ce56b1af536a9932fe6a076e63d30a46e685333c94417c990ffe5ffd6a729f7a

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce56b1af536a9932fe6a076e63d30a46e685333c94417c990ffe5ffd6a729f7a.pdf
Size 52KB
Sample260628-e69ggafs6p
SHA256 ce56b1af536a9932fe6a076e63d30a46e685333c94417c990ffe5ffd6a729f7a
MD5 9053851b3bea3196cae56fc9e5b34eb5
SHA1 a6efb0a75528a6df748b3782413b34b8bc7d1980
SHA512 8f60254dae2e7ddaa060ca2a2fbcc1e4d0530162822c57b6a30eb875e3964122220276f7ba88a7101b5e1cbd4e72fd29a751d50c3b0efeba83946ad3cb54b19f
SSDEEP 1536:3KXdbgOQdx2lvUMqmzg5JmzH8nekaaycDXZ:+bg2lvtzlH8NaaycDZ
TLSH
T10D33DFF6DE2FA346E2748C36169D097179A8812D082C42EB2D67597038DC5B727F48FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\msedge_url_fetcher_6108_1188694838\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_391114966\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_1886807157\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_381867652\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_391114966\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_1886807157\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_1886807157\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_381867652\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6108_537481433\_locales\sw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
772	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270948947921346"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{981C3000-6E3E-4B8F-B645-75DF75EC4C35}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4560	AcroRd32.exe
6108	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe
4560	AcroRd32.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5280	4560	AcroRd32.exe	89
PID 5280 wrote to memory of 6112	5280	RdrCEF.exe	90
PID 5280 wrote to memory of 6132	5280	RdrCEF.exe	91
PID 5280 wrote to memory of 6132	5280	RdrCEF.exe	91
PID 5280 wrote to memory of 5272	5280	RdrCEF.exe	93
PID 5280 wrote to memory of 2256	5280	RdrCEF.exe	94
PID 5280 wrote to memory of 4940	5280	RdrCEF.exe	95
PID 5280 wrote to memory of 1688	5280	RdrCEF.exe	96
PID 5280 wrote to memory of 1688	5280	RdrCEF.exe	96
PID 4560 wrote to memory of 6108	4560	AcroRd32.exe	111
PID 6108 wrote to memory of 4200	6108	msedge.exe	112
PID 6108 wrote to memory of 2252	6108	msedge.exe	114
PID 6108 wrote to memory of 772	6108	msedge.exe	115
PID 6108 wrote to memory of 2252	6108	msedge.exe	114
PID 6108 wrote to memory of 2252	6108	msedge.exe	114
PID 6108 wrote to memory of 4352	6108	msedge.exe	116
PID 6108 wrote to memory of 4352	6108	msedge.exe	116
PID 6108 wrote to memory of 3308	6108	msedge.exe	117
PID 6108 wrote to memory of 552	6108	msedge.exe	118
PID 6108 wrote to memory of 3308	6108	msedge.exe	117
PID 6108 wrote to memory of 3308	6108	msedge.exe	117
PID 6108 wrote to memory of 552	6108	msedge.exe	118
PID 6108 wrote to memory of 552	6108	msedge.exe	118
PID 6108 wrote to memory of 5816	6108	msedge.exe	121
PID 6108 wrote to memory of 5816	6108	msedge.exe	121
PID 6108 wrote to memory of 932	6108	msedge.exe	122
PID 6108 wrote to memory of 932	6108	msedge.exe	122
PID 6108 wrote to memory of 3352	6108	msedge.exe	124
PID 6108 wrote to memory of 3268	6108	msedge.exe	127
PID 6108 wrote to memory of 3268	6108	msedge.exe	127
PID 6108 wrote to memory of 3268	6108	msedge.exe	127
