bd9f07a7065c3d2fd71168c16899fc2354173c3cb5f0f04d84d7b3c19005ba1c

Analysis

user interaction
yes
max time kernel
70s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCANNED_FILE_001286736.pdf
Size 259KB
Sample260511-la8cvsd17w
SHA256 bd9f07a7065c3d2fd71168c16899fc2354173c3cb5f0f04d84d7b3c19005ba1c
MD5 305b40d5eef3944e88278e2c555949cc
SHA1 45cddf8ae12ea93b584c7f365e2979ffeaf45bbc
SHA512 dda093ea1189847eaa02d32f3c8c35c78abb66b0e51d934c14c4641f0a942241be54307390ff7227a4618d7875cdfaa370e47b770857065d7b70377aa57f2b67
SSDEEP 6144:I666666666666666666666666666666666p7Z8gRP+MD9L09oRcw1XQALPI7eoNN:17ZeMDi015LPIioNQN2853M
TLSH
T1E144E06493868CEFC7CD61B4E712A3451337FAAE2ACAB56F5009EF1421C1B9DC51227E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6124_1750265603\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_6124_2070943843\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1832	msedge.exe
5540	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229648756938372"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-643422742-1162610606-620613169-1000\{48FB7D08-E4C8-4EB7-B21C-A87B7157BD4A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-643422742-1162610606-620613169-1000\{077D8E87-5B89-4412-9D0D-A2383FC44432}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3704	AcroRd32.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe
3704	AcroRd32.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 6024	3704	AcroRd32.exe	86
PID 6024 wrote to memory of 2776	6024	RdrCEF.exe	87
PID 6024 wrote to memory of 4880	6024	RdrCEF.exe	88
PID 6024 wrote to memory of 4880	6024	RdrCEF.exe	88
PID 6024 wrote to memory of 3948	6024	RdrCEF.exe	90
PID 6024 wrote to memory of 4044	6024	RdrCEF.exe	91
PID 6024 wrote to memory of 4044	6024	RdrCEF.exe	91
PID 6024 wrote to memory of 1928	6024	RdrCEF.exe	92
PID 6024 wrote to memory of 3764	6024	RdrCEF.exe	93
PID 3704 wrote to memory of 680	3704	AcroRd32.exe	95
PID 680 wrote to memory of 772	680	msedge.exe	96
PID 680 wrote to memory of 5540	680	msedge.exe	98
PID 680 wrote to memory of 2848	680	msedge.exe	99
PID 680 wrote to memory of 3336	680	msedge.exe	100
PID 680 wrote to memory of 3336	680	msedge.exe	100
PID 680 wrote to memory of 2848	680	msedge.exe	99
PID 680 wrote to memory of 2848	680	msedge.exe	99
PID 680 wrote to memory of 5968	680	msedge.exe	101
PID 680 wrote to memory of 5968	680	msedge.exe	101
PID 680 wrote to memory of 4780	680	msedge.exe	102
PID 680 wrote to memory of 5968	680	msedge.exe	101
PID 680 wrote to memory of 4780	680	msedge.exe	102
PID 680 wrote to memory of 4780	680	msedge.exe	102
PID 680 wrote to memory of 5728	680	msedge.exe	104
PID 680 wrote to memory of 4048	680	msedge.exe	105
PID 680 wrote to memory of 5728	680	msedge.exe	104
PID 680 wrote to memory of 4048	680	msedge.exe	105
PID 680 wrote to memory of 1236	680	msedge.exe	106
PID 680 wrote to memory of 1848	680	msedge.exe	107
PID 680 wrote to memory of 1236	680	msedge.exe	106
PID 680 wrote to memory of 1848	680	msedge.exe	107
PID 680 wrote to memory of 1848	680	msedge.exe	107
PID 680 wrote to memory of 5208	680	msedge.exe	108
PID 680 wrote to memory of 5696	680	msedge.exe	111
PID 680 wrote to memory of 6124	680	msedge.exe	114
PID 6124 wrote to memory of 5536	6124	msedge.exe	115
PID 6124 wrote to memory of 1832	6124	msedge.exe	117
PID 6124 wrote to memory of 5356	6124	msedge.exe	118
PID 6124 wrote to memory of 5356	6124	msedge.exe	118
PID 6124 wrote to memory of 5356	6124	msedge.exe	118
PID 6124 wrote to memory of 5268	6124	msedge.exe	119
PID 6124 wrote to memory of 5268	6124	msedge.exe	119
PID 6124 wrote to memory of 5020	6124	msedge.exe	121
PID 6124 wrote to memory of 2456	6124	msedge.exe	126
PID 6124 wrote to memory of 5384	6124	msedge.exe	127
PID 6124 wrote to memory of 3192	6124	msedge.exe	128
PID 6124 wrote to memory of 2544	6124	msedge.exe	129
PID 6124 wrote to memory of 2544	6124	msedge.exe	129
PID 6124 wrote to memory of 5648	6124	msedge.exe	130
PID 6124 wrote to memory of 5648	6124	msedge.exe	130

