hxxps://acrobat[.]adobe[.]com/id/urn[:]aaid[:]sc[:]VA6C2[:]9fd6ce02-4d8b-401b-b56d-ead94f8f628b

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:9fd6ce02-4d8b-401b-b56d-ead94f8f628b
Sample260805-x4wrpseq41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304315273987821"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{9F09104E-5CC4-4B54-910F-ADBFCC59EEAB}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1268	2680	msedge.exe	85
PID 2680 wrote to memory of 1576	2680	msedge.exe	86
PID 2680 wrote to memory of 2600	2680	msedge.exe	87
PID 2680 wrote to memory of 2600	2680	msedge.exe	87
PID 2680 wrote to memory of 2600	2680	msedge.exe	87
PID 2680 wrote to memory of 3464	2680	msedge.exe	88
PID 2680 wrote to memory of 3464	2680	msedge.exe	88
PID 2680 wrote to memory of 4400	2680	msedge.exe	89
PID 2680 wrote to memory of 4400	2680	msedge.exe	89
PID 2680 wrote to memory of 4400	2680	msedge.exe	89
PID 2680 wrote to memory of 5072	2680	msedge.exe	90
PID 2680 wrote to memory of 5072	2680	msedge.exe	90
PID 2680 wrote to memory of 5072	2680	msedge.exe	90
PID 2680 wrote to memory of 5000	2680	msedge.exe	93
PID 2680 wrote to memory of 5000	2680	msedge.exe	93
PID 2680 wrote to memory of 5000	2680	msedge.exe	93
PID 2680 wrote to memory of 1592	2680	msedge.exe	92
PID 2680 wrote to memory of 1592	2680	msedge.exe	92
PID 2680 wrote to memory of 1592	2680	msedge.exe	92
PID 2680 wrote to memory of 4424	2680	msedge.exe	96
PID 2680 wrote to memory of 4424	2680	msedge.exe	96
PID 2680 wrote to memory of 4424	2680	msedge.exe	96
PID 2680 wrote to memory of 3196	2680	msedge.exe	98
PID 2680 wrote to memory of 3196	2680	msedge.exe	98
PID 2680 wrote to memory of 2708	2680	msedge.exe	99
PID 2680 wrote to memory of 2708	2680	msedge.exe	99
PID 2680 wrote to memory of 5024	2680	msedge.exe	102
PID 2680 wrote to memory of 4712	2680	msedge.exe	104
PID 2680 wrote to memory of 4712	2680	msedge.exe	104
PID 2680 wrote to memory of 4712	2680	msedge.exe	104
PID 2680 wrote to memory of 4536	2680	msedge.exe	105
PID 2680 wrote to memory of 4536	2680	msedge.exe	105
PID 2680 wrote to memory of 5052	2680	msedge.exe	109
PID 2680 wrote to memory of 4944	2680	msedge.exe	110
PID 2680 wrote to memory of 3852	2680	msedge.exe	111
PID 2680 wrote to memory of 4428	2680	msedge.exe	118
PID 2680 wrote to memory of 4428	2680	msedge.exe	118
PID 2680 wrote to memory of 4908	2680	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:9fd6ce02-4d8b-401b-b56d-ead94f8f628b
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd3431c188,0x7ffd3431c194,0x7ffd3431c1a0
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,1881342843490286473,13711802534547842680,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3541538144890880065,4575774761458763220,262144 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,15772990029420934489,12543101061199684648,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17551668289247822129,7966543840905922839,2097152 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16369699459079134582,15286120942567597496,2097152 