PID 6108 wrote to memory of 2600	6108	msedge.exe	128
PID 6108 wrote to memory of 2600	6108	msedge.exe	128
PID 6108 wrote to memory of 2600	6108	msedge.exe	128
PID 6108 wrote to memory of 5792	6108	msedge.exe	129
PID 6108 wrote to memory of 5792	6108	msedge.exe	129
PID 6108 wrote to memory of 5792	6108	msedge.exe	129
PID 6108 wrote to memory of 1556	6108	msedge.exe	130
PID 6108 wrote to memory of 1556	6108	msedge.exe	130
PID 6108 wrote to memory of 1556	6108	msedge.exe	130
PID 6108 wrote to memory of 644	6108	msedge.exe	131
PID 6108 wrote to memory of 644	6108	msedge.exe	131
PID 6108 wrote to memory of 644	6108	msedge.exe	131
PID 6108 wrote to memory of 3828	6108	msedge.exe	132
PID 6108 wrote to memory of 3828	6108	msedge.exe	132
PID 6108 wrote to memory of 3828	6108	msedge.exe	132
PID 6108 wrote to memory of 5756	6108	msedge.exe	137
PID 6108 wrote to memory of 5596	6108	msedge.exe	138
PID 6108 wrote to memory of 3608	6108	msedge.exe	139
PID 6108 wrote to memory of 5832	6108	msedge.exe	140
PID 6108 wrote to memory of 5832	6108	msedge.exe	140
PID 6108 wrote to memory of 784	6108	msedge.exe	141
PID 6108 wrote to memory of 784	6108	msedge.exe	141
PID 6108 wrote to memory of 3596	6108	msedge.exe	143
PID 6108 wrote to memory of 3596	6108	msedge.exe	143
PID 6108 wrote to memory of 2564	6108	msedge.exe	149
PID 6108 wrote to memory of 2564	6108	msedge.exe	149
PID 6108 wrote to memory of 4288	6108	msedge.exe	150
PID 6108 wrote to memory of 4288	6108	msedge.exe	150
PID 6108 wrote to memory of 2936	6108	msedge.exe	154
PID 6108 wrote to memory of 2936	6108	msedge.exe	154
PID 6108 wrote to memory of 3772	6108	msedge.exe	155

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ce56b1af536a9932fe6a076e63d30a46e685333c94417c990ffe5ffd6a729f7a.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E20C4FA375982A332EC3B88C5FCC83F3 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8B0572F765EA507E540C7EB68885D04F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8B0572F765EA507E540C7EB68885D04F --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6132
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=39906D936091953148951D9C77A65273 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5272
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF6BDC61D9653299E5F48987FDDB293E --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=877F1BF7C96076F4BB6D66E69F8CB9D6 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21F3E451111916C9C28D1D07F6B0ECD9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21F3E451111916C9C28D1D07F6B0ECD9 --renderer-client-id=7 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://celeritech.biz/.s99/go.php?c=ZpyGHA
  2⤵
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffc7320c188,0x7ffc7320c194,0x7ffc7320c1a0
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,13609721095447569835,12551862904151538823,262144 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,15797281933880365382,16463386336476676278,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:3
    3⤵
    - System Time Discovery
