4bc9bac3840ffeb0c635734613fc46ce9228088ecf563b072c50315dab59fb08

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Receita_Aviso_protegido.pdf
Size 173KB
Sample260716-yfjmxact4k
SHA256 4bc9bac3840ffeb0c635734613fc46ce9228088ecf563b072c50315dab59fb08
MD5 44560dda67cac6a551a01ec5f606599f
SHA1 87bfefb18bcd19d5c8022980a77e4b2f8fb1a2d5
SHA512 44551a552d84f16bc50d207b0badc56cc3c2cb08dca7fa4d62ac72464738bd12703d572488d5ed2835ac1d0eab1fed3883d4089ae6e684323e7bea9522ebe40c
SSDEEP 3072:iJSZsTud3Du7037I2V8GhcHa+Nfpd6VCAtjNf6BI05n8IMb4NPOthNSVi1B19ykk:rZsTI3Du700m8w+Nf6V1xf6y01BOtTSj
TLSH
T15204129A95E98DDFCC9500066CF168C5C2CE52630FB67819B59FD0D42FEA508F3AD7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4452_1800177946\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4452_766420403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4452_766420403\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2480	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287048128924818"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{A337886F-5CE5-4695-AFED-F566168F4A82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3956	AcroRd32.exe
4452	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe
3956	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 2692	3956	AcroRd32.exe	87
PID 2692 wrote to memory of 4332	2692	RdrCEF.exe	88
PID 2692 wrote to memory of 4332	2692	RdrCEF.exe	88
PID 2692 wrote to memory of 4744	2692	RdrCEF.exe	89
PID 2692 wrote to memory of 4620	2692	RdrCEF.exe	92
PID 2692 wrote to memory of 3444	2692	RdrCEF.exe	94
PID 2692 wrote to memory of 3780	2692	RdrCEF.exe	96
PID 2692 wrote to memory of 2720	2692	RdrCEF.exe	99
PID 2692 wrote to memory of 2720	2692	RdrCEF.exe	99
PID 3956 wrote to memory of 4452	3956	AcroRd32.exe	100
PID 4452 wrote to memory of 4080	4452	msedge.exe	101
PID 4452 wrote to memory of 2480	4452	msedge.exe	102
PID 4452 wrote to memory of 3848	4452	msedge.exe	103
PID 4452 wrote to memory of 3848	4452	msedge.exe	103
PID 4452 wrote to memory of 3848	4452	msedge.exe	103
PID 4452 wrote to memory of 2424	4452	msedge.exe	105
PID 4452 wrote to memory of 2424	4452	msedge.exe	105
PID 4452 wrote to memory of 360	4452	msedge.exe	106
PID 4452 wrote to memory of 360	4452	msedge.exe	106
PID 4452 wrote to memory of 360	4452	msedge.exe	106
PID 4452 wrote to memory of 52	4452	msedge.exe	107
PID 4452 wrote to memory of 52	4452	msedge.exe	107
PID 4452 wrote to memory of 52	4452	msedge.exe	107
PID 4452 wrote to memory of 5020	4452	msedge.exe	108
PID 4452 wrote to memory of 4580	4452	msedge.exe	109
PID 4452 wrote to memory of 5020	4452	msedge.exe	108
PID 4452 wrote to memory of 5020	4452	msedge.exe	108
PID 4452 wrote to memory of 4580	4452	msedge.exe	109
PID 4452 wrote to memory of 4580	4452	msedge.exe	109
PID 4452 wrote to memory of 984	4452	msedge.exe	110
PID 4452 wrote to memory of 984	4452	msedge.exe	110
PID 4452 wrote to memory of 5960	4452	msedge.exe	112
PID 4452 wrote to memory of 4084	4452	msedge.exe	113
PID 4452 wrote to memory of 5960	4452	msedge.exe	112
PID 4452 wrote to memory of 4084	4452	msedge.exe	113
PID 4452 wrote to memory of 4968	4452	msedge.exe	115
PID 4452 wrote to memory of 1100	4452	msedge.exe	116
PID 4452 wrote to memory of 1100	4452	msedge.exe	116
PID 4452 wrote to memory of 4688	4452	msedge.exe	119
PID 4452 wrote to memory of 4688	4452	msedge.exe	119
PID 4452 wrote to memory of 1344	4452	msedge.exe	121
PID 4452 wrote to memory of 1344	4452	msedge.exe	121
PID 4452 wrote to memory of 1344	4452	msedge.exe	121
PID 4452 wrote to memory of 1540	4452	msedge.exe	122
PID 4452 wrote to memory of 1540	4452	msedge.exe	122
PID 4452 wrote to memory of 1540	4452	msedge.exe	122