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,14024122852628909046,3309481598283980212,2097152 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,8881628813229901857,13570831036484398853,2097152 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,15913557764333904106,13227070554067962312,2097152 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,9828712233862664907,4663063551835051315,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,12522949394631457089,5735799724974216036,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2890976376946013444,92867977138745173,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2890976376946013444,92867977138745173,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3552,i,4964388773338228528,14747540643459774930,2097152 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13397069460065798963,16083666252779247304,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,18101953236122448346,3794349262008328285,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,10946307244144546126,3452433145679554189,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,6884754527719560508,14237454129157911314,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,16269783874926116078,10034614916490570031,524288 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5272,i,8589818348710987365,125484952652151446,262144 --field-trial-handle=2208,i,15633259593040401961,4938721668767698695,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12e7cbb941c3023db4f822d1f2c98fb0cae07852284cb119a6496a1e413ee6a7
MD5 a74fd0ddefaee0626444fd4411e7730b
SHA1 4aa4e89cdd69b07ad1923a1b08a8faeabbbb0e9c
SHA512 ac7baf622680c4c54c4fd586e6b67ce23fdd94601e095e716107034cc30a8ed15991c47d07144f6775f968126b0a883f9b2b5a0cd9ec5a094dab6e6c634bc2e2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T1CAB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 25KB
SHA256 8e7b01cdb1c941cc5ffb7225b8d18e09ed9e7dccc11651e77d50b7ad8428fb3a
MD5 38b899a7d8bde49431423fd7d9a1a20e
SHA1 3cd553f990e3c5f42247b5b21d84b4d434d7fb25
SHA512 da12b3e60cb00a5cd131da5531cbc5d50790af335cf3b6a69b998f4fbe493f436f9cd105c2b02db2122b4d90fb0c18f480b2b0af63a8331273e4290149fad9cf
SSDEEP 384:ErkZl/0TQoI4NaT3Eru4suAFYapxMdvBdWSCvTYI2bpdgt+H4enX:6AlcKRUruzuAFOv8YBbGm5nX
TLSH
T1CDC2F1C1984869CA5E1DA90D1BDF95EE936019D7498A1CBF0EBB44C76C21D23A5093CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 2.9MB
SHA256 4159451d32eef7d74a260e2f051a198d3c78d4038c0b09219226f66cead461c3
MD5 b9260303abd6f6ce2f715e866c7753b5
SHA1 8c6b35bd4cfb3ba640b087f7a99a34ed5c7c6fbf
SHA512 66c5f4b1de73a3dd15610c165dc2979e0e5e13f918c3bdb51aacb171fe6158565d44ff3cfc5fc1af68d666b8070c5c43897d36adbfbf1f8356fd4dc5f115e21a
SSDEEP 49152:pf+pJ1OuG0v3QxNV5s7M4VlcgJpiKyG+k88Vh4e8dTNAQRai4hOPnP:t+p/G0/gLs7MbOZ+kdVh49v1J46nP
TLSH
T100D533C4CC95A6F484863486488BB06E60D9446F07CB8377B10FE5F9DFAF2C1EB66961
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 63KB
SHA256 c443503ef06b56b2e0387d0a0169fb423c96a05c577613c2c32907fd9389b93c
MD5 052dbf115e7dbc883018b57dea77f527
SHA1 d2472ebd8900f228a6bdbb8e08de5c7ee5b45b63