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,7287376805185816381,2220999631798532033,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,161844769196564414,7550674313631330798,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15610347494707394623,42650957090036477,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,17934779377133406159,12503460898006913453,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12923522075862842062,403721275097670790,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1932681695542949672,18402930728728938557,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1932681695542949672,18402930728728938557,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6036,i,4582827880639590871,8887351297883129647,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6268,i,4495489368603253235,8200375296423097096,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3560,i,6928675979097051508,12916335583021424,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6364,i,11089606767943337158,7901978502740846978,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6784,i,14041955018937774898,4685104864665250042,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6976,i,14435652905321153411,2136198133104452317,2097152 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,17271197243223096342,10148893142313765152,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12003976221438114599,1153125922315309741,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,5989719280651684184,4623441200911668268,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,16263273594207642789,12637331979709007420,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,5746937070988172667,7033896453475586689,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,12794429940709316162,7484549506057107342,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,10435662636578261406,6389893280808932853,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,16720692350995425657,6228401867437256306,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,18377055801673236264,3513753647175506240,524288 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6832,i,316526942976654063,933492695993413376,262144 --field-trial-handle=2288,i,13930147550764340423,11602334679795879126,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6108_1886807157\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6108_1886807157\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6108_381867652\manifest.json
Size 118B
SHA256 0dd431412bbf85c1cb0f55639470e825b9c4d92bbecbaa5a6bf47906e899fbb5
MD5 cb16493aa263c0658b1cbee697566695
SHA1 0acecec2c0a7cd6d9aeb3a4f9de67a182d8ced9f
SHA512 83588bfc7fc8f40d7bc833113904a8305014a3e2e5d75bea64b42a98078883d75897e1829f54468703fcdf7ee28f5deba8228a3cff18acc0a817716add4b717e
TLSH
T1E7B092B00C0AA03B228097A0ECB06682C3F80218E8051B2A088132881F881B884362E2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6108_391114966\manifest.json
Size 53B
SHA256 9943e80ee867bd06da1039bb873407d16bd5d8f9701bcbd145bf6ebf8e4d7560
MD5 11d9be17529b9a6c83e5572db6d92e0e
SHA1 df0c90e32848efe07103037707139d5f00bb1ee2
SHA512 d82fd6693a7319632e0b9e55f6ccf4660ea01447ccf49f992e2111f901988b49cb7f25309188a218aa3f4ead9c75f9f6d2dba5300efce750c3da0d7de98cf663
TLSH
T1129002604514951716C10E9065B1B891A391661995850D1D04451559069546CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 21a03e1d04b2a9629b211fbca98a52a870ab6f0ab9ad60cd078f685e2b3bdea8
MD5 69ed24028c75e52585817427427406b5
SHA1 664b7d7c17678750270be4fdb82c61473ffc780b
