlMzQ4ZmJhYzQ5MGU2YTIxYjJlIn0sImVtYWlsIjoiY2xhaW1zQGFkaWNhLmNvbS5hdSIsInR5cGUiOiJzaGFyZV9kb2N1bWVudCIsImlhdCI6MTc3NzI4MzY3NSwiZXhwIjoxNzc3ODg4NDc1fQ.l9Fnkmsg8E5wrXws5Ppgsc6m8Y3s4iP4XjBHDQiZR7c&return_to=https://app.luminpdf.com/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXRhZGF0YSI6eyJkb2N1bWVudElkIjoiNjllZjJlMzQ4ZmJhYzQ5MGU2YTIxYjJlIn0sImVtYWlsIjoiY2xhaW1zQGFkaWNhLmNvbS5hdSIsInR5cGUiOiJzaGFyZV9kb2N1bWVudCIsImlhdCI6MTc3NzI4MzY3NSwiZXhwIjoxNzc3ODg4NDc1fQ.l9Fnkmsg8E5wrXws5Ppgsc6m8Y3s4iP4XjBHDQiZR7c&action=share
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a0
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,575220588858069266,13294422416564377208,262144 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,18116153398264730312,10948420798272604473,524288 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,12890828761441767520,9766693536499375735,524288 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8556305056677939945,11132609922491183562,2097152 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,5482838609604114232,87135053791537678,2097152 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,2934511752103496708,16060380213567900732,2097152 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,420169016250629997,18443094309260989361,2097152 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,14004250160763491198,18356382716843396023,524288 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14950481405667925780,8693617998399979533,524288 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5287483133064865557,309221806269838979,524288 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5287483133064865557,309221806269838979,524288 --field-trial-handle=2288,i,6077092004189762839,8472221558427904830,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75776f18-6cd9-4235-a446-41cc20d8c32e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75776f18-6cd9-4235-a446-41cc20d8c32e.tmp
Size 8KB
SHA256 958d76c5207a68b67ec7fa1424023806c97bd7c2674f98c979f04d1ba3949dde
MD5 649a6eecd8ab410f20e9e94712bff450
SHA1 5e41d9a50386474d175b0b868a7a34ba6420da59
SHA512 79ad24b9ca6840881e08e5d615b3f5e8df5446d80006711e6fa83fa6082e5d0f4dad89d64f204829c22c1175c7d447455f6e3bc46fe50005f3b65ad0bd582881
SSDEEP 192:UONX6kEQmiUyV3s9035jzorkbrav7XHNNoacR6qQU6:UONX6d4s9g8kyv7XLonIU6
TLSH
T1E2122B32687C6C6B5DD3A945B44B32275EE5412BEBC97F94E6EC2B1C00DF29C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 92a908538089a45b7267542a2b86d1a63b5a35a14b876e2973f8c13aad1654fe
MD5 3be5a24efaf87f3baed7f1fe7380e63b
SHA1 bbf3f915abb0c0973886257d8d70206849d13325
SHA512 46f6a5196f27bc42271724c4ec93c2d258ff71f175073a3d6d7f098db60666d7acceae87b6c053d4ce205a6d1ca3e790261390f9a01bf8af4376a0e26832e3fd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T11AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c107d5cf33a714a068be0aded9bac4225385ecd3f59f1705fa681e4010125f6c
