ca34361f44908f7910716bc7e129402fc950e6448f09d2545f0c5817a479c0d8

Analysis

user interaction
yes
max time kernel
36s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UMBRA CONTROL S.r.L. Proposta_protected.pdf
Size 55KB
Sample261110-v232wsb18x
SHA256 ca34361f44908f7910716bc7e129402fc950e6448f09d2545f0c5817a479c0d8
MD5 07f61ad467ad679ee2929d2aa94eadb6
SHA1 6dba8e965fc76f59de6982e27338c48e9495f8a1
SHA512 1bf8370631376c8a1c3dabfb9e5c660046eecaf924639552a9b18262c9c0ed38d2a5221c783fe7da332d912e968b376f20b5db4133f6ee9c394cc2d83974ccb8
SSDEEP 1536:fb4Ph+5v+eu3uevAnwRT6bHLEfZJqBjUv0:Dih+9LeonhbLQqB/
TLSH
T1D9430268516964EFCCD19F10AA0E3956D8C9C2171E94E62F80193E9B352EE37EF443A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
912	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{ABFF2AE5-3F81-43C1-A587-13C80C8CF29F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1956	AcroRd32.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4448	1956	AcroRd32.exe	86
PID 4448 wrote to memory of 3808	4448	RdrCEF.exe	87
PID 4448 wrote to memory of 4820	4448	RdrCEF.exe	88
PID 4448 wrote to memory of 4820	4448	RdrCEF.exe	88
PID 4448 wrote to memory of 2140	4448	RdrCEF.exe	90
PID 4448 wrote to memory of 4332	4448	RdrCEF.exe	91
PID 4448 wrote to memory of 4144	4448	RdrCEF.exe	92
PID 4448 wrote to memory of 3524	4448	RdrCEF.exe	97
PID 4448 wrote to memory of 3524	4448	RdrCEF.exe	97
PID 1956 wrote to memory of 1828	1956	AcroRd32.exe	99
PID 1828 wrote to memory of 1428	1828	msedge.exe	100
PID 1828 wrote to memory of 912	1828	msedge.exe	101
PID 1828 wrote to memory of 536	1828	msedge.exe	102
PID 1828 wrote to memory of 536	1828	msedge.exe	102
PID 1828 wrote to memory of 536	1828	msedge.exe	102
PID 1828 wrote to memory of 5016	1828	msedge.exe	103
PID 1828 wrote to memory of 5016	1828	msedge.exe	103
PID 1828 wrote to memory of 3068	1828	msedge.exe	104
PID 1828 wrote to memory of 3068	1828	msedge.exe	104
PID 1828 wrote to memory of 3068	1828	msedge.exe	104
PID 1828 wrote to memory of 4260	1828	msedge.exe	105
PID 1828 wrote to memory of 4260	1828	msedge.exe	105
PID 1828 wrote to memory of 4260	1828	msedge.exe	105
PID 1828 wrote to memory of 5044	1828	msedge.exe	106
PID 1828 wrote to memory of 5044	1828	msedge.exe	106
PID 1828 wrote to memory of 5044	1828	msedge.exe	106
PID 1828 wrote to memory of 2756	1828	msedge.exe	107
PID 1828 wrote to memory of 2756	1828	msedge.exe	107
PID 1828 wrote to memory of 2756	1828	msedge.exe	107
PID 1828 wrote to memory of 4856	1828	msedge.exe	111
PID 1828 wrote to memory of 4856	1828	msedge.exe	111
PID 1828 wrote to memory of 3376	1828	msedge.exe	115
PID 1828 wrote to memory of 3376	1828	msedge.exe	115
PID 1828 wrote to memory of 1036	1828	msedge.exe	116
PID 1828 wrote to memory of 2744	1828	msedge.exe	117
PID 1828 wrote to memory of 1036	1828	msedge.exe	116
PID 1828 wrote to memory of 2744	1828	msedge.exe	117
PID 1828 wrote to memory of 5164	1828	msedge.exe	119
PID 1828 wrote to memory of 5452	1828	msedge.exe	120
PID 1828 wrote to memory of 5452	1828	msedge.exe	120
PID 1828 wrote to memory of 5644	1828	msedge.exe	121
PID 1828 wrote to memory of 5644	1828	msedge.exe	121
PID 1828 wrote to memory of 5920	1828	msedge.exe	122
PID 1828 wrote to memory of 5920	1828	msedge.exe	122
PID 1828 wrote to memory of 5928	1828	msedge.exe	123
PID 1828 wrote to memory of 5928	1828	msedge.exe	123
PID 1828 wrote to memory of 5548	1828	msedge.exe	124
PID 1828 wrote to memory of 5548	1828	msedge.exe	124
PID 1828 wrote to memory of 5464	1828	msedge.exe	125
PID 1828 wrote to memory of 5464	1828	msedge.exe	125
PID 1828 wrote to memory of 5464	1828	msedge.exe	125
PID 1828 wrote to memory of 4468	1828	msedge.exe	126
PID 1828 wrote to memory of 4468	1828	msedge.exe	126
PID 1828 wrote to memory of 4468	1828	msedge.exe	126

