a9bf57138125df7be8cba9ad9c256e6eda15505a01792013727a673845cb36a0

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe-acrobat-pro-dc-2026.html
Size 241KB
Sample260910-gl82ba1ycs
SHA256 a9bf57138125df7be8cba9ad9c256e6eda15505a01792013727a673845cb36a0
MD5 4a77a5e0397a9dba0036bd38e915d5d7
SHA1 f50be4b805b57fb40a21b01d09ec7399953659fc
SHA512 2c0182ddf52e7b6cefe4f68984f64c75112a113fd6911a636b41711d5b391c7b3889f2d68f9dfc5c001643962f10ff9d385bab1e22c53bb8310db967b0e862e3
SSDEEP 6144:8P6v/pQg5Mmjx+qehFP01nckoPkIQZHoIfGfl:X/pQg5Mmjx+qehFP01nckoPkIQRuN
TLSH
T15F34096103F49CF935BFA36A5E8DF318A113AA00C64557EAF0BAC19462CDE5519E3B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334933044179089"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{F0A671C6-5A2F-4CE8-AEB6-445A14035306}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 560	4304	msedge.exe	84
PID 4304 wrote to memory of 3724	4304	msedge.exe	86
PID 4304 wrote to memory of 4112	4304	msedge.exe	87
PID 4304 wrote to memory of 4112	4304	msedge.exe	87
PID 4304 wrote to memory of 4184	4304	msedge.exe	88
PID 4304 wrote to memory of 4184	4304	msedge.exe	88
PID 4304 wrote to memory of 4184	4304	msedge.exe	88
PID 4304 wrote to memory of 4732	4304	msedge.exe	89
PID 4304 wrote to memory of 688	4304	msedge.exe	90
PID 4304 wrote to memory of 4732	4304	msedge.exe	89
PID 4304 wrote to memory of 4732	4304	msedge.exe	89
PID 4304 wrote to memory of 688	4304	msedge.exe	90
PID 4304 wrote to memory of 688	4304	msedge.exe	90
PID 4304 wrote to memory of 4324	4304	msedge.exe	91
PID 4304 wrote to memory of 4324	4304	msedge.exe	91
PID 4304 wrote to memory of 4324	4304	msedge.exe	91
PID 4304 wrote to memory of 60	4304	msedge.exe	92
PID 4304 wrote to memory of 60	4304	msedge.exe	92
PID 4304 wrote to memory of 60	4304	msedge.exe	92
PID 4304 wrote to memory of 1992	4304	msedge.exe	96
PID 4304 wrote to memory of 1992	4304	msedge.exe	96
PID 4304 wrote to memory of 1992	4304	msedge.exe	96
PID 4304 wrote to memory of 2704	4304	msedge.exe	97
PID 4304 wrote to memory of 2952	4304	msedge.exe	98
PID 4304 wrote to memory of 2704	4304	msedge.exe	97
PID 4304 wrote to memory of 2952	4304	msedge.exe	98
PID 4304 wrote to memory of 3984	4304	msedge.exe	100
PID 4304 wrote to memory of 1764	4304	msedge.exe	112
PID 4304 wrote to memory of 3892	4304	msedge.exe	113
PID 4304 wrote to memory of 2460	4304	msedge.exe	114
PID 4304 wrote to memory of 3308	4304	msedge.exe	116
PID 4304 wrote to memory of 3308	4304	msedge.exe	116
PID 4304 wrote to memory of 4708	4304	msedge.exe	117
PID 4304 wrote to memory of 4708	4304	msedge.exe	117
PID 4304 wrote to memory of 3296	4304	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\adobe-acrobat-pro-dc-2026.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb719fc188,0x7ffb719fc194,0x7ffb719fc1a0
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11468823145236056445,4815582482140498355,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,8165060626974824309,5476388945062979917,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,13418067644718002842,3255812298562423237,262144 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,14167403425860221924,10263079951540314028,2097152 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,12173472308888820594,17893101935879809496,2097152 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,7289853918652714144,7938320189202485474,2097152 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,11525853076988641216,2333616278120542860,2097152 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,16899561531444123576,10940351744441806852,2097152 