e7fffb71f1651afc1070d42e06dc2746b9e1194ef0ca7e70b76c25113ccb7f3b

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe-acrobat-pro-dc-2026.html
Size 243KB
Sample260930-g86jps1tgt
SHA256 e7fffb71f1651afc1070d42e06dc2746b9e1194ef0ca7e70b76c25113ccb7f3b
MD5 d490d31d243777ab2cb1c58a1874ee19
SHA1 213969a65eafc4fc1f57797aba093cef2c5c9a55
SHA512 a25e772d9a1c347742b6c0779782ca414778d387b34de8ffcd3fe54e380836353dbbbeee5934446d702f060a4b0db155078ca61ab58a2447bd279b512f4827dd
SSDEEP 6144:WBt7/pQg5Mmjx+qehFP01nckoPkIQZHoIncBH:4/pQg5Mmjx+qehFP01nckoPkIQRcN
TLSH
T19734096103F49CFA35BFA36A5D8DF318A153AA00C60557EAF0BAC19462CDE5519E3B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\exe\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\DLL\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\exe\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\DLL\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\rpcrt4.pdb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3860	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{4E002659-D982-40F2-88F4-79356A9BD953}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2248	3152	msedge.exe	88
PID 3152 wrote to memory of 3860	3152	msedge.exe	90
PID 3152 wrote to memory of 4112	3152	msedge.exe	91
PID 3152 wrote to memory of 4112	3152	msedge.exe	91
PID 3152 wrote to memory of 5628	3152	msedge.exe	92
PID 3152 wrote to memory of 5628	3152	msedge.exe	92
PID 3152 wrote to memory of 5628	3152	msedge.exe	92
PID 3152 wrote to memory of 2792	3152	msedge.exe	94
PID 3152 wrote to memory of 2592	3152	msedge.exe	93
PID 3152 wrote to memory of 2792	3152	msedge.exe	94
PID 3152 wrote to memory of 2792	3152	msedge.exe	94
PID 3152 wrote to memory of 2592	3152	msedge.exe	93
PID 3152 wrote to memory of 2592	3152	msedge.exe	93
PID 3152 wrote to memory of 1956	3152	msedge.exe	96
PID 3152 wrote to memory of 1956	3152	msedge.exe	96
PID 3152 wrote to memory of 1956	3152	msedge.exe	96
PID 3152 wrote to memory of 4652	3152	msedge.exe	97
PID 3152 wrote to memory of 4652	3152	msedge.exe	97
PID 3152 wrote to memory of 4652	3152	msedge.exe	97
PID 3152 wrote to memory of 4748	3152	msedge.exe	99
PID 3152 wrote to memory of 4748	3152	msedge.exe	99
PID 3152 wrote to memory of 5380	3152	msedge.exe	100
PID 3152 wrote to memory of 5380	3152	msedge.exe	100
PID 3152 wrote to memory of 5632	3152	msedge.exe	102
PID 3152 wrote to memory of 1232	3152	msedge.exe	106
PID 3152 wrote to memory of 2096	3152	msedge.exe	107
PID 3152 wrote to memory of 1316	3152	msedge.exe	108
PID 3152 wrote to memory of 300	3152	msedge.exe	109
PID 3152 wrote to memory of 300	3152	msedge.exe	109
PID 3152 wrote to memory of 1844	3152	msedge.exe	111
PID 3152 wrote to memory of 1844	3152	msedge.exe	111
PID 3152 wrote to memory of 1844	3152	msedge.exe	111