SHA512 0e96840cbcf015819be186507327f918d54b6d2ca893377fc389972a5f12afac4cb43227800e460bc9d015847da1c31aabdc807749bafb0da92ad7a57c57d73f
SSDEEP 1536:fbTGpXmcy+scxn+NBxoyinxnWJnHcWtUPYSPYThcX:wHyWF+NBx6xnCcWtUASPehG
TLSH
T1F953019CE81E1D92FAD22F37275D2098B91241D7606B9E9F500653F5E0B87C2E7EAC0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 ddd29625cac6f0ce176f48e64d3300263856e86e555479d66c0a8c0700206ae3
MD5 462ea1fa3bcfb3e175d9f20e2f0be845
SHA1 e245835ef01ea9a73be794a99ca3b2304479d790
SHA512 6519da9f756a93ba66cce0eb903f3af2f0269d82a1cef4ca94b98d34ef282ba7e5f807870d7e4472170c3c46ac71ab97e0c9e35b49458a088ff5f1ee0bc89131
SSDEEP 192:DpOJ8J1FHY1XczN2eQz3OEcjZ7fyhLmoyQlqTPGhY:IJ8J1F41szN2e8GjZ7f0LmoyQUT
TLSH
T1833274340D9A0451EB43A1B265C14AB838B155E6FC0B9FEFB32E13B5512B3DACE07D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8455e12fcb573638_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\8455e12fcb573638_0
Size 1.3MB
SHA256 d55cc7f26a3c7ea5ed0be50d1e0ac8a0611e5b2a453419a2df7268fbf27f5155
MD5 4367f741fdc653cef4a59915a4b47288
SHA1 7cc8c7f5114bfdb4adc035551c5c34c2522fd198
SHA512 54f692f5e77433c9957254e9ca13ef39ffbc64e704568c8ef4d787fecb5c36d9f3211f2b810d079cdb94e57ed3c3ee7f233e5b279b5f6e8f5edb369a250c1c28
SSDEEP 24576:zqpy01BIQDzEgNCNU1by7DmvZaXDRlFDXWjCGqkhWPD9LS1V+dGpR/ANV6g:zAy0ZHTvZ8TFDBGqkh4NVdORWV6
TLSH
T1515529C2D0B3ABCED116507831A71F26A820B51C0E50DAF797B4CCF62B77E5352A925B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df2924f7ba66065d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\df2924f7ba66065d_0
Size 315B
SHA256 68f463df46691772ba75b9f522afcc62c017bb851ee48404d2e993c829f51aff
MD5 34957da64d5752196929b4b82a9666b0
SHA1 488def585d605a05cfd2bcc1293b9f207bf62aca
SHA512 08f80b55bd6359aa34821db7ba1cdaa18ef754be11fbfb1243671b6eca3f543ac11e1505e660da26a082c2693d5d1a76d4033cbfdd6e474f942ee665602c8c6b
TLSH
T14CE07D3B2532A00ACB274BBCBBE1639BD255F4780D5FF195D053D5A32E5252358D3099
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 0df3ba990f4932aadc8e8b2e865a56f23e8d659d012d95bc1e29fe610f191727
MD5 2be2c53e0ca22d4328bf9cc487aebc88
SHA1 1a6b98874daabbb99d16ed535b4867c566578d26
SHA512 aa1fd128d8571c9b80c447bbb6af8a59a4184ae948c226d64bb9cc5c9d52db9b6ed62b570703cbeab7276db7d33d306cab6f4128de7127cfc959447b601bbf69
TLSH
T1E9B012420C301105FB47833041C30560377C0F760D42060FF681003B41822CC20510B4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f09899b8cdb1abb1200f75ee135ffdc6f16852001ba774f89681e3aa70137e95
MD5 05c96b130225c668eba55123e45a3dc7
SHA1 c84975bd97953dfcb98c56935f1d8fa7f648be8e
SHA512 5adb63e190f5a3c7056fbfcca152231f28e205f65ac7d6ffa0b5cc3f22e942bad9b6b74a66310285637cc8c6ebb5ff76f0f2526456467ed100fe572c1bff8eeb
SSDEEP 192:DjggxVx1igkGSIrEsxTs+A20Ra38Lm+7k7xrkFRoM9kKd:D0gxVx1igkGSIrEsxTs+A20Ra38Lm+7N
TLSH
T172D136F783B9852D892391F09B18EE1FCF991921876CF939C9D15E5793A34B1E200B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8a97213b37f786a3f0b8c2ab50639880d0371ac93b232ba6c16da0829a4a5039
MD5 636777d4186407e9ab1f55b5166beabb
SHA1 8e790c10689864b70e16b5dbd7ccb73873696158