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SCANNED_FILE_001286736.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF7F48C2F6593E725F8FB784C0F8267B --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=99005DB5C3C7928CFE04EA25A5526A56 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=99005DB5C3C7928CFE04EA25A5526A56 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=65D9BC89E3D4D27CEB477E96AE6251C5 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9F887D08BA9AD2D9023AAE8B6F6E116C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9F887D08BA9AD2D9023AAE8B6F6E116C --renderer-client-id=5 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=627B1B8F7F022FA8878B0CBCB1211FBF --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=50495C20817297FCD788B02AAF305548 --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yellow-gene-recordings-vegetarian.trycloudflare.com/SCANNED_FILE_001286736.zip
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffdc7d6c188,0x7ffdc7d6c194,0x7ffdc7d6c1a0
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,8785103754813749537,547514288490046056,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,18147318362190852787,17887086674692806471,262144 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,15708808286044454586,14353646171382665492,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5981058016193895119,12150751846858774124,2097152 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7881678870571996337,12522820155481969140,2097152 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,1173043710244736596,15382802106535335896,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,1932961619545184787,3811720465124821953,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,9929410701628628483,685415176568413423,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5572,i,3280821688208088556,9744619562087867969,2097152 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4567419698700999584,7059803109915190335,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2344819256289555682,16812625610477391875,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2344819256289555682,16812625610477391875,524288 --field-trial-handle=2908,i,8416788778810285621,45476836062723107,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdc7d6c188,0x7ffdc7d6c194,0x7ffdc7d6c1a0
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4962460448813049419,1295087910649401968,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
      4⤵
      System Time Discovery
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,16827975601905305492,4496485586924175072,262144 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,17367971510650138649,11153266746239525778,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,17686753247397322508,4657829326371724804,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,17686753247397322508,4657829326371724804,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,7989738218290869636,8500925268672012825,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,9785618319136949368,5144244188783609568,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,6470955447562954978,7857585223458319746,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,2269885987894345703,11655833045340785848,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:8
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,9229053334966880425,17871020911602406755,524288 --field-trial-handle=2352,i,5281552444143672170,1871239244514133094,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
      4⤵
      PID:5648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef
MD5 c26ed30e7d5ab440480838636efc41db
