hxxps://acrobat[.]adobe[.]com/id/urn[:]aaid[:]sc[:]us[:]844120c9-d89d-4fc0-af93-341ba449c7a8

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://acrobat.adobe.com/id/urn:aaid:sc:us:844120c9-d89d-4fc0-af93-341ba449c7a8
Sample260812-v1237sck2s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310293042225485"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{DFBE4CA0-EFF7-4470-B4DC-DAAF6ABEE0F2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1048	5028	msedge.exe	86
PID 5028 wrote to memory of 3528	5028	msedge.exe	87
PID 5028 wrote to memory of 4672	5028	msedge.exe	88
PID 5028 wrote to memory of 4672	5028	msedge.exe	88
PID 5028 wrote to memory of 4672	5028	msedge.exe	88
PID 5028 wrote to memory of 2952	5028	msedge.exe	89
PID 5028 wrote to memory of 2952	5028	msedge.exe	89
PID 5028 wrote to memory of 1588	5028	msedge.exe	90
PID 5028 wrote to memory of 1588	5028	msedge.exe	90
PID 5028 wrote to memory of 4760	5028	msedge.exe	91
PID 5028 wrote to memory of 1588	5028	msedge.exe	90
PID 5028 wrote to memory of 4760	5028	msedge.exe	91
PID 5028 wrote to memory of 4760	5028	msedge.exe	91
PID 5028 wrote to memory of 3352	5028	msedge.exe	92
PID 5028 wrote to memory of 2420	5028	msedge.exe	93
PID 5028 wrote to memory of 3352	5028	msedge.exe	92
PID 5028 wrote to memory of 3352	5028	msedge.exe	92
PID 5028 wrote to memory of 2420	5028	msedge.exe	93
PID 5028 wrote to memory of 2420	5028	msedge.exe	93
PID 5028 wrote to memory of 4896	5028	msedge.exe	98
PID 5028 wrote to memory of 4896	5028	msedge.exe	98
PID 5028 wrote to memory of 4896	5028	msedge.exe	98
PID 5028 wrote to memory of 2544	5028	msedge.exe	99
PID 5028 wrote to memory of 2544	5028	msedge.exe	99
PID 5028 wrote to memory of 5000	5028	msedge.exe	100
PID 5028 wrote to memory of 5000	5028	msedge.exe	100
PID 5028 wrote to memory of 3396	5028	msedge.exe	103
PID 5028 wrote to memory of 808	5028	msedge.exe	105
PID 5028 wrote to memory of 808	5028	msedge.exe	105
PID 5028 wrote to memory of 808	5028	msedge.exe	105
PID 5028 wrote to memory of 4136	5028	msedge.exe	108
PID 5028 wrote to memory of 1372	5028	msedge.exe	109
PID 5028 wrote to memory of 4692	5028	msedge.exe	110
PID 5028 wrote to memory of 4020	5028	msedge.exe	111
PID 5028 wrote to memory of 4020	5028	msedge.exe	111
PID 5028 wrote to memory of 1992	5028	msedge.exe	116
PID 5028 wrote to memory of 1992	5028	msedge.exe	116
PID 5028 wrote to memory of 1984	5028	msedge.exe	117
PID 5028 wrote to memory of 1984	5028	msedge.exe	117
PID 5028 wrote to memory of 3812	5028	msedge.exe	120
PID 5028 wrote to memory of 3812	5028	msedge.exe	120
PID 5028 wrote to memory of 3812	5028	msedge.exe	120
PID 5028 wrote to memory of 432	5028	msedge.exe	121
PID 5028 wrote to memory of 432	5028	msedge.exe	121
PID 5028 wrote to memory of 1552	5028	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:us:844120c9-d89d-4fc0-af93-341ba449c7a8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffa062ac188,0x7ffa062ac194,0x7ffa062ac1a0