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UMBRA CONTROL S.r.L. Proposta_protected.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9809719C7D3F73809A2E249056F310E1 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3808
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=43CA09FDCEBE8181DB37EAFDEDC2F4AB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=43CA09FDCEBE8181DB37EAFDEDC2F4AB --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=06F7DD8C621E4A59E6550869307D5157 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9903312DC4C43D113F01829A7B3D4D65 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=90B628B61DC05731D82668E540FD8C78 --mojo-platform-channel-handle=2500 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EA503E9BEAF84428D299168E15E7ADFC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EA503E9BEAF84428D299168E15E7ADFC --renderer-client-id=8 --mojo-platform-channel-handle=1916 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://al-manbijsat.com.iq/[email protected]/Index.php
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffc4b05c188,0x7ffc4b05c194,0x7ffc4b05c1a0
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3130092898352792057,10411016477319389486,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,14040871496121074026,10923227270490833135,262144 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,7073432871258103114,17066812267393285101,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5954241043561781652,1408655371268241035,2097152 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3048251895870456128,13158898716262877945,2097152 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8312576393129844638,3151842616869015695,2097152 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,17968662098808465315,13106486019919174488,2097152 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,5762458651928233215,15330959659082227457,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9641071979007968701,9138167173623549883,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8657012943017005659,6532649117870414066,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,16923787274023207298,17472500655228533334,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11766774967599779688,474179625854065327,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11766774967599779688,474179625854065327,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,278978964869180158,9132490809938664419,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10627916534292410534,4570631211326552580,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11677780002062164488,595871470645847036,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17231709876934957018,14706501425300918159,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,5695307881176520145,1066890074891482316,524288 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6540,i,1618744281502142423,15465990330316259092,2097152 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5892,i,14603241121277165509,8374386975324595274,2097152 --field-trial-handle=2272,i,17840184575739728046,3077603194338306956,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d2d7ff8808da4ef2a4c7125f2f98dc441488d52a2d14522ca05f680c5eb96cca
MD5 ac7b2694939a95e21b9e68acc9b7b26c
SHA1 dfb2900be0bb20f12cae6eacc43063066e67bd7c
SHA512 ee14e9b92f6106e193ea2ada2f1549a14e35498df71399c57377a2f00bb46ca2d0d5a539468f2a4b7a90bec74211e1dc6606c27c6717728d0ad36d707ec19959
SSDEEP 384:CeadThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:h+eUZsLQCZsL3hUS4
TLSH
T17253CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 2653b6bb93c06df2d197ccd727e98547a496507ca4c73f3519d9366b95ed6c18
MD5 39c40c406fde57d88f7be4bd3cee9434
SHA1 a6b3a53e1db6f93741974bf0ce3bed17e73a2bd0
SHA512 3dbd4565215d54234eb776103cba2b1766291e59804d06410c4ac5879d133219476ab937c190ad302a570a7eb8b2330df77425b0955df07cb31865cabb0d5055
SSDEEP 384:yeJdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:4+eUZsLQCZsL3hUS4
TLSH
T1BF53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 cdc06d18c031e6fc5a085d0e8f44160479a1e7133cab659eaae345ab804b82ad
MD5 feea86a03182d979e0b3c7024ccbb87d
SHA1 deda1ce85aae383d735fe4944e3157310f1eabcc
SHA512 6849a17ef8dae24e7fed47265daab50a6c9d2dfcdc4c9f9fb9b754e0caace1f3aa219b340a615339e3ab116c0c21f7b6f3493f1241074d4fa7e022229bee7aa5
SSDEEP 24:TLyx/XYKQvGJF7urs2jCS0hBgCS0e3CS0MdCS0eUt6:Tel2GL7ms2jCSmgCSBCS9CS3
TLSH
T1DB4268AE59187372DCE00A39D0C100662BBC3EAF97BB10D22A118CE08D2E255610A2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19946813-bc9b-40dc-8a3c-049c4bd65a57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19946813-bc9b-40dc-8a3c-049c4bd65a57.tmp
Size 8KB
SHA256 8fcf7b8ec19173b932a4a710dd14cc898368df196ad9db2abf2a43e1381a9f93
MD5 28967ea62fc55fbbeab11c7031a3b6c5
SHA1 ea0b355e8aa671fba3c3af8695e4b0dae58551b4
SHA512 c1839a3bfb28fe7514dfd016b9c2a15fd71c0169aa9365f56ea18665cca421edc286c86ded68362985d3a2d61b440dd72ff9f82d13da44c3eb199ab728d17776
SSDEEP 192:CONS6JUXQmiUyYk1o//ORhpmNxBqwH2U6:CONS6+5A1o//cp0IU6
TLSH
T18C120874B8A9FC775DD7A400F08376639EA410BB9E829F85DAD45F1C05D729C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ac4a52a-5c8a-4012-bc76-7b001059e958.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ac4a52a-5c8a-4012-bc76-7b001059e958.tmp
Size 8KB
SHA256 4ca0023ca0aa7f235e2ca62b9760af65038e5266fe8d9dcaad25c5e52ac6383a
MD5 54101a6458276cd73f904420b64b5f80
SHA1 b93f646fe01c2d6ac0ba02150af61c9a6966c8da
SHA512 efb88b72873a4671c0e81274548ea481038bb80a2ba6fd5703309381549a1c6e56c7ba07d1c47e9cdf5f897618fe55b0c72de0df8b7e48c9c7f5e61acc58e403
SSDEEP 96:KqONkoQsjpfbUmjH5ih/cIPURHl8h4otop5iaDABKP4v+Y1xf//ojdFxjYpoR1/6:BONw6JUm0QmiUyPkso//ORhaBCBaU6
TLSH
T14A02D634BC68BCBB8EE3AE45F4877B239FA4106B96911F80DAD82F2C01D715C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