SHA1 c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591
SHA512 96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df
SSDEEP 192:xedRBsKhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:xe+KhBvkZsLRGlzh+vS9
TLSH
T12C4387DF26348100CA07A8BABD71771BBA55D0BFC1C2F0E87A968A1780B457CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 2dc308b869cb88599e2922ff8686efa0412dccac16ac2fc038ba8034db26a572
MD5 3ad3030a0bc12247ac0d12ecb7e84b76
SHA1 2caadc8ca55f1a230d3bb35b12ad22f2cd9ce6e0
SHA512 a77e9251ec9bd659329297930a2568f1b19c3220ec9b768fcb4450657a833df5ffb22fdb8de3561c063eb827a1edd8eec690ce2a5b6eb4b8bc03ab17536450d6
SSDEEP 384:yeqdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:B+eUZsLQCZsL3hUS4
TLSH
T1E753CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
MD5 2abcf056d353616a5983a10f17185a31
SHA1 40d71f06b42cf03d05e8dba44f76231dd24d9fd9
SHA512 5bff16b6683201694139145fd708bf7d834e97a5792e68cfb43b011e13c0e993e1cfb6a8c6f450aa2437fe486fb6f3ff1af62a05b918ee73bc195ec5cb0b3e02
TLSH
T1D7D080181275AC31D4A68575548537093E2DED675543533B5473557C0DC7E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 15cd14ce58606b38ae0c2570150dc41040dbbaad9e925ad3e76c8cdea402a646
MD5 686896015e6944a2a9915f9540d55729
SHA1 c5754dc62ff0e9be9e07889c1f12dd98a4bc658d
SHA512 7a0a82884e8ea5f2795ceef560a1d44353517332396befc494101f8ff0a9f1f6f1870f563169d145e4e51d87d111b3a0e3d29abd9ae7cd6fc5f97a1c72c86d08
TLSH
T14ED0A736260DF015E63E4175911382551F2D6D5524434555E315C14C4EBCA9997C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2bec0f138f45b680fdf871b978a68060cb91882497fcc8202a0bd9af5579268b
MD5 13f07adba3a8f7fecb40cacbc0967841
SHA1 d72daa28a80cbd77a1ca3bb8a7816bfd71ff03dc
SHA512 310f2dac1c8dc94a32a63e838ca323f3da6f6504b6779126b6ae313effb3acc15f1533e04c709bf92050d994ea4ab103a7b3acc4af06768a694e0dc8595d4cf7
TLSH
T1F5D0A736270DF421F72A5271D412C7151E79699124075655E311C15C8D69A95878B182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
MD5 9b2430d85ce0b6612f557c45f7f3cbcc
SHA1 0a1e10f745cd18a847854cf92a1d4154f1e53a18
SHA512 187d6a5fac24a44192cd7964a293cf55a01134f6bd0ced9759bf4dee1fbc0273c5e118208cf3606ca4853d0f0f145448fc8342dac94a0745638e99f4acafd46e
TLSH
T1FED0801C1275BC31D4BA8575544537092D1DED675543533B5433557C0D87E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a49dfd4eab1e22facd7c9acb00144814778081f8bef66b6213992b39b9b2ea77
MD5 0cc860550cc00489dcb27c400f041971
SHA1 987d6f241a0191f14aec3382d05e1cad676e7ebd
SHA512 d6ee05110a21bd4f3e9ca630b3bbf03f88aedf4c86231fe046cc5a3fa471724a20c47fb845038f1fabd69db3821ef8e1f5904e8d703b67e0e3d84a77e6db6018
TLSH
T1C4D09732230DE020F7160230D002C3040E38289224071609E310C00C8D68AA4838B182
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c566f9306fe5b95c0687d9b84950a894ed88bdab23e64367994fed66d10e728f
MD5 883171ea2128866284edaa33409cb5f1
SHA1 77cd5bbe222970a88df9487f78cc97c80bd101a6
SHA512 b5806ffa4004ce5c80f87dfdb34df83482fa045abe242397899bdbc1437887b721de428caf82a99de8b092a000e2a6905db7124aacf86f06c6eb5e83c699744f
TLSH
T19AE022AED926EC2B2DFD675970604B85EB5003162B80991F3A3CE20C8FB063A0686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7dbd86d03488e775a9a98b091672c98f59034a34d90cdc1695b8a19d6f051f16
MD5 e16dd3ba3b4f4795bf66a74dbd654fd4
SHA1 f250b73184a6693eacf52052a393656ba6a41974
SHA512 a12aaa5e0910d66229bd74a26ae3ebb724f9325b5b7ce1630e6d7c26b209a66922fd705f48b180e389f0aa8bbd54a03431cf95e001caf05e32c8e9b7e57f7080
SSDEEP 384:NNlkpH8pCDK+ks7SXTrbWrYcSp5KJqJ9oIgCEu:NNlkF8sDK+ky2urfM5KJqJ9oIgCE
TLSH
T19513073E764D0C52CAE617BD5C5F2AB42B39F920C4E0515F837A764887EA317788EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1bf198df83a0f04e52e4ff5118f3ea0c13d2f7899b245d2d225d5060edac3ea
MD5 27487cc59d107294f3f33301121f22ef