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,14586206204775213844,10207179995925276830,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11604875257448477192,3782284575330650657,262144 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,13026337890168865615,6950015724183531704,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,10452457762420531707,8303456729427630001,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,9288112465004217448,11498057311940179477,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,15997135234875841350,11581243973100561417,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,16029823149404546636,18323477342162550810,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3860,i,1317113713669372099,294650235942718831,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,6450178498405692819,16805584628415502702,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,1693916691137265529,5710754567887146443,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1606797456668029717,13783294606636297712,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1606797456668029717,13783294606636297712,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4576,i,16681315572844596161,7859028705495642256,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,6307785170934320329,6914805512004428727,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,207305763091963266,16943299463805058975,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,14806214825357468401,5615943781380878926,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,18302513590983344526,7003841740292198258,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,8401674037898295023,4074134713401280325,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,403560179562545054,11655327480243963750,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6796,i,3609312467990905972,15858478047028162718,2097152 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,10216575131171933531,7772750333184180732,524288 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6540,i,9301249103083680783,5813000504564080199,262144 --field-trial-handle=2580,i,7056269598693712174,18359916085104720311,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 991008b9b0595d73a834485ea29586af44591a386941c327848eaa62bdda1d31
MD5 361e52e3af42b9ecd11b87e3113f10ec
SHA1 317337f4abf4ee15758d7ffaf16d705572917ecd
SHA512 176061638831bb89d64d18adaba36e7e65a39b64768b1d30891a8116bd979cdb3c938e30394f379c786c984d6a7590d1d7d0b299de23e12b878648fc110b41a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1ACB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 2.9MB
SHA256 bc98a695b93b1718102d4d7a6f07fb220a5393845791c2871df9503cf2759e79
MD5 e12db3c7f4f19c6af61478f50ce64cbb
SHA1 64c749c427c2e43444b3af9f6ea8f286fe1b4dee