SHA512 396246fbeb65b6575fb8b462a77b9fb33788a314d06614d135783fa2a081d499e4d55e33535124426e3c0a52a53d3edd7129e155d08d9a8922df50c630a0d881
SSDEEP 192:sxZdRmyM/jK1Ml8Mkx/fCsUBqEEdpzRgHW6+WN8CQ/YCVr2+kIgrJ:sxZdMMx/fCsUBq7uHbW/R2z9
TLSH
T1C742EA126A346977CCCBD70DFA417B93D6F5097292940E589AFCDA1C04E6AEC320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a48ee43a980e03ad84c65434f3356d371dede64548677d290004ce96ea401c73
MD5 6887c5a6566f9f4f26afcdf05a02214b
SHA1 c555441de9248d29b490a37d027e5e00111ddfe5
SHA512 77f0f45fb55117762206eff84b66694a3a8cc75e11660985166185e117421ff5f76095e758a3308faac915f19196b46fac27c21c1d80611264630deb090d92c2
SSDEEP 192:sxZdRmyM/jK1Ml8UQZkx/fCsyB+EIdpFRgHW6+WN8CQ/YCHxcF2+kIg50IJ:sxZdMqax/fCsyB+dQHbW/dy2zKs
TLSH
T1E852D7166A345977CCCBD70DB6417B93E6F5497292900E58AAFCDA1C00E7AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9a45ae4e02544358f48486d39f14b5671c81b338fc5d43d79058c0ded30f6e20
MD5 0834332bb42f36545282e9b50e558233
SHA1 305dc1a9accd4a36a0e3d1e8fa0c004d9a8b49c9
SHA512 fc3ae050ce5f7c9dd119af7b61e9f7eb0594e048c853596ad7f9915e664232b62cf65ceed41e1e19dfa79951aa068f318b7cc664db1d6302b7aa2667115992ca
SSDEEP 192:sxZdRmyM/jK1Ml8Mkx/fCsyBqEEdpzRgHW6+WN8CQ/YCVr2+kIg50iJ:sxZdMMx/fCsyBq7uHbW/R2zK+
TLSH
T1CB52D8126A346977CCCBD70DFA41BB93D6F5096292940E589AFCDA1C04E6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6d79fb550ae18ed7f105ea1b7f03233dbc9eed4dfc8357f0911ac957ed3647fe
MD5 03bd5e4f33b209b4704ab5f6d10ca069
SHA1 96cfad9f425632e738bb43a73eb91a32f818c567
SHA512 6f88f026d18740194629a0af3c90d537537c0dfc9330d8730cb486daabaaae4061588485aca5ad924fe8978fc36170eac5cd6e820f9b2f1ce6ce1a547f984ef6
SSDEEP 768:i/8bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVZroi:i/8bqn+WvSC36u1jaCZLbWVSi
TLSH
T16DE21B3B280CCB7E4F845E5DDC26AF962ED801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\b48c799d-a7a9-40ad-8dba-ad681cc7aca2\index-dir\the-real-index
Size 72B
SHA256 76c29d860bee11e9a3b67437f5db8d92c20bcb815db5089baa655ef582b2f771
MD5 cd98432ebf408040bd2c49bad46c2008
SHA1 33f97ec53010bbb3973988fcaa00d4d418f17b7e
SHA512 74eea75361e4ecf84b8bac69f0826ba6e3cc9aef80d2a5da0ef2935601484022d0ec5ea45a1f5fd6ceaa09184745f0a73b62ef38ca69a4147d3f58ab0d7e9719
TLSH
T171A002A10A924012D61447F1D0C64A74373448100A028612E1A415498997357A113524
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58968e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\b48c799d-a7a9-40ad-8dba-ad681cc7aca2\index-dir\the-real-index~RFe58968e.TMP
Size 48B
SHA256 cde0be708d61b98827c6ce48eb2011ac7ff5c7598d9f26cef5b1a3e4a1af8238
MD5 60279451cbbb905b5c327325601d2312
SHA1 240daeddc32c155d4843a296cda28847b1de655c
SHA512 217860c885fe75ca964d9a0581ffa9db260b625a4feddb6885c45d02ffbef2089561190fb25038054939f62aa191b549575c46bba579c74495c531eccbd2fd1c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt
Size 256B
SHA256 fd760804e5271142a130a7d897a828be3c946699a5eff12735f178847a321248
MD5 6cbdcb84999333b30eb3d976ce71eb4f
SHA1 651b59683c0e3b7184dec32672a74787912e84e6
SHA512 85ba5b78556ac10604a4e6363348a3b7b3e7d0d9e3ef6d5749362b155a74774d5b0b5a674a72ce7cd60180a54463aaacf7cf244d12c40182b4280eef0b1ca515