SHA1 64860695dda84f4370bb009aa7e6f185b659d5ec
SHA512 ecf80398d212ee8cfa4aa1900cb713787f3261c5a426edf2fe6490e766f44e6164ec29255f005a8afba2bf800023fd858a5ce53587c0fa545206e20c415c97a4
SSDEEP 1536:bfkj8lsynN8eW0pn90KMaFabOyfF53zFE/dL5ew7AFLp0hu0uXc2NcPbKkVP:b9Lgb7NcPPV
TLSH
T1814470F74955A01BCFA802F5E2033A3DD577405D6CE1F8E9E63C0C852866B22B6BDB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e4024e9ad861b4a83b04402aba3bc57c2f0fbbf7082bb2a69c19e7fdbe254e05
MD5 ee5096bbdc18865ee1df78e8901772dc
SHA1 2a2c578c2a5dc149c4f70cc6056d4fd3e080b61f
SHA512 d464b9d886990452d5f29deee907c6f0ea2a96991f81b163f7955fd9f5bb323d89692576c3898435d2ed972be487102c5c5e0b338a9411beabc0705f7f466268
SSDEEP 3072:tb5mNiH8GUG/iLaoFxzlhP0HlAs0qMXFPhZYrZG:V54bvG/iuoBl4lAsOXFPhZ4Z
TLSH
T1F8255BEE9F382C86DD6B4D70B4E0EC22BCB411D3761AE1D34818C99087963C6679B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 6486596ecc1723a819f8cba017c88b81d4967a3f19d3b6d5603e845f661f531d
MD5 22c2666f13a7d82767e11876b310f3fa
SHA1 0f975a78516c6a06e5682adb56484c83da34f027
SHA512 aa62d9e217a3d154eec2ed0a6fc6bf6e148337e8328b9d9c875f4e4377371c1e8b4c5a97aa87371b8a7c5949657d4d2cb9278e433dee94b4d7626042ea7bfac8
SSDEEP 24576:oXWcKJN2GJoUtsRvlml2l9rcD7eO05Vip/A8JhjePhTRtNlBJAppWWvwAH+pq02e:uCNJLte2+cHeO0XiNLFepfNT6HOXM4
TLSH
T113867EEEC6785C83CE678A70B4E0EC477C7412C3B555C1D38958C59802AB7C5BBEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 163a07c587d35b93eb488bf4f808e5b3238c2e5c8c548ee1d01ea11825f3e752
MD5 3ab0f7480c7967a9d44639326be1c095
SHA1 19937f5f589e9b3412fd879a0498c668760297e6
SHA512 63d7258914c191c6cdeccc93d07ce9d1a9203cccd09fbbd6c19281012852a1d9eeeda07c3f52a6e562f76b3097aff89efad89b01c08168044c2861d774654100
TLSH
T1C9618464B7E1C828F7E447BC0AE244B67D7D7A6841532F0E06D495FFC96B7539081B04
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 cc3ca6167ca03cd49e7e8a269e013d6a3883cd1cd167afe4165043fa28d6268e
MD5 b3de106cce2aaffc0bbcbf86651416f7
SHA1 4844520b436b9e81fc1e1c4727066a9353a5fd8d
SHA512 05faf0a616662e07ebf115a2bb7b0135027ca6a483dfbc429d63f2abbd8d88efca661c1af6e050f346f4ccbcf1c9849e6c5a293aaaca3d376351984bceaf5b18
TLSH
T16BE020D874CAC69D696039C35238AF0CD1CC355ED6956D432714CCC0B602101F25D59B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 1431a9d8e832b48fa91dbdd0a9dd7ecb0bb0f1c2cc1276e92820ba3961517a3a
MD5 4a7e2a7e871f49494090d8e1fb993ea8
SHA1 6e4f8b31b835b0cb582c1d6dc96124d36bc228cd
SHA512 c9084e00911182a00387fb7986f4bdbd429e88b2b0f8afe6e2fb53b63d6018a57452f3e020c19282df4881a67feed686fdc9d2517f1fab2863bc18eef235841f
SSDEEP 48:Tyi+7f+UZD4jJ/BeOFWxaOHcCLm+yuEt+y:GLnD4jJ/FTmm+dG+
TLSH
T137E20E4D3E11F911C8ED773DA0C2C6E09EBC286C8A9DB17141389862CD926B2F49E54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 c43c4655d8b73a64f28f379cc6207b385112b0588858285bcd2530840bad1fb2
MD5 eec61a8e5167d8d539c45d330ebc800f
SHA1 00295776838635f1e111ab1a8df4cd3971624deb
SHA512 143d80d0ae19ef9fb67262a72ef0a4b885fa006560ad21c0d13e266597df52c21465d656b1b10d707d8b0649701a32fc90d112e9c102c9a342f18091d28e06cb
TLSH
T1FFE0268D1CC8CD2D9967BCD3936DEB08C6D0390BB3883D465748ECC0B201A41B2EE294
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 2a0292447dc2c2c348c0f28555ca9abe194b0917dd1bee78e454d13995beb32a
MD5 6cc6b65267b1da22aad1d6df9badf401
SHA1 198a56f9290d0ead8a175c27440e6b8672d00e78
SHA512 39ca1a74133622a59c6a7b792aa7e3b4b6c8751d00d0b5c073d28d095f557a69f067cfe4951f3f07f26269f69eb61c2f98a62d33a2868e5cc7d17f878b02f992
SSDEEP 96:n0bPLzpLEIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfRb:n07Xpwf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T1E714231E5F342721CDBD917629EB44B35D7CF03F8B5266CA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2e7164489aec2dadc086f38ba8a68f1fc93cd4391abbb6b9b3e52ef936f03e3d
MD5 e11c051042174d6592c729eca79eb166