SHA512 cf755742df81a73025753e1132dc42ea118101606021b90d84ab6fa8b78f5995b9979160367bddd78083a70eed89bdd812a5b70452306c3cce8a7cc4a30709c0
SSDEEP 49152:tr/lS85UxF8ogRgQY8zo/tMeue78sSax8sDz/Jk+uLtfL9WFZBg:tr/0dWvRgQK/hmsSaNX/a+uF8Bg
TLSH
T176D533943E66751ABAF252388877A21F113B7015B8780E3FBC65197D0B6FDF18A2D0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 25KB
SHA256 20f8627b3013d11f96197178719a8fcdedb24ea85903c7e4682c9fe70f4a303c
MD5 c777bf4f893c3eb5f178c4d7c23f6123
SHA1 4c2c77565f05821f0cbb8696979a1c2f864a5bfb
SHA512 ffbd3978cf02c683bb735fa446c8b12c6c0c07264dfdd3e55bb3161fcb2e4a9a78b74701fcd3f39fdd081fb4abd473bf6000bfe495f770e7839df6bc94b20bbd
SSDEEP 384:ErkZl/0TQoI4cy2+FtVpQe0+npXl3ELXBtZTrxTP5TpMTg1uuIdlAmtkr:6AlcKFd+Ft908lRELPZTrF5TpMT4uuSg
TLSH
T13EC2F1F0CEA433A915F9DC25239F64EC5526E2E3101DAEF1CD7268C786C991625AC2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 63KB
SHA256 402998d8b893572ebc3320c44f843f181470dfd58013c1e9636d3ec34bacb722
MD5 56e178f4154b8b2890cdd20d88799528
SHA1 b24bb245d0158a5eaff94d914f7b160758eca964
SHA512 0e6eddecfc84e6b13a9398590d1b58276262a7048c7df76855afb4f782ea8bf3b316e72f1d82a5f1446da0b169a4ca04652a16650038fdd242f2843a4ca1c429
SSDEEP 1536:KtoP87MW9OIwIAVFRyAlZWJxXAECJOyFXt1tOamMfHw9hSe:2ok7MW9PwFRjZWJUlk
TLSH
T1445302DF49A9C224AE697E26F2A136DC0C442B35002DBA984C7F4EC045EED167DA74E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 5432fec3ef6610deee2e8ce6a73a61c39476b3217e984144c95e5fe0fbe1fed0
MD5 b253d23f0b6faaa29571484a6d1f3c06
SHA1 b9adf6dad38beedd7115b688019ef57c2ef06dba
SHA512 02dc39010c3eb5e30b0fc041178252974141a79aa9d303a80b69da1a92d9c1d16e68dd536e7b573f44fd66cdb956fbf8679c2d90ab652e9520a24cff426044a1
SSDEEP 192:KlsjjB+qsgHont/AznKXCtWSTELNctJBtmDPQ:KlmUaNlTR0PQ
TLSH
T15122B8DF42C38831CF532238FAD8CE8871B1B1AA654B9F6317152E7E54063FA9E26470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 85f6df4bfe7ad20efdc00a8e2b9923c7bb3849f24c03dfe1ddfc516262dfb324
MD5 25e47a47093b730604b069f0d9e7ed85
SHA1 c569fa748094fe746354c680d347130ee7ba53de
SHA512 d9bd956d6cfa76ca729d377c428bcf933ef49646e653edb3483c0b5f6bf8b66993394fbc1c388d746325a1384d1eda2c49e01d4151911bd492518e9b9090b7bb
SSDEEP 96:2RKilnpajEPBk70cnsdQT6UjynCbdPAntPmPp/XgnoumIJT8zXvXzQ1wTuA7ao5C:+jML+Cxonkbsg5T0SffoP
TLSH
T152D1D7EE82838474CF63157DF2D4DE8935B272FE29479F5227412F3EA1163DA8E26094
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 a115f2080fbc69b93ac1e0c677cbfd6363cbdcfee071f6273f68912d2d31a6b4
MD5 bed51a984542ab43f582920fb896a3f0
SHA1 95da40b9dd7f5b3c9eb19e1bc4cee02af9cfb59d
SHA512 bbc0dc09bad465c7c40236795f1821c130a84f7351a73c96e0492a33a0c4a9469f1bbda27930534302937bf5c33342f6d563eea1cef41de8958b6583073fb95d
SSDEEP 192:EjsjjB+qsgWont/AznK5CtdSTELNctJBtmDPh:EjmTarsTR0Ph
TLSH
T1E922C8DF42C34831CF572238FAD8CE8831B2B1AA654B9F6317156E7E54063FA9E26070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58aa16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aa16.TMP