PID 3152 wrote to memory of 3204	3152	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\adobe-acrobat-pro-dc-2026.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ff9b3ddc188,0x7ff9b3ddc194,0x7ff9b3ddc1a0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,12232174463009042572,3358814003097915859,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,12631043912935632738,3584160646470938776,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13658326392988734029,18397377908549783960,262144 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,3552413247813004415,11438832129451872317,2097152 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,6940406531563356537,18419314585782528417,2097152 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,8840802565592922413,15030714697829074372,2097152 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,4266203890283479940,24944206402502547,2097152 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,6892511239889646581,8741499316135287376,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,18407252541200259710,9792070086332432953,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10678515506188973728,15368983623959094549,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10678515506188973728,15368983623959094549,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14222962839967751508,17049493625678016339,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,8673091835933133391,7255391453391130074,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9701714289825766634,17646724317267666403,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,14836732331471273851,12346456020951941796,524288 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=5060,i,5341550911686823717,9258119861770322731,2097152 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6896,i,14505849860124271056,12161500175499916355,262144 --field-trial-handle=2756,i,9590347253473238373,15643866789447947603,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
Size 114B
SHA256 1b14c9ba71de606a92ca484f936decc2a9925524e3bdc797c694c293944bc37f
MD5 3efb6ee63b38d15659c16c13bf37a0a0
SHA1 b082f3dd4761f641a5c5dfa6ca8106a3d6303548
SHA512 a490d011a41efcf15323e125ba276e0270b381d02abed546018affb96736f3d4000d917ec94acc51c3cd0096cb6d02a7a6509e86194a06a1f13a5cb75d06c9c0
TLSH
T1B2B012DD27413709C0074F334ABC53001656E920B75763008113E6CC1F21D094901220
MD5 SHA1 SHA512 TLSH

Submit Download

dd8d97d4-9698-4c76-9155-36f67488cd34.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\dd8d97d4-9698-4c76-9155-36f67488cd34.dmp
Size 808KB
SHA256 cda63fcb783e3a01bc64c617631a35fbaf45ea9121434930ade1242ecdc34960
MD5 b0db7748c173946f258b5c577d8d823a
SHA1 a65c74c3a49b49e72c2234f709e1fb80eab58a4e
SHA512 73f82264211f08ace29ee84490b165caa16e8f724f5eecfdb67c250a087d5671a8430726e36691da9561acd63fe608fb94795d397aab8832cb4db701c5188fca
SSDEEP 384:CuOYaVD6hQdw7f7nGz394kZWRvgZLISyRtKKRKKKwvvrvw1B6a:BO7D6hQwj494ksgZLISSvvrvwn6a
TLSH
T12A05539AE75609B7E4080B3046D72B19BBF6D4941FA3EB5EDB20453EEC6F3049A70E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f211ad3b8cceb115e85bb3587f900f7b57c763b18b837737bdd4523ed4de0950
MD5 3efd9e1a9e4bc75bb5e72db4e7f5f55c
SHA1 d7838374508e9cd780cb1d4ac8b36636c070c76c
SHA512 5897f4e962996fce838270b9d1dc0c1ce0594f3494289c4a6e91f06a11ccc6e677d3ab64762b44ace2db6b46961ffddb2c64a44bcc5109e7709ee6e7dbe0043a
TLSH