SHA1 560577de4591cb39b303f6e85ea25a3fcfaf9d99
SHA512 3953e6febd4baa04136266bdecac5d31e5a5214f613cd5245f946f19ad8fdec683bbf9fafcabf43259ce200055117a28ca1b78ebfb76b094ac1dcfc974fa17e4
TLSH
T10EE0D8A854CDC59A564424C74325BF08CFF0350AE6C92E421B04F891F101404B29E5D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0ca4f04e101f5df462b7d843c3023e3e1732bf2d7dc13747713cda0e68312872
MD5 ff308e188b90f3b8e2cc59eb9d5b8727
SHA1 b979d4c9d6fe99f668177c92e60a31eb80a8301c
SHA512 7ddcb4e9a6c781a3335f442a58a56321568efa04e06ee07907d0171886c64699b44804479a3213246ad75988b8462e16d6e7d35b089dbd6388de78d09913e118
TLSH
T1C84190F383F4856E8A1196F0AA18AE2FDE6D0510431C3D9A85E4AF1BD3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 8e263c43b4f7db0c7b396c565da5b7f0185e1b7a26f79356d4c99abc5699ad9f
MD5 e6dc6a7a0ef8f6e6ac4de60a02b71300
SHA1 1816285d6cdca4c841c432f5ce27684d35dd7ae6
SHA512 dea6784377576290e8d1c27f4e9ab32b1bae4ab3378d403a010b8908c92f86833be1e1bb9b2b3175761357ed1fddd6d324d7aa4bdab06d3bf7148179ccd69203
SSDEEP 96:uIEumQv8m1ccnvS66YUPir1Sf5nFXbLo4g:uIEumQv8m1ccnvS6k1S
TLSH
T164F2CCFB07276206D99444B0E4009FCEAF16014B47B2B6EC76D447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 149dfc44956eca92664a711d1aaee63e2b34de757e4de5a6e716271a31de3fa0
MD5 0d9d82e3b9777de8e884d5434e6c7f5a
SHA1 9be6662f7089c0820547be547b35633bfa39a66b
SHA512 87f24ca963bc48679792318d9a8e7295da6e57924c7baad77ee2baf8fc87d02149d109a0fe7dbef35df8d72b360dc824ad4d9b39d10f90bbc526f63632393ab3
TLSH
T153C0221284FDF0720078083E0E80E881FAB6D430A04068E0C8A4C33CA0A00FB6A01029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 20e1eb91218e686f95b36bc63bee83e7751395f38885cef5f1b1af0a54b03b26
MD5 d600ffb1d5ef99d66ddd1f0becf353f9
SHA1 2783f42cf531bcc8522e5e31fbf3c7f9f2f4bb6f
SHA512 9e9c744dcc3c79b716c1b5b21e0263972815c090634ba5657c22e28a86c553f4860768e1dfb9ca0ed33963824fb09518fe3a938a7cc852ec00ddb1ab82fcec95
SSDEEP 192:sxZHR7yMqZ/K1Ml8Fme/fAsiWpVpwGLkizodpLHW6+WNGYvJY38jwe5IgZuJ:sxZHUle/fAsiWvpwEkZLHbGCz9Z6
TLSH
T1F472E8056A38997BCCD7D209FA557F53D7F9153392904E48A9FCCA0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6442d05dfc1932bfd053d2c6ccc07faefaa3107b141d7e588ae17751d3f00bef
MD5 a5741c7c3d136c4342c9776ce2ec3d10
SHA1 5584f3107ca9c823c1e7d0615a8b109b5d43824c
SHA512 0e66f279f216a159e95be5d24b5c3d64ad75528e2a8030c771adb331c378de820c1a08b2e9f8569568d1e4e10e9cddfae4d4a029021b7274a5d6ec460a506383
SSDEEP 192:sxZHR7yMqZ/K1Ml8Mme/fAs1wGLkizodpLHW6+WNGYvJq3ojUzIgjuJ:sxZHUue/fAs1wEkZLHbGCRQj6
TLSH
T11A62E9156A38997BCCD7D209FA457F93D6F9553392904E48A9FCCB0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 622310b46d0705f8464f47e775b729c393be942736cc7601c47a24493011ca92
MD5 3b0648456c884b32bf3f7fde62df52a1
SHA1 c5466e04cfcb8026721f679a944fb49a49d5f54a
SHA512 adf52f13460b7db4b7a7cd9bfd4ddac6b8a06bfb15a7edc66d1037f1f21b7da9768f426228c6dfb2d489aa4a2a5121837ddeb53b334a29a30d6eae40c79c9f31
SSDEEP 768:KJ4Z0+27pLuL/8MWv80Xo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvYsLLlXZUJRrok:KJ4Z0+WE/8MWv80Xou1jaaYsLLxyJqxS
TLSH
T150F20B3B6C4CCB7E4F804E9CEC2A7E8E6DE8028F9698885447F9944C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 a921fb16e81d28022c33f8f545fcbd9e3cb3cd5e30be50b4fe3d319f213aedab
MD5 bd048a8d77a7626706f208f38f5de697
SHA1 af988304edcf7f5f047db35ae1d49c1aca80c104
SHA512 008e28d4f5f76488b8752c285930507946783cd5e31e4166a76cf4e3a9850f0fb360849fe4cc2b538f5f87984478dd165574dce7eababda7fc8fe15fea78540f
TLSH
T1D8E0205466C4C57DA16523C30338DB0CC2D8B60FE2C83E411F44D9909242944716E550
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 e228297023ca6b7cc6e5eea81b0298d6b84c8886526ce1b99ed44be53aedb035
MD5 dd6d66752cb80e5e2ff3c48cfd80b208
SHA1 f35c782d77435652ef2ad37f19d0c195425ea8ed