Size 3KB
SHA256 a39049098ee714f6b51b9a7bf615d2a594526579cb47abd4e0195beaafef19dd
MD5 6e484669af7977d6b732b4ece74309a8
SHA1 67e0135eb7eeae6dc29506328cd3b4cabb42d621
SHA512 2c9dbfc8c46f71f81c1c80a399ce22aa8efd400723a588c235039b409fb706b90717fd591844e0d135ee27f4c7054d66f9958330c1a838d3082a978bb2e8497f
TLSH
T1FB616F69974208B4CF6316BEF3E0531238F2B4E8391BCF62159079BEB11676C8D7B558
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 21ba15f61fd216ad4f07968663a0befbe61cd924954b7a636613042cfe733f76
MD5 4d54dda1d4124f48c652ab8da7a754d1
SHA1 4e6c65912348a8d281ada54d206aabda98bb0a2c
SHA512 e997876d211f2c7116048caea5d35ddee9d486cb19fd409404b606b3f20c94baa2705c89edcbd8cd5b7d640741cc063f6be411816e0928193768892c0184d058
TLSH
T164B012A600300101C7434378D7D1C4C47420084941490A210181C5168015960C6241A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 524a2079c5961c4c3dc871f7d81f65164aed832a0004cd12a92a66aec2aa9c12
MD5 4d761f0459444253290f8823a2c54e21
SHA1 da7599311d855f0f4e6c1c420dab8c4f100da678
SHA512 b5240d55264ce2909797d25caa47a1a90a5ab5a1169c3037d9dfc262cb7b337c5481503cbe0aed253f8733c1b4d345861cacd61b280d8ce8398d862070228927
SSDEEP 192:DyMYczeG1iQcVGskx+082LRas3eeRjMyrT7Qb8RFuT7q0:DyMYczeG1iQcVGskx+082LRas3eeRjM1
TLSH
T14AE128F783F9852D892391F0AB18EE1FCE591925832CF939C9D55E57A3E24B1E100B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 786abc1dc9e56c5bedcc2deb8754a9a74cf0ae9983aa65a352cb16f33ae8c053
MD5 b592b28e7665253bb074b0080ecac9df
SHA1 79e936fee63458954d127f8b4f98caee3a932cda
SHA512 bee047d45a280fd6d839142ae45e9b1a0ea79536cd56cc4954c04f841466f510c8dd31f32ab8f2459d24a252d1090a7aa7e63a1931802c1979c589e58ada065e
SSDEEP 192:sxZoR7yM/jK1Ml8Mkz/fasarGIdpvAHW6+WN8T24/YwXMiYIgrJ:sxZonMz/fasarnIHbd4/C9
TLSH
T11542E815AA34A97BCCCBD209FA55BF53D6F50572A2900E44ADFCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 46e33c79df84ef20ee73c0b04149ab210060900975fb3266c8aa44efd6deb23a
MD5 a25328637982e23b209f4323aafc2b5c
SHA1 d6c26c883c092b8556149e7d28d47d11a4119999
SHA512 f9a18a243fc5b1c2ce9bb5cd64e65e06253ca634e050b7fac68e9d60190fcfd1248724f8f76ba12bc277dd83c5cbc00c974acac8fa82c4eaf2fd14082acde4c0
SSDEEP 192:sxZW5R7yM/jK1Ml8Mkz/fasBVGIdpzodAHW6+WN8LfZYw32iYIg5bJ:sxZIxMz/fasBVnXHbIZ47
TLSH
T15152C812AA346977CCDBD209BA457F53D7F5447292904E44AEFCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a2ed9e28913f953878e05627fa19a706944d95ac48da0b439f71823519a82b08
MD5 033ac49481a464ce8a363f59dfbab277
SHA1 c8b83375005a3759544126089dcc82e2b092a03e
SHA512 7a9be1b6d0d2b9e1d0428636836b9f07efdab14e432d7df06cf3ccf84283a471d04b8c69a12509745a1aa0e5f154ae3dbe52da0cb40bb7b742d2a2f436f0fdcf
SSDEEP 192:sxZW5R7yM/jK1Ml8UQm9z/fasBirIdpFodmiHW6+WN8oGxH7/YwWVHYIg5fJ:sxZIxqgz/fasBi0cHb6J/Hr
TLSH
T1D862D812A934A977CDCBD20DBA45BF53D7F9006292804E44AEFCC91C04E6BED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f66c659de84892047f60bda44ae3bca01d893a34f54b6486fea8d6f7b2137aec