PID 4452 wrote to memory of 5632	4452	msedge.exe	123
PID 4452 wrote to memory of 3824	4452	msedge.exe	124
PID 4452 wrote to memory of 5748	4452	msedge.exe	125
PID 4452 wrote to memory of 3560	4452	msedge.exe	126
PID 4452 wrote to memory of 3560	4452	msedge.exe	126
PID 4452 wrote to memory of 2380	4452	msedge.exe	130
PID 4452 wrote to memory of 2380	4452	msedge.exe	130
PID 4452 wrote to memory of 1696	4452	msedge.exe	131
PID 4452 wrote to memory of 1488	4452	msedge.exe	132
PID 4452 wrote to memory of 1488	4452	msedge.exe	132
PID 3956 wrote to memory of 1640	3956	AcroRd32.exe	133
PID 4452 wrote to memory of 5528	4452	msedge.exe	134
PID 4452 wrote to memory of 5528	4452	msedge.exe	134
PID 4452 wrote to memory of 5528	4452	msedge.exe	134
PID 3956 wrote to memory of 2640	3956	AcroRd32.exe	135
PID 4452 wrote to memory of 1532	4452	msedge.exe	136
PID 4452 wrote to memory of 1532	4452	msedge.exe	136
PID 4452 wrote to memory of 1532	4452	msedge.exe	136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Receita_Aviso_protegido.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=952D80A515EE1B444972A6F849F2F192 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=952D80A515EE1B444972A6F849F2F192 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A7ACC53F6ADDADB8C20D691E7A15619 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB84710059E307E7A3690E76F904516B --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=50BFFAEC8FEC0FED306A5A4C9AF73576 --mojo-platform-channel-handle=2044 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BDE0E240BFE9E5D7A8CC897FFB0B6948 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E4096BD6F30A1B9771C4853A2A47D803 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E4096BD6F30A1B9771C4853A2A47D803 --renderer-client-id=8 --mojo-platform-channel-handle=2552 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blogue.blob.core.windows.net/blogue/D18080CDOVMa45Aasd5XpZbs.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc7f6cc188,0x7ffc7f6cc194,0x7ffc7f6cc1a0
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,18437385401129158396,4391461879374611692,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,16333662795004880308,14154175126146925192,262144 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,13184893614980338704,5639793844655415275,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,1301546936051334170,13454961253732754769,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,3609937293438741538,3414275468792619152,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,15018603062419846331,7859368104895321381,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,3990841766875399465,15273830911928695954,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,3344413476343905008,9772682503431237735,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,5405212861685314514,14906383323261294171,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,17015242420728578259,8776903219763614197,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6367232512461755153,7508731636447420662,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6367232512461755153,7508731636447420662,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7636679771680618438,1765301847352220552,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,3293685155701420143,16885027047377282654,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6676,i,15111838129329453600,1420988236827925647,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6640,i,9991965573146619534,18112709808536187806,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,1274406720668253793,4746879633835181545,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,18416830974195929862,15576619637316037895,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,1776528989475508475,9428195289128125624,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17247736512359480071,10719899039680437444,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,15889693214524609615,12202431106185164853,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,11151134261124508930,17850963476468041616,262144 