T1D0D0125999699AE5E43218B981E14208329966929D02110A64405D150A7538204918E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3a19ba2c95452675f581acfe51851b83e314fd5cd978dea4602a6a851f8e8002
MD5 b99443ad070567350ae0f2a5c51ec15e
SHA1 76cee42df881d3ed191e4060bd135d80ae61951b
SHA512 dfea6801c87cb977edf8b7706b3d80636605d721e4aec42761d436b4ae2434b9904d7a4b9201ca8e273f6a55075a4662fd7524119554c9647ca62770d7656566
TLSH
T11241C66384A4C355EBE2053687F06393367085F0AF831C13B96CD9B1BBC6B658D24C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1b78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1b78.TMP
Size 2KB
SHA256 df7c127d5a9cbfeea1a04a2ecc3977bb5e3db65da48a198accc05ed02b516263
MD5 6e4067a5b62bb059195b9d41db42518c
SHA1 fcc9ce8d2a1b6202df0d0f6f6cffdba1f4a364e2
SHA512 dc38626a85260f5451e63e5aec3b625bfd2907eb23405227a0c04c4cbb7dce7df3466257666ddd67828ca5a1838fca483359de82efd618badba1f3ece852c721
TLSH
T16B41C66385A4C355EBE205368BF06393363085F5AF831C13B96CD9B1BBC6B658D28C27
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dc61d5e6f2a96ba6ec8e50e5c6516ed5e4709d463fe4537fc0bb2360e5296ebf
MD5 e7f2f305ae1529ac2cc6cbc45caf1997
SHA1 dadeebdb3f6e021624fe5ca20c13230bd4299f6a
SHA512 394c8e667568587b93df318dadbf75a2543912e712687d46b369f431781f0540c04902d62baedd54451ec4664409d7e87cf0ed57f9e11894362578ffd2fe8652
SSDEEP 96:DYtOjpJ27nu0kVf0iejh9ZezAhS1mVbwvxBGwQ:DYAjpJ27uv0iejh9Ze0hS1mpwvxBGT
TLSH
T15FA1BEF7C3D8877E881156F09B287E2ACD1D095A422C3C56C8E4AF5FA3E24B0E14169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a971af259979c335d357b079a67b9a357eb9f0db911f2805cb3e0b9a5b6181cb
MD5 90d6576c1e1a2c98183af37e7c0b05b9
SHA1 2b038aae01bf7374135c32a18af7717c2adb2dec
SHA512 241dc4dfedb0e58a93bb2a18f7a3659480b89543e0cb98c8b793f6b354e3ebc700d4a23509d0a61a651487192a93f694f146de6f35b0c3c3f259bf700ad748b1
SSDEEP 192:sxRwRIbu/fCsgHRcSzoA8p4y/g6+WNIYE1uG6IgDJJ:sxRwwu/fCsgUv/5Iq3
TLSH
T17D32C719A968A97B8CCBE21DBB557F53D3F95032A0D05E48F6FC861C14E76DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d09f3fb24b19bf8b7b55a3d90de44bd66d6281d2415a23899ccac9fb0043330
MD5 b699fe2d933a20ff6ca1edef05100824
SHA1 91e08c3601821e5aebd43bd96c739ae0488d5e9b
SHA512 83c3657408328466a6a67216d87a1fdcfda2bcfec90527503f452e6205ab312cbc52a3b1e1efc27c9fce37cb1f89d73e8eefff434228c41ff568f0c93170676d
SSDEEP 192:sxRzRIbu/fCsFHRcSzoA8p4y/g6+WNIYEIuG6IgIJ:sxRzwu/fCsFUv/5I5s
TLSH
T1D832B615AA68A97B8CCBD21DBB657F53D7F91032A0D05E48F6FC861C14EB6DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 66c18f819fecfd5ff07faf4870030834d3aeb13fe5ea71d5012351bf4529a5b5
MD5 ff4407b1876663d2c047351e13002785
SHA1 41c0798b57c06b838a78bd955c7cef50ed8e0c6a
SHA512 0b63719bf31862c8250eeb73f18d9b0298d43c6c9c344c542c98b2f89b80ec017a6ddb4d0bd075399aec36288671e476b251bf89834fae6559e0c4fc4f1af408
SSDEEP 192:sxRwRIbu/fCsDHRcSzoA8p4y/g6+WNIYEIuG6IgD3J:sxRwwu/fCsDUv/5I5t
TLSH
T1EC32B719AA68A97B8CCBD21DBB657F53D7F91032A0D05E48F6FC861C14E76DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d2fc23576e36a3749b13eeb831e17c55d93038b245b76e1c9902646771c90c97
MD5 1c6af519f698dce9cbc82c5e99606dc1
SHA1 7b23f3135c4857bf3227c9fcc7004a48eff8a1a4