MD5 3ba4fe9374aa631b8bb685dd9f4039f0
SHA1 68884aa53a5a438a72f64d44a3d8c48a964856a7
SHA512 4bc6ba10a498a0d734a9089c06c9a49753d4ba3ef81ec174169058afb46da649f33e02f7bdb83571d41847021aed5caf77b1f0f901b8f84d9f9a06ddb8d5efc4
SSDEEP 192:sxZW5R7yM/jK1Ml8M9z/fasBVGIdpFodAHW6+WN8ysFYw7VHYIg5bJ:sxZIx1z/fasBVn9HbaFc7
TLSH
T19552C712AA346A77CCDBD209BA457F53D7F5047292904E48AEFCCA1C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\950ed387-5df3-433d-a370-1487343f9c07\index-dir\the-real-index
Size 72B
SHA256 96586e1c699bfd2992384a775b2df3e3d2b3e3752476e3c1987f94a6880ec239
MD5 d9cc1fe72cc662bb367e7854317e5a79
SHA1 7e8b654423773f64069bcf5fc95993c0f27353ff
SHA512 25958e9e0037cea203dd78bfcfc895f9965a23a0b7cdaf2f20889a185685620fc8bfcf889d84941a46061512a81fcf23ecb25650ac86dcabaa37af6386b1d17b
TLSH
T1FCA0025016800162D548537590D982567B18482107429223889008948C9B353C217214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fd28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\950ed387-5df3-433d-a370-1487343f9c07\index-dir\the-real-index~RFe58fd28.TMP
Size 48B
SHA256 5f1db58f3e3c5170c79309c1c455941bd5560e5488c056bc2fcc95845703e463
MD5 9f0e386a7e4be8c74ae73465a262e8ff
SHA1 3378ce9f49db1aebf9a2a57797d0044bfb28bf73
SHA512 c23989264807a86f63e6aaea68ff1e38a9b8f347ebf7c6a8fc735ab20c5225daf7c1cc604131fc40318bc5b18c8e5699a9e7553e121e05aeacd9fdc24bcb6303
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt
Size 250B
SHA256 e06c791fba37a69fc41dc99a861f4ab4e396210be751342028dadaa86e0cb4bf
MD5 ee5c28457f2bae0af5f13f9cbe733d3a
SHA1 24bbc35083fb02319f5ba0f218bb0c08d39491e0
SHA512 2834842ed1f61134a99ea14619620d6aaa8a143d6885ed34348a853eedae254f46733921be3c159ed3341d7e64c10aee1aa476bee7fd6a694acea3bb0f82aaf0
TLSH
T1D1D05B772671A2107B224A8D46ED351CA93EB1846B50DA58C123911708F5CA22415D8B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58fd56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt~RFe58fd56.TMP
Size 256B
SHA256 c8dad27cabdc76f7aad134bd806e5ff93f32f24ebf8985c518a489a79da04dec
MD5 aee461f9b1c095376aa960b22b5aa511
SHA1 aa1abd63a8d2e4bcb7c78e769f87dfd1b191b9bb
SHA512 a87f04131aa85b1c47512ec1f3bc3d5e64b9fe9feb0ccabb6351884c4e97fee22ae39a3f4c734ae196f1cd288557b805ed323d0ad10c7e000142c6f7d4178f06
TLSH
T127D05B772671921077224A8D46ED255CA93EB9846E50DA58C123B11704B58A31515D87
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 35KB
SHA256 7a1fd059e1bafe15b228325eb6bdd52fb2f7cfe631a18e9b39022cfc26399759
MD5 133766ceac983795e4c26de3a4ef575f
SHA1 e05dd2a5add677ca57f196895329f749f423afe2
SHA512 a4f8cbba0e7039603b7232436bb5c724f499566632ca8afd07d295d6e5a925c429c4c6a8c8ecfd2fbb70bc8a92643b042e24a26f3e6519b5e53ebdd02538cc42
SSDEEP 768:7WUCGxs4/9xnnI9jqbh+18ZpO/IDxPCkJjUe8GxkOt0s9u2rMKii/TXUd39YubT9:71LI9j8GoxPC6jDFxVM27/g4uHzIf8r3
TLSH
T141F25DC5B73461B3C7EA45B495371313723661483D0AD4E1B3ACAEFA0DA1A87493AF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 77KB