MD5 aa4214cdd355dd491d7e78f2dc15f214
SHA1 60b5b7a0e0c833918c018f11fa7354bbb8735685
SHA512 aaaa9dc5718e77344760f3ebe4d3dbfe1578d67071ac4752c2addfa29e2e562b6da4ab466d0cef8231f31f45568e99edbac8c445454402bcf9b5c4cbebeb232e
TLSH
T10BD02372BE91D3D0D019303D502002403B26023123CF832310A8480CDC7404082DEECB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0760225d13d82a9501bf64519b37d4842b7e6eb1fc9037cf001407ab59d45bf6
MD5 73833f3873e92c27e472a07d6dcaa032
SHA1 4da9454814859ad7c400c5bb36360ced9bf971b7
SHA512 4fd3ceb929b0f610303bd4693fa15bd055764caa77b418d2abdf6fa8eb1eea47e507cdc475a6088031f790c79f121762141d388d039ee94cc5755bfa7cc1a97f
TLSH
T103713C7921C227AAE38A3533E2F2160A34718FA80F137D211174F93ED909B166736DF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c80e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c80e.TMP
Size 3KB
SHA256 0cb81ae6f400e4fdb2f27d26328ecff13b13bba3d806ee11b0948d9a9a63441a
MD5 70072fa5116d3778d369526b9ab5a653
SHA1 d17fec8fff78d2a0acab65189db586daf3378009
SHA512 f8018d9bcf54fd120eb12ad1277ad0bf50a585fba65c25e29e1e813bd835b25330bafb47b2212bedad9253a46ff40320f33dea6d8c94a3815838fedd0da095d8
TLSH
T146713C7911C227A6E38A3533E2F2160A34708FA90F137D211074F93ED809B166776DF8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b356378-4d0e-4c02-9521-7ba1e1560d44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b356378-4d0e-4c02-9521-7ba1e1560d44.tmp
Size 1KB
SHA256 bc36f0ae0b79dcd9b8395a5e7d2b6e14b41d93afec53d1d3223c783c03c163c7
MD5 1dca4066c9a9d4b554cf296add8fe5af
SHA1 320da030bf51233ef0de912769ee5c0522dea62c
SHA512 ef8a13fbec566d453e8dfb4821f4ce4a009f82a3c5599b134d61caa768e9e8038012b180d7b8e834f604bb13f42b53dffed3f0d1e1e2750a62dc6f63f45bc260
TLSH
T1CF315DB3C7E4965EC91116F06614AE1BCE1D0A14832C7D2A85D4EF1B93E2475F001A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 84e715b217e45e9a3d3202fd616c899b6c99a50ac6a1ed1e8c3737a2e258fc39
MD5 7e4916f85b89ac7870134174047febb5
SHA1 a4a1b78b6aee662519af692e372944a67f3dcb33
SHA512 0eb3ed96fb8d9c03c9293235276860dbedbfcd495393542c38778754497191791fba098ea82db7f62e93250799a5bfee7732994971d17cb22bbc71cb7a51c226
SSDEEP 192:sxZMRVyM/jK1Ml8MkD/fvsL4EIdpZqRHW6+WN9ZO/Y4lR0QIgrJ:sxZMbMD/fvsL4dUHbW/Z9
TLSH
T19752F911AA38AA77CCDBD20DF945BF53D6F91572A2901D44A9FCDA1C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9121d967728f613a9e15acc3230288a869a1ce7685230514cf63b2e1f3cb52ca
MD5 f7ca5cd7faf3a57f255494462ee25794
SHA1 3a09dbc2f6d5fedfbb2a4cbfb0a6e9a06f30fcef
SHA512 6e1c59171e2660c0e098b0a0060c74b0369bd31bf554f705392a7df2e47baa196c46edab3da9e2d76582adedc9a825a2e007825ddf5ca725a7aa38fae517921e
SSDEEP 192:sxZMRVyM/jK1Ml86kD/fvsGWpVM4IIdpZqRHW6+WNqlZO/YQzY5qIgbdgJ:sxZMbQD/fvsGWvM45UHbH/zy
TLSH
T13752E911AA38A977CCDBD20DFA55BF53D6F9153292901E44AAFCD91C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8730b414a6e6722467779bbb1323b169cd12c73889a43f5c5fa15351d6c82da3