SHA512 09cc8af3bd59da677ea762ff26c553e0aba9cfc2ea66307e1c9fc363b6d298409c73b8dabc61424d66f4c76b914e0a175801e09a387bbc0ca2f236734a5cfb7b
TLSH
T19AE02074A6C9CB2FE18535C75328FB0CC1E2760AF6C86D512F18F5D0E306580725F550
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 5eee5691b266788d28be7eec1e280c5c66c6c9f679d871f7429ac95e8e03339b
MD5 1d8881affacd18cc17638e0c504290ee
SHA1 11f2222bcbee402c51a7a084918661acabb87b85
SHA512 7f337c8fe57b768ccf1942c5cd32d40d67fc395b701a2291df7316aa7aed0a36068ac87f547bf755a367fd98c4d827d7414c5667448afa798d6bc1fd5eb2ee4a
TLSH
T16CE086B4A6C9CA39955462C34378EF1DC6F4BA0EA7C83F86570CD4A0E201594B6BE994
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 242a7c967bf4ffd9028899ff40ac4bedc37e1493ccf85bb7d6da39120716eec5
MD5 b73357e74de6072a6243ce6676cc2af9
SHA1 00905244cc7e9acb32d56cfee97bee1af8ac2f2d
SHA512 c29c32b37a8c73aced29b2adacb24c217194e11830de375fda04c347568dc49c083904d886215722e75bba50a31e762d4012b72c90e7bca02550764b4c18aa9c
SSDEEP 192:ANtDrpn3F2E9FHwgRBL3WDfSZXV9MJdvnn63mt99r/LWV9O7N/tN3/vtg:AzD9n17lw8BrWLSJCNNvve
TLSH
T189C23911317B02C13D7E294E81A5B86F66C231633198B92B3BB854764F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8c37be8b676db8162d563bf2f65a3e2bde5110ff55d12679f147487406c741a1
MD5 e3124c4516738b3702b91f874739a614
SHA1 4ca6369dcfdf36bc1c19e61d79a298fea1abe203
SHA512 aedc82ae3dee71d2f8667fbe257b29a8b9e9df6989cdd7db290f63cc51702b784a6795d630d2ed660e47cf55d287c30712ae42360786308dce08e0f27bd4a73a
SSDEEP 192:ANtDrpn3F2E9FHwgRBL3WDfSZXV9MJdvnn63mt99r/LWV9O7N/tP:AzD9n17lw8BrWLSJCNP
TLSH
T14FB22811717B02C13E7E299E8195B46E62C231633198B92B3BF844764F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 76360d706cbd07aaa5bb304ae750175ee737e78da60644632aa14c5a0cd054f0
MD5 2df788aff4376c632394729d79285766
SHA1 e44d53f6de786f6ef68fd8afec18e2dab4427e27
SHA512 8e195161443c71f61477c26eccdc4e389c0ef2de99736df377bcb9d5f03ca760adfb1f81e0021a7377f35d6e75b0fa412d2e0e4fd7cb58c754e849baace2e51e
SSDEEP 192:P+xWTs1wfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx+OwfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T12F24630A7B747001EDE6E9725CB080771E3C716DCF22A6915DA254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 637a1e0d0da561e160f695433347a90b990bbaa3dfea0a9d1ab04cf4f86adbff
MD5 96ff5291d1995f260a26f1a78b6ce193
SHA1 eced7c669e12450cc671f71545848a81bf9abf62
SHA512 ca12ca02cbfae0d9681131b9dc9f924e93f741b3296723ff7217aba1fba67653b4ffe37485c3166870473a06d3b56d45d79061ead274d2bc53e7fe7680930c15
TLSH
T1535136C193A964C6AF89B981C21D7C13A4E13E6B360E9871373E84F55F44C289E3FE25
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 e82efa4c4ac976276812ece07f45bbf7e3f0d66b984670bf5bd5f75aa4a63c19
MD5 ea063df0fdd859181fe7709b7f101e29
SHA1 7843ff856e8de18fe8fffceb138447bb1c96612e
SHA512 c01ae2080236237fc664c289a704b3458a8125f3bf306bdcebd3ced0e25f3cb24c17c31ab822c1cf0d29624277e779c41113acf5ac48dc33b60571cd68efccb5
SSDEEP 192:rxOHOAs4lrqxrs/G/PMleIcJIc5IckIcsQkIIIrbrMIMBgYcYA:MH3s6is+DVFQsQkIIIrbrMIMCB5
TLSH
T1DD72E6656B250733E26E6F7322AACB4613DACC820D61224E7621285F4DF2F638BD51F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 270cc1b4f54cace30d1d55ec946e63ef9bd9ccdb33678863ffec6069e962f81e
MD5 260f89a8a3874f515c6f7c4707278c4f
SHA1 5be1e8c8828fe4b66a689d8aacae9b6cff2e9715
SHA512 efee70f5d8efdb2397a4f55c577a95bf53318663b45d7a573867d9e34042a971cb0ec8ef69ae4b1a1555595fa29e8d04bf5c780ecc4621fcb92b8f31ab9d5739
TLSH
T1DAE02694B8C8C97EE5EB30C702259B0CC3C43A0BFA983E8A5F08D8C4E241500B2AE1A1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 848dbb263ed6ba969f6e8e791a2a43496d4192d189929416b8364979e07694a7
MD5 67559d9020f2ea6f4127721fa1428aa5
SHA1 a0a4ca7a9abaac00cdd8060a95c7ec6a3250382e