SHA256 5f362d852d03e8cd5703de023817b2575e229b570d4c12058cd463b36cf5cff1
MD5 69aa5ababe3a3066571eaba75476b8d7
SHA1 1a1d7b84b3066e232c5ab633c91dc9e916dd2965
SHA512 348e2958ee47b05435ab65aeb453b67b861128e55691e12d941f1b334b9f597e930a4ce73c2d20911ab8667a2c3985f4c95fdcd932213648b769b75d0229a5c3
SSDEEP 1536:J1tmml6F3WJPYhmd90N4yhwJDWcirEPxcTnpa8Gh/p5BC3Fyxsq8zp:JemlQ3GMmd90N4y3/rEPxcTnpLGh/p54
TLSH
T181732A430355A52BCE2B83FB9197491B3379810D7F83C36A66A5D3392C263F78D8D926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 51db322365df411392747e1589b2724e8566d6a19d5780b6b35a146405d65f6d
MD5 a6338597c33af621ee7748e5220a03c0
SHA1 30f22e71f65f264c0317c9642f3cd4562c0a5fe6
SHA512 cc6ef2faf92dc5ee2ed799383da42cc03538e7c6765a313590db21993d2f60d699796184ec2e69a4be819e4f26d48f5281501cbb43a00af7a2d3599e4102913a
TLSH
T136A00252116C4643C50323F8AC42438423D9C9108215732744E400548CD4AC1D913258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fc8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fc8b.TMP
Size 48B
SHA256 11577491c2c59913110f1edae9ab1333c33668e65926aeacf343480a26a9745f
MD5 be38cdc5358e72c0cfc737f43333cc52
SHA1 21e3457022392fded2367668569a14d22bfc0da8
SHA512 054a0dcae401822c395af82d46e25f71ae9eede67114a8d622efa5497b49024ed4ac0d91dafeadc6ceffcbf8b23499ecead911c9325c36c42cf7f21441b0ff2f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0b8207085b63cd16b9963f8cc6b54d672ec46e9a748e6fc915e0536e4535f815
MD5 063cd45c762c4758fa915f031a4afc24
SHA1 cd32c092ac4d8a69461d6b815c5d2b17aa8ca9bb
SHA512 acf32db2085835cf364e6d66443e2d4ac2c62db1d8d9b17dd81e53e6f44610476f7c6893c5a43e0a27513060f330b76d6967e5cfbca6abca5dcd2b44c9149010
SSDEEP 48:KNOfCuD1IxKuEkDylrIBKsIMJdRd2drdPdBdfdzdHKd7dQdeIPdXdHK4dGAdVdHC:K41KKuE6mrmKsIzkgKt2WV
TLSH
T1679130CB75BF12112C7E695D91A4872B074276637019F42B7BAA20A10E6BE341CFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c25271fd-cafe-46b9-aa2a-68e27f20da1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c25271fd-cafe-46b9-aa2a-68e27f20da1b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8c21209-888f-46e3-8911-a70348c6f21d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8c21209-888f-46e3-8911-a70348c6f21d.tmp
Size 30KB
SHA256 d50f8c0d069e976b0ffbf65dd93b730065eca364368d55ed5e8c975e90a1bf5a
MD5 9bfcc86b09dc5a3baaac54eeea462bd8
SHA1 56aaa4758c980237da679ac53b46714dc1134e40
SHA512 7a97b48fa12c0b95f018508cc267f3073014fb4bf34512e17d47297c106b32dbb43cfd42ea29630ff6670e173ec8976099c6be1f5ed1ab03fa6ed12aca869e7b
SSDEEP 768:pG4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+diroh3cual:pG4jeXmWvmKLEu1jacPLZQd5qX
TLSH
T19DD20A3B284CCF7E4F844E5CEC2AAE976ED801CB6A584D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59302e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59302e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8210eb9d23129795866baf370f154aa4cadf5fbab69fb5bf8fc7ad70932798c0
MD5 c369af33ee03e5ef920bc8e9ff691e2d