TLSH
T14BD05B7716714115B7624D8E02D9315DE52E79847E51DA18C267B40308B18922518D86
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt
Size 250B
SHA256 c776aed9f6230ffc5a7a6a0a89d597c4a6a592534c047b6b187ba3b532b08c82
MD5 9d91b760e5787a70d24270a7dbcb005a
SHA1 cecfc01cb28cc7febddf34987f6f257fb9e880c4
SHA512 cd3f454fbdd44422557a966de4c9c39b2d11b0c39925a753d4cc606379654625ffd4a72c4a81547f5438ecbb57a5b874d1c31686fadb4b046aa0741e57426206
TLSH
T14CD05EBB16719125BB628E8D02D9312DFA2E71C57A50DA18C2A7980308B28D23415E8A
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 35KB
SHA256 59587992f9bea8acc4c1108cc18466a043b82900023bd5051076c35f49171c71
MD5 3094db5f556475b13b7bbe9d7bfff2a0
SHA1 22ac036dc09f7ec5be023703de5a55d07f30ac5a
SHA512 0da5022cf32226fe3d21d5eb45f4f7839da498d4d9e5564015fddd82f4f8072e3c5e5754918f7c62008d182d1038d51fb60ee7efad77d2d01c5d594a86efd812
SSDEEP 768:7WUCGxs4/9xnnI9jqbh+18ZpO/IDxPCkJjUe8GxkOt0s9u2rMKii/TXUd39YubTD:71LI9j8GoxPC6jDFxVM27/g4uHzIf8rV
TLSH
T12DF25DC5B33461B3C7EA46B595371312723661483D0AD4E1B3AC6EFA0DA1A87493BF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 77KB
SHA256 e8e82bca8134d98c34728442bbcf92569ee26dfb1bc7e7a45bb4868f7c6d7850
MD5 dd9c3f795b53896cd0336e86daa0b892
SHA1 e8db55b929f00cb1b7e4f489fe8cd9634a82847c
SHA512 72fa990cc0dc4e8912e430e4b9fee21b506dfc81496bf80ff0e4401369aa522403ca7a529626d9e1e94a8492387b0e9866d2e0c9f075e0a59bef6b9fc23d8cd1
SSDEEP 1536:p1tmml6F3WJPYhmd90N4yhwJDWcirEPxcTnpa8Gh/p5BC3Fyxsq8zu:pemlQ3GMmd90N4y3/rEPxcTnpLGh/p5P
TLSH
T1F6732A420355652BCE2B83FB9197491B3339810D7F83C36A66A5E3792C363F78D8D926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 640fa3aee5a4f35f5e787b1dc718326ce9cacd14288313a45b688317d0558ff8
MD5 6532a59ae140cec0a6f9a98829952577
SHA1 74ab05ed8dcb35f92e0b787fbd92a8838f26fe79
SHA512 18191b4d25060f22559c7110b66ef05dab04024338765f242c076b74fad9581d38b8a9e34acd24a2543a1c1b3564686e224b7fd17cbbc24ae2710c84a20f1b22
TLSH
T16EA0021051491403C67206F11845A55173D6C921860A533775A0959DDCE66C15E51341
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5894b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5894b9.TMP
Size 48B
SHA256 bfa61c1a38515f003f3cf77270ac58692d867d1f0486e454c0dee36f81725734
MD5 c5d7060887316bed2b443f3eb294df05
SHA1 92faa0675e63382bbaf82c0df797f9ca785f886a
SHA512 a3ba326a2162af591525ecd35688519f886c08af8062a679a80d03f04c1df12e60a73fd0fc2d5d8e3701dfa4edae86d13e6ecb484976a2dc142ffedfc8726207
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4f4b8b57ce8b11172c98a5d9ea404acfeac810a71ad4569ea8cafc400207a5fa
MD5 1b324a8ee4092ee7a512cf43224fe3a6
SHA1 9261aed0d548c17466071d574060b6abf1ba326b
SHA512 a7b3ce4d4bf0e4735b36f00bb92c319c91c143ca9c067173e980e669b196472fd03b4e6d1381fe5c34f769dca7010875bd4a1918388fd8bb24706d9d8da042f9
SSDEEP 96:K4/6KkocOh2KaIND2KEAmuT2K8oTEAKl2ug:0/1zVN3/g
TLSH
T1EDD14347B03B220239BE250C96A5A6365F4171637418A46F7FB801724E7BE215EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70f75e35-9c50-4fa2-83e1-521256934686.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\70f75e35-9c50-4fa2-83e1-521256934686.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ca03758cae0f0f4830d59c408f76420f28419827300af513fb2560b260630459