SHA512 eb160f6836902e702005522e63d4ce14a65118f4cbd1c025dd9a94cd12ce2a758557c48af26160c8016f77ce5a1c657c6a52c4e6d901d249d747ed1eca35751b
SSDEEP 384:yeWdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:9+eUZsLQCZsL3hUS4
TLSH
T11D53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a31cedc-fa23-403f-b182-fa5d15815f74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a31cedc-fa23-403f-b182-fa5d15815f74.tmp
Size 33KB
SHA256 4a750f46970c1da7e5107e33e86eb5a2d2dc8ec6f1ed1406659eff5fcdb3fc15
MD5 2700cde31514d3c5d53e7586dd48d4db
SHA1 7e229bf074c8696046cbd793b3567877052a54e3
SHA512 7c03e48f49c9f86a90953a8c9750b1cccf9d97383b937b257a267ccdde49de482d2220efdfb089d32b3cd3874aeb3db95651dfab64dd74910c2493117d2ec0f9
SSDEEP 384:neWiF1tNn/s3n9Sx5sN98TUNTUlI4qQckCrsEfHupvBftG0oDti/7cLT9z/GAKm0:YF1j+9UcwgtkgfwjG02I7i/GA/7qH
TLSH
T17CE2D3F198D78977E89E8B87A73E2E429AFCC16375885984B7D44D0CCD821BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 748e36f3ff21c7e39380e46d82dd9405daaf688a07c50fac2dec1fbab8b1b6b8
MD5 3b8c2f3c949350fefe67d22e57127f93
SHA1 72a099922b5f6a72f9008edcc01f25f260fa143f
SHA512 80319f9d7a128db649751d93c046c03e82ebe839f4a8d154ede55755f9216274b7f822ac8ffe791505da8dc99d50e13ecc50c34fdaf5f4dce7337cefba79ea6d
TLSH
T127E02B77C862EC2728FD47287009875AE74017673640494F3B3C83088FB062A45C585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7cbf1eb9af3a7eb9dad0b2d40f19cabdedde08f1d0085e85d73754ad6d018deb
MD5 3c908ac1c50bfb127b5599d102f74f92
SHA1 fb89957c034190945213656ad55d44a4ffeff5db
SHA512 57448c346a70b70e7373f40586b9cde3a6fc24271275045b86b37144de10c6be163b9aa4892d79a07143fc0a689eee2c0ff7a451972a304ab4b2b191c771b196
TLSH
T1F071E6F8E903E9A6DBE50E3783C1F231397281D9FA534D8C226784BD2E19769C10EB04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c8e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c8e9.TMP
Size 3KB
SHA256 d4ebeedd847aeb684bf8634a45012f48d458c69a00c3ecf99e471b1f3734ce06
MD5 6e1a335f6d6102e1341ccf67269c2018
SHA1 44241e7ad997894ae6560c68f814ba176847b2ef
SHA512 fba7e96f284029b8d4fa34c83cdf833e6d0a4a58fcd92b4c530ce2e561b19a78acb9ace4c9cdeb28f8c0046870927c5a987209f850981ee6f533e84096efbb47
TLSH
T1CB71E7F8EA03D9A2DBE90E3383C1F270397185D8FA534D8D226384BD2E59758C10EB05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 de7d46190352a3ebc800ed26c1dc4319d0dfbf0642fddfa75033403e827303d1
MD5 7770b2d08a318ca8e7ea4a547dcb6a6d
SHA1 87eecd0536df73816a8fab901ac929fa39c19dbb
SHA512 2d377adc4533605f9992eb2b7c304963afb596890c5a6468a4f80a12716b6918269452697e33ee82ea8b8bc1bd02154839833860919e63ab65d539854029cbce
SSDEEP 96:D1HBOFberwxq5aij6hzL86fsQ4j/PBwXVRcO1l:D1UFberwxq5aij6hH86fsQ4j/5CVRcOH
TLSH
T181C1B0E7C3E8861DD91156F1AB147E37CE6D0954832C3C5AC9E4EF0BA7E2071E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d9ae5679905f20e33148753d6d6681dbea4c7b38cc2035e547f0f8d1138ee02b
MD5 5fcc4a8dc57a4a4a10f436017d6252fe
SHA1 18d09b897bbb8636f5f48f9a6f5d8488e67db6e7
SHA512 f1e96d354a07ea60c31d53e416b0ed154ac44822c7a050270f4eb78c3fcb3a151e7b86cf1801db61ceb4b725b6248d56faae01ea507c6cd36ed0d7690daf5a88
SSDEEP 192:sxZaR+1yMqZjK1Ml8Mjw/fassW1xaZdIaRuvLzodpSm66zHW6+WNwrlDI/zFvju6:sxZa0o7w/fassW1xazIKYQScHbD/wyjl
TLSH
T18972E91666345DBB8DDBD219F645BB63D2F91122D2A05E44AAFC8F0C05E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2557674b569842a9becb2d153234512c248695cbcf734a1cdff89ac3ac228116
MD5 c8e53d036b3a1266314ab5cb090b29fb