SHA1 8103f637b2bc3ec54bb86f41cd5dd663131ae834
SHA512 1537cbb30b3c9f75a101605bfcad01231196151e4eb1ca08f396da419db4c8080a66d758e5e1fd254584bedfe6021d65c3bd85d94f8b58afc0b6d605a864e268
SSDEEP 384:CZcIhsNEBJxZ/ovf+o8eHXo4FYVMsRnlYkR/:whfUnx3omUhn2kN
TLSH
T13F928E329C787C765DE6A542F48A36138FF8913796C57F84D6ECAB1C009AAED0316C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 75b216fa7d0eb04b8daac5a696d72979662e4629938dd225da7dbd730b34550d
MD5 7568859172fc80e96185fd911ffeadf8
SHA1 b88267510959ec6782f5c2624e484fc7f7482a18
SHA512 72ef4503ab30e82ee7bc54ec00fecda395a72c7f472b89867e0aa1cb3321ceeeb72c614d4357b59721e3b53734ec1b93bb8250aac01fe919d2d66094ad1772a9
SSDEEP 384:GiFiZcI5zsNM8TUNTUlIlwWxZ/ovf+o8eHXoLFYVMsRnlYkR/:tFQ5Rwg3Unx3o5Uhn2kN
TLSH
T15BB26D339C68A87BADF66A42F49A36138FF85177D5C5BB84E7DCAB1C009A5EC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1bea87af16c22bd8f9d2c3d9bcba9e266ed318fdd0176d30d7fdfe20342b8217
MD5 4706d6d9ebbd25eb4d9c8ca64ad2bab5
SHA1 5de52402ecc77f614c8f17f5840fd0296f97f4cd
SHA512 52cd0c2304bd4b0e690e5f56e0c72380ae0570d903fa84e75eda62c0fcfae45a19fd5397920330d96f7e580b7c7ad133de575a2b742dbb50325e6d09b78155ea
SSDEEP 384:hZcIhsNEwJxZ/ovf+o8eHXo4FYVMsRnlYkR/:phwUnx3omUhn2kN
TLSH
T19F928F329C787C765DE7A542F48A35138FF8913B96C57F84D6ECAB1C009AAAD0316C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45158dcca9d899cb7e900ac8b28610040b563cc94b3c949d149e7e88fff73d9d
MD5 8a96a7f078e6276ac9214c484eae0ec7
SHA1 a27abde92b7caf9041d933865400be1dd6044e4d
SHA512 a058e9191e77be09618d406c32634fd667085dbcad7c7d8b2ceeb95c93d6a53f6b34930cefc7cd7cf58513d298c94eb23de30611e1110dd93f581825e0d2e2aa
SSDEEP 192:EONG6hZ0QmiUyZZpc/+jVSjzor9oZ5wOZYaU6:EONG6okpu+o8eg2LU6
TLSH
T1A702D83568687C678EE2AE45F48727139FE8117BEA956F84D6F81B1C00D779C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 744fe4489469594c6cdb9d32d1726848697bf76a629bedfa865f27cfc0bc04ee
MD5 db4e41c0e819f288fa2d82610803997b
SHA1 0485c71b8b6d2bd69436b7788869830be58995bc
SHA512 318fbc2c947dd066ba5f398394188d05b05992f05dda0dfbbaa451b662f1f6373a977dd0d68fd0c1779cb9c1af6759a7a82951e6759f428e2b259a43a8d0b3f7
SSDEEP 192:xONl6hZoQmiUyVZtc/+jVSjzor9oHXLEv5cOqMqaVU6:xONl6citu+o8eHXoC9YVU6
TLSH
T10A12E9326868BC675DD26A41F48736139FE9512BEAC67BC4D6FC2B1C00DB6AC1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85984e5c-2274-4977-b1c2-d7ff8efb2c93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\85984e5c-2274-4977-b1c2-d7ff8efb2c93.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db903b611825ba69ac5431447bb9685e57e504e929ba6153453c70171b0ea991
MD5 cd77734ffb4a50c41b09d079a9eb854c
SHA1 c0086d6b6321682d909ed9a4e5c3204d8827910b
SHA512 68bf414bf0427ff80070ccaeda288b68502afc1d52e2dacc295dab5092323cf6eef6b2a51dd9fe8914c4125a16e9ed4fc25c0a80d5d6ae502efd744cfc122b20
TLSH
T131411758AAFA1108B3B77E1AABF6686D487B78272F07D15D10010D4F0A73B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download