SHA512 34bb38c196df5c25ff4887395d6a12abe991cf489b4ade291966fafed8d7dd9da51ffc9afd7f5879c6cb9a0ac1af5cb6029d182785295b0a4699ad0775b588cd
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXUroJep:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0VR
TLSH
T181B2D92B640CCB7F4FC04A9EAC196FD77D9802CB9A588D4047FE995C02C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6c4cb2c6-dd72-44cd-9a23-7459e2c13640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6c4cb2c6-dd72-44cd-9a23-7459e2c13640.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7279db8754b5621da968a4241ed29870fe34df3b544e2c63c0ca4a66a5f9508e
MD5 4157e7ab6277f85ed811931949f02e07
SHA1 2f5a6c4b119a162d903b08ab2c5716b3884dd448
SHA512 a3a7fb96a2c7563f54ccd8d24619b97114783b6fe61f3106d12f81afcd3e60bfce55b7014178c6b1583a081dfd190ac3c31c8f7ba3ff089411b07031645115d4
SSDEEP 768:Dj3KE6c7fZrK/HKp5XSwQs88uBkiT2l2sGNM:Dj3KKtr+EILNBI2sKM
TLSH
T17CF2BF39E8D449B7ACF693857A4A37036FF09107D4C80A94C5DE671E018B7AE274F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6f49c42c80e3ce9da6000cd52ab42980f78e69642a9c3bf154f1704eb0fee574
MD5 37279be482330dbcb1c4eab6f982cda2
SHA1 32d53132bb6dbb445e60b2546262bb03d3e1c4ff
SHA512 ec03c9b97a7fb4bcab89be94909fb62fb4360359abdc8f04b20d719f1e8d854aab3785d099016d459ac85550ebf957ca28d8a6738577d41f7e0fa664c0d674f8
SSDEEP 768:nFQh30wgFE6c7fZrK/HNp5XSwQs88uBkiT2l2sGNM:6h3UKtr+zILNBI2sKM
TLSH
T180F2CF36ECC489BBACFA8781BA4A37039FF05157C8C486A4D6DE551D018B69E134FCA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 55367bb3414d7efa9fddf783024d0ec72af6fa7b10cbd7d544ee9d12ea6468d1
MD5 39e4689fac4a929d2e482957345744d1
SHA1 24aff0d4a6a28c752ab78f0c9fb4fbb856b4b768
SHA512 21ecfbc8b84a65242fbd40604de4cf7f87f05463bfc4e09c5e0243f18cba9cf618209b7cebd8b67bc5bde336b090adda10cc65adbc2b60e3a09ca46f71dd7987
SSDEEP 768:z/UxvxjgC+63XZ6c7fZrK/Hyp5XSwQs88uBkiT2l2sGqC:GZj3+63Xjtr+sILNBI2s1C
TLSH
T14503CF39F8D45C63ACF79385374A2707AFF05457D4C40AA889EE6A0E02CB79D634B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 db11cd66dcc8ca6d5a3792bf223331dfa00c5892a7d472ac4bd86874d49dac25
MD5 e2ecd2d0c03f5f4d5c6e8a075dd46e94
SHA1 ccf2f5424796ec622537c9757cef0a1a1ee7c2ee
SHA512 6a4537b5af33aff2e55c75cf87cf1bc1aebbfe5b992ab40de5d4721f173cbdc303af850277a408e1959e8fb30d43611044e9e047598349b64cc5608e9c72f0d0
SSDEEP 768:Pj3XE6c7fZrK/HKp5XSwQs88uBkiT2l2sGNM:Pj3XKtr+EILNBI2sKM
TLSH
T10DF2B039E8D449B7ACF683857A4A37036FF09107D4C80694C5DE661E02CB7AE274F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 49deaa16148062536b59b7f5a96b9af514e3303d9f1372412642432003453729
MD5 e7418405b85a9f2f39fd8f1cd809945f
SHA1 ca66d4cf80c85bbf4ff0f691ce0eaaf0ac894e0d
SHA512 b22e999183d55138cd0c6e72b3f38bea28a208f1bde0ebd26f6896a01a38dba672584304433807c8bbc46af9d1e7e24cdceee0039be06d1b87188cdd25946db8
SSDEEP 768:R/UxvxjgC+W3qYdc7fZrKsp5XSwQs88uBkiTCw/P84g:kZj3+W3qptrnILNBFHg
TLSH
T1AB03D039ECD46863ACF39385365B275BAFF05153C4C41B9849EE7A0E028B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de6142af-d4a7-41c0-aae5-025095463ab6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\de6142af-d4a7-41c0-aae5-025095463ab6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download