SHA512 2e0e3a0257d1ef81f6178e0df8e578a4490e1178bf90f30dd0df959fb348ecf0eb9af7bf1163264840a9d8673513606b61cc1e21addcade52a0d83e27e69cbf0
TLSH
T1E221BF55F320C249E18A967D942BA7351338E8129FBCED0F507924292EB2A001E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 7b65fbc01f39d80474fbd077f44959e749215279fccc1b75e063085f530a76ca
MD5 ed3a83106a252fdde5fa39c5f37f3839
SHA1 b357a54efc442124d47dbb82efaf899c268e2a3f
SHA512 bc01a2ac1e82cf6266e182352f629632d20512cb8dfda02fdb64fb32698b1da9451110a6f595448f09c1704e3c0cd233976434c4d37ecfc7ec6398d583650d13
TLSH
T1D6E0205474C4C5BFD1E230C30365DB4CC3D53907FB942E455F04CCC4D20154172AE161
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 759da275f8397168cae0757f0970bef5d67527074d7954ab0e2d10c62f43935a
MD5 49bfe2ff5b3aa762bc94d9c51f794c1b
SHA1 d7d62ce3d40d38aaf8752783734e81ea070e4bb7
SHA512 722ced0e4bf82e16bc1fdf3799a9427462eea4e3a9ffaab23eadc2b9d371918ab8e3957d8acd61a0114d5c7a5b7d923f71adf612bfdc819753c045febf3d1e6e
SSDEEP 3:MsEllllkEthXllkl2zEflKl:/M/xT02zVl
TLSH
T1BE4404047FCC0415D5C031304071C7501370D4140D31574335D104775CD7D401C14510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 208a8cab12589e88c812cf11cff9051f8f64becef9b3069d259505fcf1a3bc55
MD5 5c8a0d0240b431d8493999039f9d7e07
SHA1 ce76a142992618d8cd2c1b40e8f02e1131a25c68
SHA512 a87ef32190da492ed74361313f9a90e3ce4fc51cf3b08b7dfb1661a99a0e3baaad3d658915e0f99d2d95861ca0237739bb2e288fbb6280e016f7000083ab1398
SSDEEP 768:lFncpNcwgz3SmxUQZpVk72820E9dKhkoFYS/EGeK:SN63SS30GKhkoaAT
TLSH
T1B2E24A70E894CDE7A8E6CBC9A74AF542AEE401338948899CD6F86D2D209F0FD5747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2ac4e2c567bc83cfe306abcc672005434965dc8ba37668fc672bbf98258c51dc
MD5 a2604deffc69933ebce1488ba3636aac
SHA1 dbb3328d89b2c2d38ac7d1178038fede7ee144ff
SHA512 628441079504f898525810a4535d13f21eeb50e2a8a8ec67e04f0002c0977ab06726ef84c7c503b3d166d52a602e2ac0468ba39a46e1c728161196af2a65c15a
SSDEEP 384:nsiFavqMg3sNK8TUNTUlIm2TJvuxOiFGNLqvfqZpVhFL/wiRYV/Vw1mRQCe0wrNx:XFayv37wgzmxsdZpVrRYk1mu/0Ur
TLSH
T153C24A36E854EEABEDE78FC9A70A7A07DEE41167C58C4AD4CAD80E0E00971DE5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d995daa2aee5829c6d835e0b01e12645007b3b880ef33153764dd925d483e48b
MD5 47e7326527039d3eee48c467a883a419
SHA1 aa90bdc1b40a9891b9856963327f3853a968e97a
SHA512 599ff0e92be2360757a4d091b79268ce03ad572d179448b33e031fbf7b513c8f58e4cadf4e5c2c044350e4cb2de114557598840beddc8a9dba3cbd852190e1a2
SSDEEP 384:nEiFcCcmyWCNsNh8TUNTUlI4+3mTJvuxOkwHmqvfqZpVhFL3LrKmZhkP+lFYS/E7:fFncpNUwgz3SmxQQZpVKmZhkoFYS/EGw
TLSH
T1D1C25935EC58DE7BACEB8BC9F65A7683EEE0117385884AD4DAD90E0C00971DE174BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 95375c74740fe6e80d1d32eb141bfcb1273f52a76e174e875e7cf1281872672b
MD5 55c80dc8f4a3d1c79f0554adc9ead8c2
SHA1 36e2d393f2c05bb7c37a4c8190cabc30b626ce20
SHA512 c018730721cf774afe433134dcdba0b603ebef865d96d2f2cf72aee1237c742f4751ff88df07b452dba3a6b2cfef742f6a0a8c5fd28cc16ae0476b3688144eea
SSDEEP 384:nOiFavqMu3sN58TUNTUlI4+ZSTJvuxO507mqvfqZpVhFL3LrkjhkP+lFYS/EGird:lFayd3cwgzZ2mx7QZpVkjhkoFYS/EGed
TLSH
T168C25B35E858DE67ACEB8BCAF71A7643EEE011A389884ED4D6D50E0D00D31DE674BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 df81c0603eb5eaa729f3a912c7ce51a2a2abf3b58c828a76d0bc67170d058728
MD5 7b7a764b73496be21a7931f030978173
SHA1 47473754702e59719a6d2e6042ae5a71cc148f0f
SHA512 69634628149c2ad965137e62d7f6dc3245fb6d1999526ddc607480cddc12642d8eff16f79804bd56d61ea4aff6850a3abce580e2685029927e7fd626e8445c8e
SSDEEP 384:nOiF9CcmyWC2sN58TUNTUlI4+3mTJvuxOk07mqvfqZpVhFL3LrkjhkP+lFYS/EGT:lFccp2cwgz3SmxAQZpVkjhkoFYS/EGeK
TLSH
T128C26A35E858CE67ACEB8BC9F75A3683EEE011B385884AD4D6D94E0C00D71DE274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4acb901437c093115db5aebbae5554539d7ba467c7fdb4fdfcff9a018dc0cd0c