SHA1 768f7f249fc91cab4913f6b0db25cff3e17dcaa3
SHA512 bf7c4fd2d8d7f880adb2dd1c6a7622f16aee80fb0e344549e5022ef0cc9d76cfa505b66615239c3358a80aba78a86959fdbe173f5513446e02f0ea1ff6e020aa
SSDEEP 192:sxZaR+1yMqZjK1Ml8UQUjw/fasT18ZdIaRuvrzodpSmN6zHW6+WNwrlDI/z81vN+:sxZa0oqww/fasT18zIKYwSdHbD/ayM2
TLSH
T10572E91666344DBB8DD7D219F545BB63D2F9112292A05E44AAFC8F0C06E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 10ca528b5e29c34e984a436c7888ebc436fd8df596d774f0ed949be8201029b4
MD5 c65dc2d319272cc1f455b6606259b04d
SHA1 083ab3eb18e8bf3106b40b92129acc4a1163eb59
SHA512 6cfb201bbb4ce2ddb55a9db51a2a332a3b0b194b430ce2884ae3dfaaec1787e6ff982156412ea4688992ea2596c2e3b871f952f2ce13b62dc4664bd0cc1266d2
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvysy10LlT:eY8Od/HEnFhWvFvQXu1jabt10Lm2Nu0h
TLSH
T13BF2FB3B6C0CCF7A4F844E9CEC2A6F8A6DE802CB5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 570c34e8e1d84489c1abcf2b73f784845bb5e6c8462ee85ed95b325b45760694
MD5 e173c8dcac6df0f0d75499fa059e1367
SHA1 f1099110d046322b436eaa6018fd31bfbfbc4c61
SHA512 f0e3b152210c59c1b8ee79e3949c6dd6da4b4668d5c04a386582fe97d2f7fb6b12e278fdcc07b13cd2f11c469bcaed9f286c760bb0ad04ca56499a70f552766d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG4:05ppxnY753RNBvRJJdt7p5J9rL9a
TLSH
T138B27B5A703E0211397E298CB39696364F4235A37058E4AF7FB814A54F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.15\data.txt
Size 149KB
SHA256 6c06804841a25558d413ef4a693eb0af3dd7c73d00e13b4aa437a37bef468256
MD5 c85d9f0ea7e0bb78c6904b1cbd56febc
SHA1 637dad8c1ba9c984069ceb3cad16ed7b42fd94e1
SHA512 4f81f0c52c163d4c63b1e88bbed8479c06026d202bce3e7c479af0aca4fcaf325608e48b80be385528c084a0f94bb0a579a2df77992eba95701846b5c67b54d6
SSDEEP 3072:mPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhrYgtryMcsPB:aX1aI5aZoKzMJ07NhrYGr3cs5
TLSH
T169E3F110C9C40F9DDFA82A2C50FE0B0DA3D0879D85677AC6DB73BD4AAFA7A0552171C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fd59ef982b9a78f8b6633aa5f04bc2a42115fa46b6ef8046ab5872baf2f30ffc
MD5 619d5f18eaaff672169b48143d08b880
SHA1 c940d4d30e1797bcc25266b06f0edbd2c1a74007
SHA512 4d380ce33a732a6821d3f48a61054e5cc6d3b31dd917c9b30bcb2e939187d49f7df3094c96200600e2d630e4bc2e5246591b095a8f485870b4b37c5775b9cf2b
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9l1KpvBftG0oDti/7v/bpje4KV8p0+Hr:pVFccps3GwgbkUvkjG02I7v/pI8p0or
TLSH
T1FEB25B36EC68CABBECE74F99F70E6A07DEE0512785DC99E4DAD81D0D109719C030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a42060de3a625537ecd5b3db606a2216e49650c9089a5f7d5e58018d332d5bbe
MD5 0bfbf542a9466be02f6bff6bcf1679e3
SHA1 2c3ea2eaa2c2b5d6fe9f74136bfe64e0963ed9d9
SHA512 96104d874c855975a0183869bac0a509a9d4e195f795bc756de73f37883705d3e2a09978adbcea068dd3b2e056ee1b143294abc552b3c6d959d1c20fec3eccce
SSDEEP 384:npDiF9CcmyWCs3sNj8TUNTUlIm2QckCr9NHK/pvBftG0oDti/7cLTa/Ge4KV8p0K:puFccps3KwgbkUZKxjG02I71/GI8p0or
TLSH
T1A1C26C31E868CDABECD78B99F74A7643DEE0517389CC9EE4DAD84E0C109719C170B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0e299173683eb06bb66c65a64c19f36396e1e4c4fd61c2a870e78937d29d3900
MD5 8fa630e45826b3cf3d1af901375f8088
SHA1 53b32a552f8ae8346538e4dafc24e68368c26528
SHA512 888f96bc1908500111636aeb8df91be3496534458de30d3f8459b7d753fbe70c4d315c53496fc9a259a0283e1fdceb15148bf9a3fa03ee9f2c7675e531ff3bfd