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4904736779966391778,17162184350923077716,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,16563788156239265417,129577642705944448,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4702811707786095533,14099247585439685109,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4702811707786095533,14099247585439685109,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,18066852924307781151,12117550908669463673,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,15260124731987608681,17767950655222091212,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,5046445354022189871,11264950168450075972,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,14597455856875525616,18375058573112401830,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,14877477604468550776,1695948141315766596,524288 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5520,i,4529301333031674992,6315730223129853022,262144 --field-trial-handle=2796,i,13398880700032427827,6854698508017284124,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

1d031296-314d-497b-a2c3-44f15aed65bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d031296-314d-497b-a2c3-44f15aed65bd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bca72829cc5e8fbafeeacb5c3e7bdad71973b7591e10fc10a41a005db4ee5fda
MD5 5339e758285c80b93a008f41cb3084d3
SHA1 9772dbc1c861d3f804052f57e31c2564447de3ed
SHA512 7e8c5a0352928a32cc4797fc600ce6b85ae5ebf39d84c17ea0e3ab42a7e43ec636c90ed7e6aa5b021f1213b118414f605077c3724a8acffecb93dc5e3abe618d
TLSH
T1C07119370BF704A2DB61B7B1ACE0C2433471C6C7F517AE66ACE4AABD1D187518D98109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5885e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5885e4.TMP
Size 3KB
SHA256 a42eb64e9701ee95909b5fed1f15e2750f4c0101cf3b44a32875dbd5099880aa
MD5 23620cb81050aaf6e280f4dd2fcea64d
SHA1 c505e705c4c4719452b1d69589f77c9d7e5243ed
SHA512 d3115ef107d04e4a7edaf98e064f8fc2338870861e548ec8346e27ba21fb955d2a6c6502c6c993692ce7933938491b860b0aae3e991c4c3ab2999f7adaa85fb4
TLSH
T14E7108370BF70062DB61B7B1ACE0C2033475C6C7F517AE66ACE46ABD1D287418D98008
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2c6822b3066fde5fbaf4e1af0dbbe57a3d575a88522cc39859deaddc3160bb7f
MD5 a247e2c0a82159f69a78c4343f792ddb
SHA1 548d82f81525955674ad3558a2b9b6fca9ac5d7b
SHA512 11aab4e91c2bc4502fff81c8d4e10cd86f514fa2905502dc5de45055d1128bfafc4a2b2b9743b9c996d066178b831d243b4643cfde7e3d1bb71dd1201e31390d
SSDEEP 96:DAJOUhJh5e+UZY8o1gvuzW7FVVboouGwQ:DAMUhJh5e+UZY8ogvua7FVpoouGT
TLSH
T176A16BB6C3D4836E881256F09B257E16CD2D156B42283C5689E5EF5F63E24F1D20229F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 81964be5f4ae5cac345b0cca6c63faaf0ffeb4769774b46d56b013e7230501b2
MD5 fccca3b5d0e9749bc922d7f50aea1dfc
SHA1 b9c3b33c5a0ee799dde2da63b2cc61cddc982cad
SHA512 0b180d749902266f518b84453a0e493ea773ff797a8a860c3445be1a7f025d5ef764b65b8a7c366fb2cd280fa1f33f93346d697010398c1a566eb1d2fef319b0
SSDEEP 192:sxZDRjyM/jK1Ml8UQKWp/fhsEYxIdpHQHW6+WNGYI5D20Ig5YJ:sxZDvqlp/fhsZ6wHbGnm
TLSH
T18D52D612AA345977CCDBD20CBA41BF53E6F4557296900E44A9FCCA1C04F6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 491264c0a65ee348cf43b98411ba3217ad7497e5ab88a0be4e71ccb476a8b386
MD5 f458448084858870de0f36cfdaf6c53c
SHA1 e140ee7ecec60718371609cd6317e6df74b5ca8b
SHA512 5393283777a34923863ff1d8b00acabe93eabf3656e62237e63947f21531923b0a33bb6bfc9f165e2524a11d36ae6c6a507c11638e35f96c71493b94464f0f9c
SSDEEP 192:sxZDRjyM/jK1Ml8MWp/fhsMZxIdpdQHW6+WNGYIkA20IgrJ:sxZDvup/fhso66HbGf9
TLSH
T14842E711AB34697BCCDBD20DFA417F53D6F44572A6900E44A9FCCA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ec51fd6e99042bab8caac0ecb7a39398b17f2a55f5ebed4dc91f56a69780cad8