MD5 3eea1b19a3e15641dcb6c79a423a6257
SHA1 71d1dedd26fbcd78ef712d34ab6599e4b04cf8c5
SHA512 29f322ac74773b931d5627fb8cc40cd8a0ac1abfbb7be666bc111c7191842a2f684d2103b2107a24ae3e21edbd53df75cda9f7d22948599cc23ea007fd3f981f
SSDEEP 384:n3iFavqMg3sNV8TUNTUlIm2TJvuxO9H5HqvfqZpVhFL3LrljRYV/Vw1mRQCe0wrr:yFayv3swgzmx03ZpVljRYk1mu/0Ur
TLSH
T106C25B75E854DDABEDEB9BC9E70A3647EEE411A3C98C4AD4D6E40E0D00971DE270BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1d92a45054e665a16820c95d6c052592da61ef2b1280b6c9177c5e06d909cf91
MD5 a91aa3b6f1da4f02b7518dea97cc5abc
SHA1 db8efd926091a8718cacf0f23f7a7413abde69db
SHA512 d510f41925edff6f8ca56079b8fa94daa6895cec4c207ff1a091a0dd9d1bbd663595e9efefd7b5658ef853304b4293e3bde3de0d2193cc2638ae593932295867
SSDEEP 768:lFncpNcwgz3Smx3QZpVk72820E9dKhkoFYS/EGeK:SN63SSS0GKhkoaAT
TLSH
T19DE25A70E894CDE7A8E6CBC9A74AF542AEE401338948899CE6F86D2D209F0FD5747C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 ae66d6a7dc958f0804ab1cbddd8b51f8fbebd89e3cc76b7b0da047c4663fd598
MD5 01d13f280a2976b4e75cc6ab278161ff
SHA1 a190a05c85b0fd25bd155dca74acf6a3ab1a9d48
SHA512 61ee87b045f9bddd47d16ec82cceaba61243a133b590f155aeffc7585a9f02559dd26abd87b741d429b2b639ed792437f467bfb038ea3772cd6b1701e2e3c1b8
SSDEEP 3:MsEllllkEthXllkl2zEfluKt:/M/xT02zzKt
TLSH
T1FB44040C7FC40405C5D010304051C3501370F5550515575334D30C3F5CC7D411F05510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 8dfba2e1c879c5eee228fd08934e10ebbf8fa0d350fa2ad5706b2ccd1c8dc200
MD5 e2a14b2f62619e857f9157ce10820eb4
SHA1 ad7e948f879c24c6337b49764507aeb0fbb59bcb
SHA512 193a20e25161d986558eac29ac0bf3210badec388d3cfc370ad5d38f92a0703d7a833fb4fa68c0156987e4248139da354ebae92983f2eaae6e510cf3453b6d4d
SSDEEP 768:1QaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:6LhaqLI1WcxKgdfHJHH
TLSH
T14663D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E792F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eaef354af1306109548148da6079e6bfae44cd204d15d8077d76dcd71a6a9363
MD5 0215f78c3cf97542f23219143e1646a4
SHA1 64f3ab6ac1649f3a647e8a0b978d8abe9205b7d0
SHA512 cf5a9f7cab1f43a9b5f8f3ebce2da080148fa9d6c23f50a923d54bf5acbf868506bdff276cc17d24159474eed1e2c164b13580e868a71a1f24093ee718a082f4
TLSH
T1F041F858A6F91158B3B77E6AAFF6A82D447FBD772E0A946D10110E8F0763A00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 16066c50e548090604afe1bd583fbf74b32f918a1daddab5c897dadbd87763f2
MD5 2f83263f6b326f44b8a4dd2c36d4145e
SHA1 d66359c4d8f3716065c14b6465ac27bfe8e40e7a
SHA512 2eba6eee5441ad4f886684c3c35091d184098ea7ca9ef3fb5f38b9230400495b38f6dcc4e134661a4c7d041060f96f4f570642a5a85e0fbe7308ec822b36500f
TLSH
T140516C5876F91048B3B36E5A9BF669AE583F79733B07955D10010F4E0632A40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 2704af1d10e61e9a341331f0a9e3dde934c7f8b54855aec064dc372cb7bc0309
MD5 26d1a0db315a520412ab4e5c4e4ef050
SHA1 f00c3bf2b03089c8aec7fa8da51244855f7c608d
SHA512 eb50139f70f1f423d6193902b32e0cd72d02bd7edae16a4257f58fe7d73e5c7ca97a194cb7e52aa91166a9af5311809a26b84b9929dc6fb1317ccaef251b11dc
TLSH
T108513BE13535633F97C78BD960760C8469A0E18103BE9A5CED6B8435BD5CDE0632EBCA
MD5 SHA1 SHA512 TLSH

Submit Download

eb48bb57-c8a2-4439-815c-1fbfc736ab9e.tmp

Path C:\Users\Admin\AppData\Local\Temp\eb48bb57-c8a2-4439-815c-1fbfc736ab9e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

memory/1080-52-0x0000017DB4260000-0x0000017DB4309000-memory.dmp

Download

memory/2444-531-0x000001D2EE060000-0x000001D2EE109000-memory.dmp

Download

memory/3704-875-0x000000000E9D0000-0x000000000F0C2000-memory.dmp

Download

memory/5020-597-0x000001DB98A80000-0x000001DB98B29000-memory.dmp

Download

memory/5696-306-0x0000022854400000-0x00000228544A9000-memory.dmp

Download

memory/5772-216-0x000002876E530000-0x000002876E5D9000-memory.dmp

Download