MD5 988a92bfecf77eefaaa6b072a83e4a64
SHA1 f118aaf436d665f0dbd0e33b6ce8eff6e387949a
SHA512 b7414ab26b2ee2a75bd9891ec077cad29250530f3164c5256e476f1c4c6d1e93f3c886827d208265d0782efbf5c810f9361bc303e57d51e88bf3486bcd47c0c4
SSDEEP 384:pZcIhsNEU9XvqF7XhL8Ea+1OA/lDBeRs9JKgqijUDhOGo:hhV9nasOA9DTjKgqmUDhOGo
TLSH
T1A2929E7154389D3699E3BA88F88736175EF88037D6C56FA4D1EDAF0D00DB59C230B529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3dd00f0236b417b818771f503a1b463573a45eafe6c079b77f5d126a3636cd0b
MD5 048017ab9559375dce6329388b851041
SHA1 3741e194d819d25e124cef8eb6b8bcd07c58096e
SHA512 4339af45169ee71c1d4b084403c0079aec2c0504a1f3d48a4d88ce9b3cddc8963865b604fd16bcc08663f4ce27454de441536ed53dbbaaf583d4c88ea87ea50a
SSDEEP 192:uR6LsNEUv/QHqFmbi3JQmiU1XlRz4Ea+jBOmBRZWM/Dam+qvk3MKD:rsNEUHYqF7XhT8Ea+1OA/lDk39
TLSH
T193424C3679789C775DA3AA88F44B32139EF88067D6856F94D5DD6F0C00DF2AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 52f09f87cd8605a319a55f5d81a2e4c1e42af7d9f1936f8d36e75c74f5778ecd
MD5 533e929ea77359d62a215a2dcdca35a1
SHA1 b51c6a458ae287389f0d83c0c34170536751495f
SHA512 375f98e830f5d8e036463847f57819fbfbeea1eb70d981e722c12b11907887611802b3ce1fa70693b613de0b86471938839a863ac2d46a60dcf9f01faec3aaf1
SSDEEP 384:EZcIhsNEUaXvqF7XhL8Ea+1OA/lDBeRs9JKgqijUDhOGo:ihk9nasOA9DTjKgqmUDhOGo
TLSH
T140928E7155389D7699E3BA88F88B36175EF88033D6C56FA4D1EDAF0C00DB59C230B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5c0f803b2e8bc845e7436ceb2e5c3a5c96d5c6d2c7493f184d0b0edb960564ee
MD5 0204f55396bb8d5f797cfb0716ccc72b
SHA1 1ea8c6adab93d91c6426a4f3348503b8aeb29712
SHA512 83d4d7a1b8e90a1774693f1de7cda4f0d5d9c829b0fbd7b32efd41425f9db4290786f17a401b5446259ae53d9a05a55845030229aac9f6bc20a95c4464c17b95
SSDEEP 384:UiFiZcIazsNF8TUNTUlIl9XvqF7XhL8Ea+1OA/GDBeRs9JKgqijUDhOGo:vFQy8wgY9nasOAODTjKgqmUDhOGo
TLSH
T1B7A27E725468C97BADF6AF84F98A32179EF44077C5C5ABA4E3DCAE0C00971DC130B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3464ea1d129ee9d73c932c0e8e95f26bbbd69d28aaa2db9b803f1c4cfb198229
MD5 3b14a7ee4e3ca4287b8c3f25691fa5f7
SHA1 cb08aead3ca27105cb0c8c3f09fe8402b08002a8
SHA512 24c5c023ff2c2fca46de546d474b13420336cc42cd06136e57b492ff3ef2f41a62511fab4ea5354de182953e3fac0bb1c7881193789f36b65740052db9675288
SSDEEP 96:EqONkeQsjpf1bxX5ih/cIPURHl8h4otop5ounDDBfPgvE5BzatIRdy+ZhOmGsR11:vONa6Db6QmiUyjdHBa+jBOmBRGRgUaU6
TLSH
T1A602F835697C6CBB9EA26E48F88737279FD4103BDA966B94D6D81F0C00D765C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b0643b094f230b6e5f7fb91c042a11cdfbf650c7e155ade830f350f3531197d
MD5 98588a7fa5a80297bd16b20b98ea39aa
SHA1 d0b0994e7237d5f6990d80f33ad75359b6f215e2
SHA512 161e1521680b20b1fedf7090fcd3a65fefb13f622235e724621b4729502ea0f59b2710faee48e6d423dccfc9bd68b392e56759c3928a8272b8733561b14c0108
SSDEEP 192:VONO6DbLQmiUylWdsBa+jBOmBRZWM/ONz+qvU6:VONO6Vu4sBa+1OA/yDU6
TLSH
T15E120B36797C9C775DD26A98F88732179EE44127DA8A7B94D5DC2F0C00DF65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download