6b51e78c-317f-4662-8908-47d7ef4e1be1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b51e78c-317f-4662-8908-47d7ef4e1be1.tmp
Size 9KB
SHA256 b9e7c0214e6cef75188a0ffb120c7e955b2053c16fd5aaabfb65eb259d25e650
MD5 1d50b9d579b6d2b934e7e3b38b76f86b
SHA1 a5934c371e12ce894feeb468ccf21dd4cd91f7c7
SHA512 5d3b6307514492460c5c524829bddbd12465eb9de82437ae007e05e09ebda11cf241fdf9895d7d3dd2919017159a001479a58a8f9ccb8ede3598ab2350d3d507
SSDEEP 192:sxZQRxsn/fms/yvOGb7XCIdpJHW6+WNGY36clOIIg4J:sxZQYn/fms/yjb7bJHbGXWc
TLSH
T13822B7916E38A53B8CCBE21DBB257F53D6FA503250D01E58EAFC861C05EAADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ff0a38e-4e2f-4cdd-9a00-5e61716be9b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ff0a38e-4e2f-4cdd-9a00-5e61716be9b8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e1bf690-9c6f-4de4-b69f-80ce459f0ee9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e1bf690-9c6f-4de4-b69f-80ce459f0ee9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 46e3e96e5a9459ac5f02d654fdd30d83d58ed80aa7502c1d312498572527d6b6
MD5 cd211ff3846a07d08898d55b063c0b82
SHA1 060bc29d644fcd23975ee1541141bd8e7a2ae0c3
SHA512 909758a6624172c98dac46750a0351d243fec976c8d386c081254b2b0c907f31ded60281f5512262c53f0cf32bbe702b6080ddec23e486f442f7d532391b6c60
TLSH
T11D510B81E554FA60FBA8C13842D616F732376BB0B2831D8E0FD3C4781817755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8fce871b50331a8b848aea96ae2e977844c87b9b8150f2bcac369dc2bd2419c5
MD5 ca0ddd472e80c525641def5b5e5bfe26
SHA1 158e275dd4e97db9336090e9ff1f2c6675cf4158
SHA512 4a217a09aa3ebed5008608acd1a51f8cba13ae1bd0af7e602f1707b0617aeecd5242f08d634fca97f52e0bb86662dbc3f104441ca5de5e73a8a290e8f889f8f5
TLSH
T14B510B81E554FAA0FBA8C03886D616F732376BB1B1831D8E0FD3C4785807755A2B30B6
MD5 SHA1 SHA512 TLSH

Submit Download

1c793df7-6cba-4561-9902-0e882634e656.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1c793df7-6cba-4561-9902-0e882634e656.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

09ee084f-4138-4e18-8218-4d0f247ecd91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\09ee084f-4138-4e18-8218-4d0f247ecd91.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

67f5c6e3-dd2d-4ddf-bf5c-375d8f1cb6d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67f5c6e3-dd2d-4ddf-bf5c-375d8f1cb6d5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 878330733bef64336371d3d77aa4b0d8c1afa82c42810564a48db66eddb35c60
MD5 e172d013fa4450c0fd43341990b4ccda
SHA1 db271e050ac608d120e03678a9b7f82c0e0a04c3
SHA512 cef6ca729de5782b8192167d171c9e77cca2e97e348ffdcffbb19f32cd17f6ee529b67a74318fae96d51eaadcc5723251fc73b5ec83a375e41ac0cd07d44cdca
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/jyL8rKWkmKzb6ZCISOzK9q1IzxsjYhyKO:KEYQKhmOej+KE42WLWKQUM
TLSH
T19891AF9431BF120538BE25489068971A525131B3319CFA7AFFBC51A68EAFE045CFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0c247ed-89f1-4ceb-b37b-0243b7236fa5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0c247ed-89f1-4ceb-b37b-0243b7236fa5.tmp
Size 10KB
SHA256 4ab135cb604967b3cd0e60ebae2879cd992270649d424f99ae84e31ec59cf134
MD5 4c361a9684b4ca7d1156cdc23cac958d
SHA1 5e15c4814af49b0b2e1a80dce8371ff1cddf61c3
SHA512 e7706b15b3b2ee3666233f275f43b6224976d6fa3ce3282ce15a22eb438b6566ad6fdae227901c641905bdc3ce729cc29d84d07643b9fbb69e3bab1a941087ee
SSDEEP 192:sxZQRxsn/fmsfyvOGb7XTIdpvxHW6+WNGY36WlOIIg5cJ:sxZQYn/fmsfyjb7cpHbGXki
TLSH
T1D322C8956E38A53B8CCBE219BB257F53D6FA503250D01E48AAFC861C05EB6DD124741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf9b6fcb-e68a-4d57-b7c1-75c0a1d05e99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf9b6fcb-e68a-4d57-b7c1-75c0a1d05e99.tmp
Size 32KB
SHA256 930bc58a72a14f6c146390f405b36ef4d185b4e645f8b6f95671d01eaf052a71
MD5 623dfbc87fa7583fc2fb00fad85e2c03
SHA1 4cb8ea5df65757d174beea91b4389b7c5018479d
SHA512 55f06556fd335364391c454df99eee8103cb67776b2ea9cd3f8292b68bb850c85833db51f76aa27f9a21ac6727c2f6ceb6badea3d12d6cfba246e633e5a46730
SSDEEP 768:bDKlmzz17pLuLjYQWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVbg8/LlpPs/ArM:bDKlmzzDEjYQWvUYe0u1jamg8/L/E/L/
TLSH
T1AEE2FB7B780CCB7E4FC04ADDDC1A7E9E6EA8028B9698C94047FA945C02C66EE51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc2dd194-aa30-4aff-a162-77dcd92947c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dc2dd194-aa30-4aff-a162-77dcd92947c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f063c8d0-5f5d-4196-9af8-aabdee0899d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f063c8d0-5f5d-4196-9af8-aabdee0899d4.tmp
Size 18KB
SHA256 06cdfcfa6597c50f20414f8e114f98163dbee960c499ae7f7bcb90b63299d82d
MD5 3e0d58aceb16c9bbd8eea17e6c2c1d3a
SHA1 e16e683d365ea08a0fd143757380e727a6ef057c
SHA512 dae902c49b21c5f08a8323c1d1b84cccceb62f08e3789f6c708eb7661d237f84a4d4824da05ca2ef39b8eea487c4a7d2c13cb65da95b4dd58302d39929da99ed
SSDEEP 384:nsQkUSv0sNP1l0b9CHh//cp5IvaTZchnIIlE:s0cB/SIvaTZc1La
TLSH
T1B0827CB1A87DAC375EABA100F14B3A439EB450B7CEC04F94D6D9DB2C05C529C275BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 21c3b70786392e18f57030ce1078d24987b01fcad38f558931707ec1f64d9095
MD5 d03f2407e2577ada71282beee69fc850
SHA1 6b476c7df6ea55718443bbbdf81e2f1be37b59a2
SHA512 b315d8d1323f090f6d036355d33d1d72040094c2f5af24c874aa1d5dfe7f5ade2ada673dfd22a84a19330cc55b5bbba53329c83cf1467d4126c582b79c541740
TLSH
T1F7412B48B6EA1148B3736F1AAFF6687D487A78732E06946D10110E4F4A66B44C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

94adf27e-21ec-4e6b-a39e-955300edfd9f.tmp

Path C:\Users\Admin\AppData\Local\Temp\94adf27e-21ec-4e6b-a39e-955300edfd9f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b2aab48d-b5fa-4225-a498-12f0281e2454.tmp

Path C:\Users\Admin\AppData\Local\Temp\b2aab48d-b5fa-4225-a498-12f0281e2454.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_1742779953\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eef95cb2-3e30-4dfa-8201-db55d043d2c6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_1742779953\eef95cb2-3e30-4dfa-8201-db55d043d2c6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_330391768\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download