MD5 5589d02853a927c434d2193ba5b81802
SHA1 991985d39b6834494ea98727dda85d3100ded43b
SHA512 17d8a252e9171c49562776a9dd8dd97ff2c78f9ee08b5bb1c513190c8a30f71914db2718605f2d4db09b400e902d228a0523d58fd34215761ad5abff99a92336
SSDEEP 768:S0sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR99ro1yhc:S0sqxXlWvJD6Tu1ja54LAs921ye
TLSH
T153D21C3B694CC77D4F840E6DEC266FD76ED801CB66988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a21f0f3-566f-405c-9ea7-d07c702e945f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8a21f0f3-566f-405c-9ea7-d07c702e945f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ef841504551d3419cc36ce5527e4daba3a6adf4dbf4ba260ec8c9175748794d6
MD5 f3042ff7a616c2c9a427c9aa367716d5
SHA1 27960e529a4e0be6f52c833c5f6513fc52c4f95d
SHA512 5690aa3d03ee13ed5fe53d6b1241f72579315d4531252bfeda07b2c7d0977f0c83a8d66d8eb2be068bbaf58e0b7ea56ffd1a81f460f24969ebe9b846451c4352
SSDEEP 384:rZcIhsNOg5QbqbvnVRNPOwG9OCK6xuvzxV+MhdpNfXoq:zh+VHPOwG9BK64184pNfXd
TLSH
T1D2827D316C386CB75DE6A245F98B37034EB89077EAC85F80D5ED6F1C01EA698131EC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5ae2bc2cd24e49842ae56d28c384af98fe2f867bd5eea08d6b431312b9060352
MD5 8c0085a95d390a7f0350d980bfc59fb5
SHA1 f3eff541eae606f7b75d865f20bb1448be9baa5d
SHA512 53ea290748fb9a697d2384760cf9d28852bdb7c8f241b01d3b213574e3eed2f036a14c73fd76155bbe740a4c443b78a40f83ced30a7e6f6bed8fd03585be973a
SSDEEP 384:4iFiZcIpsNe8TUNTUlIl/5QbqbvnVRNPOwG9O9K6xuvzxV+MhdpNfXoq:DFQprwg/VHPOwG9IK64184pNfXd
TLSH
T11EA26D725C689D7BADFAAB45F94B32038EB49077DDC4AE90E6D95F0C01AB19C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9592efb56dfb59e714ea0324c09fd0541bc82f6418cecd89b351e4be0de02dcc
MD5 27cfeeb82a5703eab3ae90acb4138648
SHA1 53c591fd7f586465fef641afcbb943260a95b9e2
SHA512 92e01fcf4709ee1294e4a556d400be6913c7d7e6827b8146dbb71119b25af12ea6e63d47ea2d4a6abe4d5a9ea48e2ab22fd29018a84e0eff62e5351ad88cc59d
SSDEEP 192:tONY6JkRtQmiUyXtW+RNPOmlhPXh3KjRmoU6:tONY6UryW+RNPOwvKBU6
TLSH
T10C02C6356D382C7B9EE3AE09B98B27175FA4217BB9956B80DAD81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 781d1795586b3f5983a7d79c69ca32d27efddcb64b25e1205eb5cba68bbf6646
MD5 6be4b3314aa68cd8cb8c50b85dbb1339
SHA1 04be6c9d413bd8a1477fd150fbf259102fba5cbe
SHA512 d3f87e1d5ae799f0625cdbfeff0569ac43cf1ef695f82015431cf76c020d8e1ed337113dabac5541a97c627fe3ca84cb907f9675754f588182148271dc5c925d
SSDEEP 384:kZcIhsNO/5QbqbvnVRNPOwG9OCK6xuvzxV+MhdpNfXoq:ChLVHPOwG9BK64184pNfXd
TLSH
T13F828D316C386CB75DE6A245F98B33035EB89077AAC85E80D5ED6F0D01EA69C131AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fee70e45a678ee7a560131c76c9f5ddeeded9d3a968191ebf5919cad8211310
MD5 da97a30f5b2b6b1b07f37c6322de0c49
SHA1 4420ed98186f7c2a77cbf8ea8117bf0fe4833b76
SHA512 75c828f7321360d68df5bd9ad8954a9dd5e0c79705b5c06c769b7ec867345ab39b1d9d02f4c3393dbf5b8a80d9c804a42f889206fc9ddab8f80e53b03e963b60
SSDEEP 192:GON/6JkRqQmiUyatV+RNPOmlhPoB9SFSVcKCqvCU6:GON/6UmlV+RNPOwG9O1K6U6
TLSH
T186121B3168385C6B5EE36945F58736139EB4513BFE896F80D5DC1E1C02EFA9C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50fc3859-2b19-4cbe-855e-19d6e24db041.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\50fc3859-2b19-4cbe-855e-19d6e24db041.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f06a0a28343d7d4398dd8a3e6d50f1a50b0e2d3d8fd07b616cf5ace4269d124
MD5 61f44ffa10afc7ec46303b4e58141c25
SHA1 4ff6e8beb29a1e293f4840cb982eda518a28b494
SHA512 5adec2e452fcd366ecc981b4f29284db7896f9fbae2c3bac4ae0bf0266a99ec21a1abbe61fdf21b98b623b11a7addcc718b1679488f89da34bf68a9c7773eba7
TLSH
T126412958A6F91148B3B77E569BF6A86E487FB8372F0AD55D00010E4F4A62B40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download