MD5 fffc6c3f0d82d2f049ffc9546fda39b4
SHA1 96148d1e2acc4c2708ca8ae76099062d207da26c
SHA512 67350114cf89820f5cce83d2cd6b9f3c4fc2750b3edc7dc1a02ddf0f49b198940b33c40ec8f13ba733bc059b0ce56a80e0008727f693731c4e2c87147353f4c6
SSDEEP 768:Pv8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdwroek0Uni:Pv8iJPNWvx76ru1jahALocdb6Ui
TLSH
T168D20B3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2fb85acc93e9c8b4dbafc6ba63c1ab4756fd44f546894907b00e38346e518e04
MD5 d3c0e976c038faf09bff8294714341bc
SHA1 753405a36f1e591df7e311657a65be5b3d97ba75
SHA512 63151f035c935f6d41f9b065f041bda379e21e37be91fd99ef7565efbbd7240d5455a29206b2a3fca6db8e959af07cee5ea369aac01ea55fdc559cb60f82d8ac
SSDEEP 48:KV9IhKe0sbyV1INKGQA+7IxKU4Mvyqif2C0x:KV9aKe0yG12KGQx7uKU4eDif2C0x
TLSH
T1B7915121F1BB53013D7E394CAA548A26478179B33018A56B7BE901A14F6BE351EFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e12b042fbce772a824bbcb65b8d669d1259f08f1623f71761c736c0d96eb01f5
MD5 b486c055aea2fb9377adbdf5ee529ffa
SHA1 f9a0e0aeaf7055f4450069ff32a8a83b9566d070
SHA512 2d5ac88eca0bb84e6bb2ec3d4bf5a707cb85117c6b008a09730a6b6c699c97742b5331b7eadce149b35ca1c1522a2bdee16d791e4c91e4cc1b8b5c393cf62ab6
SSDEEP 384:OZcIhsN+yrsaD8kg8kyv7XLo6IBeRs9JKgqijUfq:shcllbs6ITjKgqmUfq
TLSH
T12C929E3198786D7BA9F3B585F48A36178FF49017E7C46FD4E5ECAB0D008A598130E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 173f3254a62ded6c4941b6e5e05d091d3a7021db34e67c99508fcf833e865ea2
MD5 d822fc650a4b4ddb1c31a2faaaada154
SHA1 ba2bce2f78e3037a4cea8cac5229e2ea1cd30510
SHA512 a62bcf459ab0714c52a8bbc6d42b1acfabc4e2364ee59907fd9616dd224e371df39678aecfbaf59b60cc083dc0f0f86c158aa2f77214f5dc899cc0cd312d38db
SSDEEP 192:gONv6kDfQmiUyF3Z9035jzorkbravWQidaU6:gONv6ghEZ9g8kyv0AU6
TLSH
T1F102D93568782C7B8EF3AE49B54B27275FE5112BEAD52F84DAE81B1C40C765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8b5c881308b6b308d7bde3899037a02f45f205ca10e0150eb6ca75604dd6fcbe
MD5 e7bccf28df1e3c54f30516610b896c8e
SHA1 3a06ce1943cb82fd282cdb9638c0bfef071ef383
SHA512 bdf8f855ae00a92bf108b2f54a568962394ed0edfb5eacc73fc7e231d312b75d2ace30c0c0359b153b3bb6309722e71a78ca6d2891e3cf372b80842e158aedf8
SSDEEP 384:bZcI+sN+yrsaj8kg8kyv7XLo68KAStv4/ow96MX2BeRs9JKgqijUfq:D+cJlbs6ISfw9hGTjKgqmUfq
TLSH
T1EAC26CB0D4B81DE784E2E9C9A54AE6171EF8413BC5C85E5CE6FC7A39308F4F81316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 701713a3c5e33714302877845fee5e77c97878c112621792a739ca890d975a74
MD5 97117acd8e63fe9c68493d3c82d219be
SHA1 0036f665d399e97d4f6ccc7c5f75629cf719652c
SHA512 4a5deb867fa7d537beae29ae58e801e913544be7836b87a53f454da5f4fea61cf33d26ff1b0ffde8eaa0f9564ad04c2e71e108558c50cf1d1c7275722950c2e2
TLSH
T19F412C58BAFA1158B3B76F4A9BF6A8AD487E79372E47D85D10110E4F0623A40C962733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads