db8139999ee3af71eaf091369d608a003460544cd23751b44e56a0c3ada94a08

Resubmissions

17/04/2026, 17:37

260417-v7dn7aht413

17/04/2026, 17:31

260417-v358mshs8s3

17/04/2026, 17:22

260417-vxw3saes7j5

Analysis

user interaction
yes
max time kernel
298s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260130-es
resource tags

arch:x64arch:x86image:win10v2004-20260130-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
17/04/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YSONG7A4W-485887.pdf
Size 9KB
Sample260417-v358mshs8s
SHA256 db8139999ee3af71eaf091369d608a003460544cd23751b44e56a0c3ada94a08
MD5 c99628bec955a2f7aa23058894f679bc
SHA1 46b9a69469bebb8d342887fda075bb36f25a37b6
SHA512 1f63d748cbf16839aea27800e2d12a735013c41e26a1e5320628366f856fdc14adee0153c0c7f39c5922b461f1ca982fa85bc64652f952aa6504a0014b1797cc
SSDEEP 192:jrI7k9P4WTR8MlMvVoGy84kOHHrUYDIlYDIvJoYDIMr:jC+P4WTmM+oGy8DRYDIlYDIvJoYDIMr
TLSH
T13B128381595DCC98C096F8528CECF688E12F3D7A84F1F495F7B38E17A042180BD872AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3892	msedge.exe
4748	msedge.exe
3800	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209209272957956"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{0E944E6C-397E-496B-84D8-FF1535DFED18}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{A5BFDBCE-A904-45E4-AF8D-C87A166D544D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{8F4FEC8F-333B-4353-9C8A-E135349F4CA4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2844	AcroRd32.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 5096	2844	AcroRd32.exe	85
PID 5096 wrote to memory of 1496	5096	RdrCEF.exe	86
PID 5096 wrote to memory of 1716	5096	RdrCEF.exe	87
PID 5096 wrote to memory of 1716	5096	RdrCEF.exe	87
PID 5096 wrote to memory of 4408	5096	RdrCEF.exe	88
PID 5096 wrote to memory of 1644	5096	RdrCEF.exe	89
PID 5096 wrote to memory of 2824	5096	RdrCEF.exe	90
PID 5096 wrote to memory of 1308	5096	RdrCEF.exe	100
PID 5096 wrote to memory of 1308	5096	RdrCEF.exe	100
PID 2844 wrote to memory of 2344	2844	AcroRd32.exe	101
PID 2344 wrote to memory of 4436	2344	msedge.exe	102
PID 2344 wrote to memory of 3800	2344	msedge.exe	103
PID 2344 wrote to memory of 2456	2344	msedge.exe	104
PID 2344 wrote to memory of 2456	2344	msedge.exe	104
PID 2344 wrote to memory of 2456	2344	msedge.exe	104
PID 2344 wrote to memory of 4516	2344	msedge.exe	106
PID 2344 wrote to memory of 4516	2344	msedge.exe	106
PID 2344 wrote to memory of 4688	2344	msedge.exe	107
PID 2344 wrote to memory of 1660	2344	msedge.exe	108
PID 2344 wrote to memory of 4688	2344	msedge.exe	107
PID 2344 wrote to memory of 4688	2344	msedge.exe	107
PID 2344 wrote to memory of 1660	2344	msedge.exe	108
PID 2344 wrote to memory of 1660	2344	msedge.exe	108
PID 2344 wrote to memory of 1032	2344	msedge.exe	110
PID 2344 wrote to memory of 1032	2344	msedge.exe	110
PID 2344 wrote to memory of 1032	2344	msedge.exe	110
PID 2344 wrote to memory of 2300	2344	msedge.exe	111
PID 2344 wrote to memory of 2300	2344	msedge.exe	111
PID 2344 wrote to memory of 2300	2344	msedge.exe	111
PID 2344 wrote to memory of 2324	2344	msedge.exe	114
PID 2344 wrote to memory of 2324	2344	msedge.exe	114
PID 2344 wrote to memory of 4596	2344	msedge.exe	115
PID 2344 wrote to memory of 4596	2344	msedge.exe	115
PID 2344 wrote to memory of 2916	2344	msedge.exe	117
PID 2344 wrote to memory of 2916	2344	msedge.exe	117
PID 2344 wrote to memory of 2916	2344	msedge.exe	117
PID 2344 wrote to memory of 5080	2344	msedge.exe	118
PID 2344 wrote to memory of 5040	2344	msedge.exe	119
PID 2344 wrote to memory of 5080	2344	msedge.exe	118
PID 2344 wrote to memory of 5040	2344	msedge.exe	119
PID 2344 wrote to memory of 3148	2344	msedge.exe	121
PID 2344 wrote to memory of 3244	2344	msedge.exe	122
PID 2344 wrote to memory of 3244	2344	msedge.exe	122
PID 2344 wrote to memory of 4160	2344	msedge.exe	123
PID 2344 wrote to memory of 4160	2344	msedge.exe	123
PID 2344 wrote to memory of 2820	2344	msedge.exe	125
PID 2344 wrote to memory of 2052	2344	msedge.exe	124
PID 2344 wrote to memory of 2820	2344	msedge.exe	125
PID 2344 wrote to memory of 2052	2344	msedge.exe	124
PID 2344 wrote to memory of 4956	2344	msedge.exe	126
PID 2344 wrote to memory of 4956	2344	msedge.exe	126
PID 2844 wrote to memory of 1680	2844	AcroRd32.exe	128
PID 1680 wrote to memory of 3068	1680	msedge.exe	129
PID 1680 wrote to memory of 3892	1680	msedge.exe	130
PID 1680 wrote to memory of 4220	1680	msedge.exe	131
PID 1680 wrote to memory of 4220	1680	msedge.exe	131
PID 1680 wrote to memory of 4220	1680	msedge.exe	131
PID 1680 wrote to memory of 3472	1680	msedge.exe	132
PID 1680 wrote to memory of 3472	1680	msedge.exe	132
PID 1680 wrote to memory of 2140	1680	msedge.exe	134
PID 1680 wrote to memory of 2140	1680	msedge.exe	134
PID 1680 wrote to memory of 4524	1680	msedge.exe	135
PID 1680 wrote to memory of 2140	1680	msedge.exe	134
PID 1680 wrote to memory of 4524	1680	msedge.exe	135

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\YSONG7A4W-485887.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FBEE9581D484ACFFE44C737DB38DAF41 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0C5F7B3E5F23D12248B54337F985CF32 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0C5F7B3E5F23D12248B54337F985CF32 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6B939F321EFDD62CC0E347314B221005 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C93F1A171E1C72637AB4356F9E250999 --mojo-platform-channel-handle=2268 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D7A8CE15D8A09CC428219F264B6C68C --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C49CFC51251F2A49679335B51923D572 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C49CFC51251F2A49679335B51923D572 --renderer-client-id=8 --mojo-platform-channel-handle=960 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://116.181.62.50.host.secureserver.net/RnbZkCTPbacmm6YtZeAkJQ3F
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa7c98c188,0x7ffa7c98c194,0x7ffa7c98c1a0
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12357990236120714800,16895283685184215301,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,15363290673936338510,16047355276041010722,262144 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3450539096017816901,14632205425697064476,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,6362055322268843684,9291465151716005679,2097152 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,10798590383055709731,609463364714549491,2097152 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,2203062409667534311,8003813289745993147,2097152 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,16304450079856933647,9684545616560826276,2097152 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,5179220971507361319,11768810627807928543,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,9950960907460081143,13189858515554078829,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4952,i,2806064639743186616,378105508411718125,2097152 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,12626234194393320072,479581498612202802,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,606457417538649582,16467834432768838607,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18161958749949845900,11379350464543961262,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18161958749949845900,11379350464543961262,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12157527071816318367,6718377639065544237,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,10449610403906629187,11786774717640972316,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15988473576484192458,2595133119749927107,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6730076224929889828,17846332941364318860,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4733774029130085,17368335526243270825,524288 --field-trial-handle=2300,i,9813870627059813609,16128335782692516291,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://116.181.62.50.host.secureserver.net/RnbZkCTPbacmm6YtZeAkJQ3F
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffa7c98c188,0x7ffa7c98c194,0x7ffa7c98c1a0
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,7863487999361808292,843823164404651272,524288 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,10680481024081107205,10650327761503237811,262144 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,9579855020386534380,6588432965934812921,524288 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,5819876983965974464,742589682994951452,2097152 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9329910825026350170,7689688819127577330,2097152 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4864,i,11034757915067619020,9753511931264935099,2097152 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,7472562854758245990,7762132313916679900,524288 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1486796911686287537,3911088911657333070,524288 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,14822343171467056101,641817227712168810,524288 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,14822343171467056101,641817227712168810,524288 --field-trial-handle=2108,i,675858819874525695,8827644602893956521,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffa7c98c188,0x7ffa7c98c194,0x7ffa7c98c1a0
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,11982631394947836184,1484007444436607841,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      System Time Discovery
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,15441109905615491918,3257426177297988939,262144 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,7646048851886042129,7529509965031335399,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15916539317267770727,5437394816623279062,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15916539317267770727,5437394816623279062,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,13140362314720556023,14759283788312790074,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2996,i,12422214520785404025,15577450706563115159,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,11039345256153304741,3506145161699147158,524288 --field-trial-handle=2252,i,8078030070440219410,8912256060416340874,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
      4⤵
      PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 5d00bc1f0a7d167b11ebd3de736118ccf25d43ad01be3fc1f6d274b26a6d51d2
MD5 cdaa1a0efce11ea98cb887ecbfd979db
SHA1 e0b6a261a001ad299091de0813d95d2952e3c469
SHA512 75f123e0d9155c1e40136a17b3cbed8bd982c2f2451237ea2872569fc6dee39ea40f7186b86114ccbaf6aa3ca4c29450438de9fff8723a02c21aee3ce811402c
SSDEEP 384:yendThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:C+eUZsLQCZsL3hUS4
TLSH
T13453CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d4b1f4021efe562889686ca23b343186755c4a3e384d48334452f0e3d84d3486
MD5 ee955f2c936c31e263773fe62d6a83cb
SHA1 47d2c335e07918d44d3d5d60208bd2e8ea91b3c5
SHA512 84d608e59364d37b614631245b5e20358df5bf985a2531a22dba8df4c53ad17ffd7989293c5a9242cbf1c9b5a7688cdb2e89f37edb3cf63a74a244c94c6da653
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a1a50b73a50c33e9fb976236a96a0d852219cabd4205dc0c2c90955572a95807
MD5 2030ed7d678cd2e532ba449f0105dc2e
SHA1 159b2b576cf62532e432577ff66dc50a27ffb9a6
SHA512 2db5b4788febb293a558645fe6a47c03cf219476d32f87be28a348a680b893a778c1558cabcce1a9928f639b3640d0d7e6ec40e1db88d0c5d5f2000090854431
TLSH
T128D02371FAF6E415D15708F1551323167F1AC6A6FE835122F011546CCC66565E7C1283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 267beb5ea41320b3eb064d505d231ce554a6e6ed22f8d577ddf86fa142e778f6
MD5 ff54dbb89cb3b5cb1de60e83c922c502
SHA1 80cca39e0b5e414e8d346904e06ec654dc50be22
SHA512 f8179a73b14eb7f564b7c1b3a828af664a89107b6a2164eb14f9e699b328fffc22513cb702a5c45514ff81ec306738971336099d46d725951b4b5a1736e46b2c
TLSH
T18ED02371FEF6E415D15708F1591223167F1AC6EAFE835122F015546CCC66565E7C1283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c148db5965fa3734162a2c052d8b274c09d63b56919b2cb9cf17debb25594c59
MD5 5548ee2e9a785ed187bdc43b7e8e08ef
SHA1 56498144405db91600ad3ecd85e48aa6fc4bd7ce
SHA512 43f0c6a05bb4fdcbbd89267aa8775a479a861df064d2d28ad95ef20b0562928e2d91256e1288fc8cc9cac6e7becba72f51bdad4762e3140f8649e04bc60001db
TLSH
T163D02375FDD9D006D33A04B3536253517746C6597F434011F059C40CDC557BEE3C5582
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d20ee7c9b3302dfa4f284c3ffc0cebb4fbd63536c7cf21a752827b0142f57484
MD5 748115f84cdc4c023599197defd24e42
SHA1 129ac34f61fb0fac07893c538023ba1bdbea94eb
SHA512 82e25b8cd4a750b082751f0f3599d50ab565d0ea081bea83359da486a506444e32d80baf414cb05918ead4eecf573cfef8b3978144b2d33550bbdf921f392b62
SSDEEP 384:2Wtq9a/Hjz4sHxaefYg8/j/krnWgZV2hoj6sr:2Wtka/DcsHxaH7crFZV3j6sr
TLSH
T16A13F83D765D8D47DADB69BE2D0BABBD57F2C4A2CAC5072302B07614A31130E786E345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e5b617964cfba0b85fe037320ab8e895a9670140f12e5bad000b846b60e298a9
MD5 fedcb7e7a6bd2571f5afeed38e54a9f4
SHA1 a6c4a63bd4f0bedc29b68864ce8854aa752c5568
SHA512 ef2567e1a2b6c49aa7ae821b03af947006aa228e5f46676848a43b719fb4423245334d817e658471c660fdf991ba9e2459cb5152264f0e6b9a4619c285ff28c0
SSDEEP 768:Hak69S/jTzwx1TkZShhKnHn3YsEieGbSRm+qAZAEtCC38PKtaOjTwAX4W32s/9AD:Hak69EPwxlmeJpTm+pOpAIWF
TLSH
T115441BF70945A01BCFA812F5E6133A3DD1BB051D6CE1F9E9D6380C912825B26B6BDF84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 4b8cdd6e5987e9559eabb417618b0fb03f9dcae3cf395f1bef51214644a59011
MD5 2afd3eb1968c6543fe444f6985a47a2d
SHA1 833995626b594ddb216bf5b6a644c096ed56e003
SHA512 9b37d8ffa933daa4cc3786fb630a533a114a5b19162853f9e95c9a6b317c8265632272b1f353c1c38bbac1f3e42d2dd7ff9e6172b260030c23d8111fb0e9ece2
SSDEEP 3072:uS5miqmiHVG4iNlGsFBsLLHPMAYuym0NYqC:V5gmuG1TGsMHPMAYBm79
TLSH
T187256CEE8F282C87DD6B4D70B4E0EC12BCB411D3761AE1D34818C990975A3C667AB6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 2106b41451ac1025c8ae6b3913a2e5bb94011df3e15bf0f52c863398a3a0b4ab
MD5 1dbf645c69b86711b041d90b9435d11e
SHA1 60d00fa5da553919a60c1fdaaa6ce7e264460b30
SHA512 2d0d14312fc618a322de3a32eb836e21611a8ab2f422b2f47606807869f7645935d9472ed9b84e33308ac6d036a0426b57fd548df14c56e7f793dca0510fd125
SSDEEP 24576:TIWirjJgyHVOjfcmjv2rD7XLq9Z4XnvkJLfV5zvJHmlKFfPOUte+g63bp/Ag9:E/6y8jRv2rHXjALt5zvFiKtG3+g8Nv
TLSH
T1B6868EEEC6785C83CE678A70B4E0EC077C7412C3B595D1D38858C59812AB7C5BBE92AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c480ca19eab6a2f1cc75baed1e8d08b51ecdf7b9630e0b93bb818314c9dd9e19
MD5 c83bdbdccf37a43aa97c400743c4f3ad
SHA1 d365880ed6ce37d6e7e11cb2effc2e103930270b
SHA512 a1bea1f519465638b28b3ab09425598fc548d2fdc01036fa4cd0b7b1247bb3744fb3d2c84aad858e12f0c93ca6aa6b39db941d9f25bdfd3ed7561cfbf1ed859e
TLSH
T10261F7506096A8CFEBE080F40FA5935A7BF24AAA06628F130ADFC53C89D5F2D4253694
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 741B
SHA256 9b997acc7c88838d57b0c2471326a74947d58166568e3b4aa7946a4f24bf7ff5
MD5 0b0a9c73fc7c9b071290f7f9ef3a2c56
SHA1 d9bd125eec41252658f662a2f320f37576b1f093
SHA512 d334bd714a0dc22be924e9d777f7a2b31fec6f98e009c4ef22049944c5ff16fde3428ea13a759f597d43736755732dbb10684bba533b7f69cd6587905db023c0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 3c2e13d7e543178a0e15138683d0713d5ab0ee918d33c6e2a42b03ecefb73c61
MD5 8b5edacade2d45dbe554fcd4bd001172
SHA1 ebc09ae635737c2ca4d08314db1c3c30fcd7362f
SHA512 d673c8efacd4673e32e4f9b718bfaf7f90d2e3439b5b0f92452ebad530cc947e1b60c9dc253db1b08de518c768a57a366c2c911a9d8ae03fe4df1f0fb7e1f525
TLSH
T1A7E026280ACCC9BDB5547A9B836D730883D03482B2983A022788E840FB03B49A3A6281
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 918dd2fe4d50783d3bf71801fa065f9f97c58af59d8b7f65d72616276a5df1ea
MD5 3f0307d831e6ec92c71e982901bf02c7
SHA1 be79f16a7f696605e2005fc117c2c7033ca4d249
SHA512 ca1bfca4b763b5ebf95bb3d2ba0f142657c332b15b9ed5679c5e6af5f966965f54bfa517e5ebf3b1d09d16a3aad3d7e0fe4b83fd436df74ca52d3b3bbd1b206b
SSDEEP 48:uzBmw6QU1PzN7Z2uNrku4JyVsCeUHzsLxfHnvrST6J0w+at5qgSH7h9:6BCxtDqu4Jy9emzk9vr/5kdH
TLSH
T16392F9976E783812EB442D33113D5D319E37D2A86FB7AC98305480626DB9583E03E9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d21bf6d1f4262e4b1a2ce24217a98b36dd12679509433a93ae5cb22b3d2c9576
MD5 879baec137ed4b8db5577cf66c841f52
SHA1 34f1c5196090d5139139861295c42b36efd86ddd
SHA512 cf52032318ad98b97469311da8b689800c0ab122a152427af73671f1ea2f48f90d5b568053f05fc9988d225364ae341151c338b28aa5ccedbddb85223d0f5336
TLSH
T191E0D87149CDC1ADA544218B43297708C3A0344AF6D8AB027F489840F542108E6911C2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d857d002b3503d271ba10ab1832b565cb508b9ce256a7e5a59e08523092baca9
MD5 93dccb75336948b4ced222cc5360843e
SHA1 c474c056d4030802b3f7031cf185548c5b5d3ef5
SHA512 3be4c16757b60d5969c27308cf2bb35cb9e5a6a7811b7558bf4257b1135db726427c05799d33390033933cba9ecdd62a57f4a763f01b177f05496d042e662642
TLSH
T131318BF7C3E8856D8A51C2F4BA196F1BCF290914932C3D5685E4AF1BA3E2870E64095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 22160f160443572761575b2c65589ec2ffe34d7c122a2db38bb3457a685b1aef
MD5 881d6ae7d972a6966b902564fb6f45a3
SHA1 728d6e25c4c03d07cf1d3576e4c42bcb31e8b792
SHA512 f8efe7e89d914c70d730dd29de8e0085b3621ca3c05d55712739c9c2c4e371053d0c2c1745ff064d733cd2c06ca8ed04f871b2d89ae0b17a91f8e711bca382bd
TLSH
T1AF319AF7C3E8852DCA5182F4BB256F1BCF2D0914432C3D5689E4AF1BA3E2871E54095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2b7801c56e495f09bebd7d6667038d22355c968b5f0c376420670515469b50cf
MD5 86686b0d6477e2e3c8b080c3c60d4e36
SHA1 d672755f0563ab1d7c9ac1bfa34e57479205d641
SHA512 b8af6ab210c7612f56bed062ba88a3b81cacdf7ff7de35e087bfe063376355ee0e62b4b907598bac213f9fc79becad846a1b3ec7b3eb2c9c5e82053584ff1874
SSDEEP 192:sxZ2/ywFqKOMl8TjA/fKs3qWpVHxi6XxgGgIup74HW6+WNv1B5/YNEq4r1IgOPJ:sxZ2PmA/fKs3qWvHxielIkHbF/pVOR
TLSH
T17252FA166A34997FCCDBD219FA55BB53D6F91422D2940E44AAFCDA0C06E67EC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5da839cbe389c1340f8d2bbfe398e296adf0521dc46e4e2cede56da4bf1c1086
MD5 7b1d9a401d750d58429e746a59a39456
SHA1 c542b95588df3b83b0cece29d9bac5107bc2eee7
SHA512 581fc3ce9e463fee07cffdf58937fe5f81b6a68da552c99f42360df89cee111ad78ada1d5e166316f3e41d0329e96d8cb715becf587328ab75b14ad837603595
SSDEEP 192:sxZz/ywFbKOhl8ljA/fKs8WpVjZUYu6XxXilBGgzoup7kHW6+WNWL9lfYM8kB246:sxZz3AA/fKs8WvjzuedgAKYHbQfU0UOO
TLSH
T130620B16A934997F8CDBD219FA55BB53D6F8153291904E449AFCDA0C06EA7EC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 5db7765b65eecec92611d08502b3540de0a4a06a41ba1d28f282a35bc5ca64b7
MD5 fc6f572f4d39143bac9ecb1aa98d4e75
SHA1 ab132c8fd89f889f6eb9c5022d1e7d211964e58e
SHA512 f1d748de6a6b787a2ff5241f37f85868677a6e6bb2387b048bc0e8c5c7c653232a6059bb16716dceeeda5c51bf3fdd381c4fd2b4ca45d717573ff96be7f3c77e
SSDEEP 768:8/Sv2Qb7pLILZYqWve+J+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjONFLllnWdLroM:8/Sv2Qt2ZYqWve+J+u1ja+ONFLfWd4du
TLSH
T143F20B3B680CCB7E4F804E9CEC2A6E8E6DE802CB96988D5447F9944C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9f4c8885321225459cb8bfe5e2b3b82b454616378e62542dbf266ec8ea842098
MD5 005b9c939008db4c81c26d9afcf0b7c8
SHA1 933c37903bf32a7dc2dc3493294e48260f5e2d81
SHA512 5fd9e394fb0fe4d723b41237b88688082e2915b8f1b1dfa987b5271c01a633f8a357c11adf4849ff6499ce41a3deaf9c8ccd2c51c516ebf40a9feb3744b38b0d
SSDEEP 768:8TQv2Qb7pLILZeqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjOcFLllnWhLroJ:8TQv2Qt2ZeqWve+l+u1ja+OcFLfWh4xv
TLSH
T130F2FB3B6C0CCB7E4F804E9CEC2A7E8A6DE801CB9698895447F9885C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 4004f133673ec833746937478b22afa6c97e47687251e5f167ec67f106b6e891
MD5 77e8bd371793c4165a8559aba9c4f1ab
SHA1 8e3f6f5164a981d357bc54325fb8058704d9f3b0
SHA512 98f094d178ff3e0fec6a5f694bcb7a894b1908412efb4ccd4b0a73d7c8c5769b77cfd9797cdbbdde5b771f28f0d82b8278b17c18ddca65d4e01c1c4bb859a19f
TLSH
T137E026148ACCD1BD72556343032EA30C82E47507E2C8FE023FC0DC60BA43685B1A2182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 703B
SHA256 4621941074fcd20791d1d0016e97bdc4953e8c91cf3dafd8ce5ba24242a19c8c
MD5 23f1ed69af867343a819eb9e6729e9fd
SHA1 0389eae7d54dd24c3929b3d2d7e487ffb78ac36d
SHA512 746f56bcae4cb57ee34af158578d42a45df438d09d8e59647b4ecfd3e4e2974fe7ff3f73e2c4615436f223ffe1fa143260b2789c5771b805ccb6455aae4032b7
TLSH
T165017DFB0F889536ED6DC2B018D57B744736818E05888FD2D7AC408B651A6B73C19817
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 22ec6295f692f55b247888dd4dee0980da9e11bed58849c79c4d232f230db0fd
MD5 51a3df7e3a78507061e53865ba22b8ac
SHA1 384de6e15317d196f98f015a930d7806560018f3
SHA512 fa070aef56d32b436291d25be68b04c3b7fc53817ffc10fc6a5a145dad6c825748c4c67c5cd64fdb3a45ddf5708a74da7dacd98e663d24bb8681ea8f61f669a5
TLSH
T1E9E086B809EDD97D6554759B03B9730C83E6740AF7A87E023B46C94CB703A45F3A2592
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13420920928594759

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13420920928594759
Size 1KB
SHA256 5eba17a12c15cd614cff845a348ba7c1f3e14ed7fd10f90d8aad040456fd3847
MD5 fd4977434783202d32cf385ff08ec7df
SHA1 324aadd6e246ffbe809dc93fcb2cf7264512a53c
SHA512 1d493b77e6c520b91f2785befa5d618872c1d5abf91287ca8901ec3cdaf00e05885885f4baf2868bafd5bb27d72992ec6990cef93974a7dcee777eac73ca968b
TLSH
T12D21CE22A6B1486AC63D4438F0CF1375BE74E552A4D1AE07D2D192020C62957ABA0DDF
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 a8f95b4175b48d98431961ef69532ab12b62105294bccbe78232fc06817ff322
MD5 b8bcb0b230faa675202ba85a6179cdf4
SHA1 183321601a7855b0ae875419efb706ee3b78eb88
SHA512 e75baea1c4373a7bd05ff2735109d6c15168f25fddf2e429a7bae697d8e93806e37357d1bc5649b07406eeaa9ccdf37947fa4bcc8af247754419644671528344
TLSH
T1A7B012443B20D616E4CC09305A894B446720F001104245F3D8B45F205C4A7B87FF1CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 a05a7358aacaa69951981434a8dd84feaf9fa62d84535a9144f016f302508b4a
MD5 b8e7606c45692faf75cef32c16cac3bb
SHA1 065d2848e0c447dec17c05e88f63b8c1ce69bd33
SHA512 d1cd6bd8d1f2e3dc3c26a33ad0e1fbae50b4d894eea0be3c6f25725dc95faba0303f96be16f4ad44ada9ed58ee6f46f042d60203f7116f3920d127a76e966a4d
TLSH
T13EE0D8641AC9C6BE7195258B4329F30882A27442E6D8AA113B489484F347644F253640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 a4543f806d3fc61c7dd321b50fc48b13e39470646c2d0dcfabd212736304ffeb
MD5 66e1b1db58d7011e2d912680f473511a
SHA1 6358523a8b979b19973faf045a64352dcf5c5b62
SHA512 9c62f9899366174b56b7fa9b5873be6ebe0803a587705ce95737a796f3533c31144f55cd68d32b2e60f4279e33d0af01ecdfd09789bc5db20e1e2ea19134d359
TLSH
T10EE086748ACDD67D6684A2C7837BB70D82F07806E7E8FB466B484860FA02244F2B6580
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 604b244f4429bbe6a8c4d55cfc9d7e10b55d8a9f752b963eed7d4b1e5e70dfe2
MD5 0fb3e27ef0cfc267886d3e10c206bf62
SHA1 f6137dbd5c826818ae432b7d585b35f3d14ac5e8
SHA512 a5a772adecc1fa94b3f5457065356d52e45bfea71ff08f80a624d94f002b7f18f64c927a52f13e4962b409347a881112ac05c0a5f64192a155ffbf2a166bfa02
SSDEEP 96:KkE4Kh6CqWcKDCuWbaKgIrKUKPaO6QoKJqm:SnP7VjbHZ
TLSH
T188E16251723A06553A7D298E8191B92ECAC270A37159A43B7BFC40A51F7BE20CDFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d3c403b9-c42f-464d-9fb7-b1a7f13a1f96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3c403b9-c42f-464d-9fb7-b1a7f13a1f96.tmp
Size 414B
SHA256 0ec1f8858eab013c6dece2648a8ce30aa296548d7c8520cfc375146d98a34770
MD5 9d1e68e72ea8e721b583e488d4be60ab
SHA1 a20d46c15cfb446ebbd870ac0914dc23866957f2
SHA512 aba9cc593434cd6b19b1c8c73a0fef3dcfbd5c97ba893083327d8df741a287b95dd482f9edd48ff2d28d5f385c0fd80c540d77eb4a7fbfd3266ad7ba5f9f8320
TLSH
T1C6E02B7ACD229C2B04FD1B1864544B45EA5417072781890F7A3D920C8F747774986C1D
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 92KB
SHA256 2d2621ade456cf5930d3f312062d715ac17a0151860ea1dfa1727ec3a066a735
MD5 73c88f9c02ebcb86f1fc02ac080edf74
SHA1 c02bd204d7058cc89a86010091f260ee24659f73
SHA512 2676148e7e6f926c3d71e287b4c967e4fba849e91563ba839d71ea9593a172e98305b301825a902ce716c390a0bfa9ddce6213af9a68988fb7c4263c060fb699
SSDEEP 768:iPTZB6aM5eNBnm3I0uldAZgVTdrtqqv4DY2B8J6VLfZlcdqlsi9zWwHTUuLI6l4a:etR6VVljIbNg1
TLSH
T1359315F7AC0AD1AAC9CD95B4DD0BEE4450B3062ACA24D8E5A93C45C33B797033D7A5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 b1a99213722da0adc0ca93c9a79be7529294cbad27ff65001a10dc21eb2669cf
MD5 2d3cd56340bdbb1f6c5fba2d7505eca9
SHA1 d73c0d720007da467699e34efde037a75b0da613
SHA512 0c30a1fe02081b6765d9ff944a59677ed85f70fe310b2ff17ac5547a30b01d9f9cfd864a6b26f4e10bb2caaa89d38e746498ec75a2a6a49afb3c3a1f982c29e9
SSDEEP 192:HQvIIIebOMIMUbZYcYyhOJGAs3OlrHNssA1:HQvIIIebOMIMeBmJPs3MWs
TLSH
T1A442932A16051F37C29F5F761256CA421BEA8891A971252D32212C1F8DF3F978BC62F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 d9555e1caad9667396dd6edf3294a4ec1a6e7d835bb37ead30073cfa3755fc6f
MD5 73e160c2e4721d46086b08fd530994e5
SHA1 5d49e83b79a91b6c2d9172c95a69a4d10f2dbcfb
SHA512 b72b93f1f8ba03994aa6781d8c1fa4dd08a323d279f9d34a37e1fbd9809a3dacc106f395c708606c55d73e35058e83e931317c75bac065b835617c44eb399bd0
TLSH
T124E02620AEC8CABEF555328B13297708D2803843FAD82A862F40C444FB03604F2A6281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2b89eb7ab2cddecd6a2f06f5fee23b687188b3e1e3374b08dd775bce36238d63
MD5 aa003f7bb31e2c1e433db46b8d00c3e7
SHA1 b7bbc4ea0284374023648fbc7fa7b019dc80ffce
SHA512 7f9de1cf347b81d5ca424c51682087c089dba945e9597aa38a60576353afdb62c9dd57a035f1be1f49ccb3f0c07ab578ab46e9a94ee72eff1848054d8ef71d45
TLSH
T14A212856F330C158D14B47BA547E5B1A0334D8029FBCED0F59BA34646E76F040D4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 1acd0021a42142c301a2e20b4058995961e0dbf125543eae859cbe60626425ae
MD5 d4e34ef4aa233717b5efeac35b9820f4
SHA1 83e1a3a29fdd126b462cf0bd895dc25cf8024377
SHA512 434fb723b017fef8c671f568fe60efa1a6cd5b3da3eec25e3daa4b9b56d0952be0b2507814ac52a7acfc87b23a2a935048db0a73b8412185c3b6575f318f6782
TLSH
T11FE02028AED4C5FF655033C303EDB348D2913803FA946F012F44CE84F6036457256542
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 79b5d4a342ccad6e162b18e01abe1595a19144d5d1a8648a70d4e6f2603dece7
MD5 6ecafeab2f5e393209892d7cf4f46f4a
SHA1 63a30814437753d6e32b383bdec0621c660ca9bc
SHA512 761aed4c64fe0a86a245495fddf1d26b452025da2804908d921d86fefabe4d0a4edc9738bed2ce31296f6e3d0276c91f9eda82214f06589f6a348efd17bc2af1
SSDEEP 96:iqONkaQsjpfKTzDXcJRC5ih/cIPURHl8h4otop5cyD6BEPgpYvJKxCbTqNGL8vDl:ZON26IT0JZQmiUy7qOgibFk+OFulhaU6
TLSH
T1CF02F975AC6C6C7F8EE36E55B08B3B235FA4212FDA952F84DAE41B1C05D764C1703922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6534abb5d4b01d1742dfc22aff880e610279e710f6d3f178bdac47853b5fedf8
MD5 e199cd8a88a26478e7ca8769c5311152
SHA1 589079cb4575ddc39e0a3e2856d25a0054ef45f1
SHA512 3b1b0177cc009547af803dcbec7390b10558aa3aa4cce54fe11edca3404a7cf252b1669fda1be56997f21c36100802f0ed01718edba63d2fd984f74f6486d348
SSDEEP 192:/ONz6IT0JQmiUyKq0gibFk+bM5ekNzh1fqSjU6:/ONz6fs0gie+bMTzZU6
TLSH
T194122B75A8ACEC2F4DE3A515F0C737639EB4217BCA856F98D5E45B1C05CB28C2B0B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3d79dbd952493fabc9de4648bafba406fbf44a421b6eb237e1041471fbe7d665
MD5 b066004994d1fe233dab0e7998fea532
SHA1 ddf3aad22d4c031df90dbb121811b58f086ccbdf
SHA512 8f18da5a8b15e43ed3fa7abb59ab66b787a4db08042e5fd41b1131eaae46e5cbc2cf0d1e2468f5fc0e44b13a63e79033a016e0a9d31020f26b001f27ad3c0f72
SSDEEP 384:nxsNCyD0OgMLZO34UgDe+bMTuRLAStc41Ap5foe0WZeE:xQg85CrKySYp5foe0WZz
TLSH
T17A8227B1D4A45CEB4896E4C96183F6236DB010778A8C5E4CE6F8B73C358F8F82706925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 fa597564cf6727130fa4228b13076181553a867cf925741fc62294be33968146
MD5 86b2da83e4f841f60e1b2e441845edb1
SHA1 8df7dce59d4b72594f82c8c10a5af7ef63505402
SHA512 c19328b9f62d9d9a3d5704a42426b9a67893014e186f1e42b0ea0ae81ddaae6f94608ac0a6a4f83a8c05f54687b52d9c18037eb64fd0f9f688a9f3608c853f12
SSDEEP 384:nxsNpyD0OgMLZO3gUgDe+bMTwzZefF7IgZ:xvg05CrEzZC
TLSH
T1C3524A3668789C2F4DD39556F0473A139EF4856BC7C82F98D6ECAB0D06CE1AC530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1de875c91f3242e7a812f5fec8f2e97912aa3eed1f20b9b5f87ab0e767d48555
MD5 3d255f7d69b265724db036a33a8b6cf2
SHA1 dc56ca45c3b089a4b31513e5b472e46e1bbeff72
SHA512 7b069b8f6b3318ab2f6a81a6d6d6f7a634d8ce4659464047d2396aec5df4811ea8158797faeae9ac974d8042b35f7b2b61c7351b77e7a0744d4c818eb673e7bc
SSDEEP 384:nxsNCyD0OgMLZO3lUgDe+bMTuRLAStc41Ap5foe0WZeE:xQg55CrKySYp5foe0WZz
TLSH
T1B78228B1D4A45CFB4896E4C96183F6236DB410778A8C4E5CE6F8B73C358F8F82716925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 158fdd68368851c87655b7cc66c4a7a9cf2401c3e215f5882228cb7fa6806549
MD5 8a26094a9443b62336cd04bf316ec2b6
SHA1 90cd40beca8ca85fe84063e979de29653390f9ec
SHA512 80d7aa89ba1a773fa51891baaf396a9c7aa561550506ac376a386541b5bd295582d6d61f48cc8f8f60ccf2547c29aaa0825609be35623da9daae6b1ef0fc4962
SSDEEP 384:nIjccCs+Bt0S363sNpc0OgMLZOxpUgDe+bMTgTAAS0NAYbn5pdexsZefF7IgIf3w:2ccQa3Tgv5CrkTSbyn5vexsZXw
TLSH
T13FB25AB198A45CFB48D2D8C9A146F9132EB4413787886E1CE6FCBB3E319F4F84706865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 2053be3d808c31d519143a8e1a697b72447709036a0f7c405faf3246e7c48684
MD5 ab0089bc21cb4db24e9e8e30ec3facb2
SHA1 138a97d63a7d302538e7f2472a717b1296c52d03
SHA512 2147270327b8dcbd9fa2477d24fee10cb0fb906e8ba1b3cabef700bd05bc6492975b4ff6cce68ef3ed962ae1116d9a5cee2ad140f4604fdaaf27d67bf3681a09
SSDEEP 384:nfjccCs+Bt0S3YsNpc0OgMLZOcMYUgDe+bMTgzZefF7IgIf3w:rccQ4Tgu5CrkzZXw
TLSH
T1CD726B3628B45C3F8CE39556F0473A139EF441AB97842F64D9ECAB1E06DE1AC170B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

26087fd9-448b-4d8b-a0ea-1e0fb1c4bbdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26087fd9-448b-4d8b-a0ea-1e0fb1c4bbdf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b4cb32ce532e88ec863d9e09836daa8bd3cd9114c7b904cebfab32a0410364c8
MD5 b9fdbeae6345e84007b2784ad08eac30
SHA1 3547bec86f9e7cb9e587d2c9bc832f8aa0dc0502
SHA512 b33b12fe9bc93b8d28a7f476939c7c71f97585d2669a6a5434b0fbbc7d93fe5a855f34507b71385cd73dc7e2885ca929197c01e082b3487d26dc757f6459a787
TLSH
T152413B5CB6E91148B3B76E56AFF6A86E487FB8772E07D45D00010E4F4A62B40D872B37
MD5 SHA1 SHA512 TLSH

Submit Download

73fa8294-b0e9-41bb-9b93-d575a06e3eff.tmp

Path C:\Users\Admin\AppData\Local\Temp\73fa8294-b0e9-41bb-9b93-d575a06e3eff.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0289c00-0bd5-4748-9f4c-8caa0857f16f.tmp

Path C:\Users\Admin\AppData\Local\Temp\c0289c00-0bd5-4748-9f4c-8caa0857f16f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2344_60069505\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31cb9072-29dc-4e30-a883-4415fed4c6cc.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2344_965581099\31cb9072-29dc-4e30-a883-4415fed4c6cc.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-182-0x0000000001CD0000-0x0000000001D33000-memory.dmp

Download

memory/1496-6-0x00000000021B0000-0x0000000002213000-memory.dmp

Download

memory/1644-12-0x0000000001A20000-0x0000000001A83000-memory.dmp

Download

memory/1716-33-0x0000000000DE0000-0x0000000000E43000-memory.dmp

Download

memory/2824-15-0x0000000001D40000-0x0000000001DA3000-memory.dmp

Download

memory/2844-23-0x0000000006880000-0x00000000068E3000-memory.dmp

Download

memory/2844-99-0x0000000006880000-0x00000000068E3000-memory.dmp

Download

memory/4408-9-0x0000000000BB0000-0x0000000000C13000-memory.dmp

Download

memory/5096-32-0x0000000001CD0000-0x0000000001D33000-memory.dmp

Download