SSDEEP 384:npuiF9CcmyWCz3sNH8TUNTUlI4qQckCrsEgHupvBftG0oDti/7cLTXv/Gesty/7r:pFFccpz36wgtkMgwjG02I7q/GS
TLSH
T119B24B31E8A8CE67ECE79B89F74A3653DEE0407389C89ED4DAD94E0C018719D170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c24451240f00d885a36730a6963948492455ec0f971208e8d2aed72fcbf14ce7
MD5 4affd544e6cda5d28fbb1456726f28a6
SHA1 2a7f23878913d88f99b7827c69062873ce63fa0f
SHA512 64b438f960e2cf1342dd395de282cddde4976ec1880d15f2ed31634e3daeab2f863adb32f3fba8c86b324e6c389c3fdcac3dc57f7682031085236b17560ad12f
SSDEEP 384:ne9iF1tNn/s3n9SFsN98TUNTUlI4qQckCrsEgHupvBftG0oDti/7cLTyv/GAKm74:BF1j+9qcwgtkggwjG02I7X/GA/7qH
TLSH
T18BD25C32D865CEBBACDA8B99F70A3647AEF001A3899C5ED4DAD94E4D01C71DC130BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d0688e0708fd7f7df2b770ddd0f432159dc132b8371a4f0c217521dc60160ed8
MD5 28c79c2895d8dc2e2ab37e4b7e05525f
SHA1 963d4039f3429223e0795c7b916e34798d4c0af3
SHA512 234129f6e1977821ec8ac90dfaf2ace3d48bae673b82da16d747892cf0578a14ba2e700fbb2f5d5ed94b4d5fafccb2a32f70bb01613f737be4cbb6577414d054
SSDEEP 384:npuiF1tNn/s3n9SFsNH8TUNTUlI4qQckCrsEgHupvBftG0oDti/7cLTyv/GAKm74:pFF1j+9q6wgtkggwjG02I7X/GA/7qH
TLSH
T1CDD25C32D865CEBBACDA8B99F70A36479EF001A3899C5ED4DAD94E4D01C71DC130BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.22.2\typosquatting_list.pb
Size 632KB
SHA256 c59a0062f5efa43c1d2546eba7d29edcd67f8d2ca7f1b35cc6ca5f81d7688ad8
MD5 9fb3c6f349a14dc20fbfebee740f7074
SHA1 69cd52a7eb43cee17300563fa841106a8b486cb0
SHA512 ce69e7ec3c28ba556266d5b824d2964bf4c74e080c3877bb6624cf7d4698560b50950f1eec91b66f0e4a463019c064ca659ea015c3c5685d185de6c3a5c8c93b
SSDEEP 6144:O/K6mZ8qhjAh0XI3q74/7o68QMPuavZ8Da8Quo:aK6mZ8qaUI3q7/tvZ8Da8Quo
TLSH
T197D4B5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3cb458dd0c60c0f83924bf26ecc93ba7e7585e21140c507e8296e6c1a730d4d2
MD5 eb8f9e7ea8329ef7f9099c1bb4b73385
SHA1 ab47fbc60024a839f5d78f839dbff2c22f4faded
SHA512 84d45b8cdd5dc617bf3bff9655436ab8555a1720151573e353b294ba1745471b016a8ed5431187d18df1350e03327b9e31b879f3ab03c15cbc96ffefe84440f0
TLSH
T1EC3121E25C391AE1C4BD0EBFA49738FC84E8D62AF1E470796898E994062D91D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e149b60a0f756427ed61793e8892eef5fffeba6b5535226fc4f13f213f62707d
MD5 e1fe85a3c210069bbe0271e9c99caf3c
SHA1 f73b50d361767ea6831e9bf90c0f747d4013e998
SHA512 f83fd6b88eadeae504c0fc1f29a8cf188128e98e7449980540009b401666a617ad7a493565636dc1a7d6279199a3fb917958cb7bc80d942939d9cf26321b1ef8
TLSH
T19E3121E15C382ED5C4FD0EBFA4C778FC94E8D62AF194307A2898E994462D95D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 461182d8b44211000a624dcf2ac5f3f2a25e692fb24eb8461113d88df3bbb9c4
MD5 790b11be84f94b746dbd23ed92010e81
SHA1 d3f6aaf75ac75e0a1c4decb8b7d8e992a21e7438
SHA512 b7d796bfeceb77c2665c6139cf729632f1a946df8646b807b73825ba4bfa90b65e1dd583364f1b34c14008537f3c035530edcf109494959de389fd7f7d6ddf05
TLSH
T1723101E15C381AE1C4BD0EBFB49739FC84E8D72AF1A470796888E994076D94D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35b0a0902982988244ded834dd79bcc8f63a3b1efa17929221c91d0fa7629bf7
MD5 1b909befcfd9cd8643b76b61cd5f2731
SHA1 20c11bce68d23fc9b335074e804cf64a51fcb6c3
SHA512 61e9d83f3f3b5c347724138e5e674ada09f63e07eed59f85988d0a6c0148e271fbc86335ebbe4e167e81ca3f44993f6e4e639939ff6184494f997d12a6139bb6
TLSH
T164412C5CA6E92148B3B36E56AFF2A86E443EBD372E47D05D00010E4E0B23B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download