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2924743220011530080,16406484389562334796,524288 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3448,i,4530200771374736062,2160369542125054129,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5580,i,15372108150167080899,10652474727955599031,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5840,i,17829815208539799226,8429425891640946261,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6240,i,12624523826732704234,14539476256615474890,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7016,i,15104198731541774253,8013205912438102080,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4808,i,1578599730449474154,17022133586436249529,2097152 --field-trial-handle=1992,i,7408853008114963986,9368488105996256244,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
    3⤵
    PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blogue.blob.core.windows.net/blogue/D18080CDOVMa45Aasd5XpZbs.html
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blogue.blob.core.windows.net/blogue/D18080CDOVMa45Aasd5XpZbs.html
  2⤵
  PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 5088f9731ec4d130580c32cc2af7864790cdb519712e790d56c89f79450be9d8
MD5 7d923cb431a5289d0ac0954dc4f87577
SHA1 0e3327a9e1202994658f0914615a6c11631e6f1c
SHA512 b522265f246a3c50cc7559bb88c1a200d6a5fbefe4f84a3f268a7523ae43952d3162a93eeaf1e689e0a1a6933306a5fd73d5a6abede10bae4d2cd1f51528d7be
SSDEEP 384:yeUdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:X+eUZsLQCZsL3hUS4
TLSH
T1EF53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 71KB
SHA256 a5207a288e914403ea2bdc8af699a26777c42845a542ec78dedaa60740c1ac37
MD5 da1f9dfaf1a002c007e8ddc131dc5f29
SHA1 8a8e1703c4f89d76b15d5bc8a37fb4587abd27fc
SHA512 f85fe442882c7c4fbc8cff0dafb9065b95b8195a01b1628c7933994c5fe8787f73eca788f499443b59c66b9e95302c050756bc03416dd7ed57cd615c7370f623
SSDEEP 1536:k2N6ZuPlkKyldgoomQoy8qD/MAfnlx7qUdMNAH:vQQ6rlde1o4D/MCD7qUdMNAH
TLSH
T17C6302A45221C0FDEC97047B8021BF7443E01FFB32ED699E899AEB5A5816FE105C8B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c4d74b378b249d11a510963d71a8fea644aa00206a796536d381f7cdae1b044a
MD5 441e105ed833f2b0aa614f44671883a5
SHA1 0dd0ae071ca2ed0237e71bf2decda731ec65d4fd
SHA512 cca726dd9cf3de8c13b50fc7b31604b09b40dd685aa86b2463d49bef60c77b5d02b29102d2a1d5b23181dba890ee8de986ef791e3e4c6068a65c894d92911a92
TLSH
T1C9514D10B32E2AD1E3A18AF280F8C6CDB3F5946DC6C72ED11A5C1D704C22F9960E1523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b73f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b73f4.TMP
Size 2KB
SHA256 a50f85e95e6baac09200e477417e21a2599f7927d92f656050d2e2fbed36cb90
MD5 7c03de9198ecb998f637e6955eae3107
SHA1 d875d3e9ecc3b5edd3534c0855270593903dbb3a
SHA512 5af54216034b33d773603cb5c5129d978e21d81bec02bbb4160d26a996fb38c446cdf196d07d9caf46a8a299cbfe36fecaf3879433c9f70956bf71d36beca5f4
TLSH
T191515E10B32E2AD1E3A189F280F8C6CDB3F5946DC6C72ED10A5C1D708C22F9970E1523
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3da7c0a22fd85c702b3ac8df94d6f8683627d3db6c9e17f99eecf583a95f755b
MD5 49f677609e010239980df3e6b639838c
SHA1 e037bf15b5f91a626e93aa5229e1cf7cc96c8965
SHA512 e01177d3241367b2dd02a6044b0e13ed03aa0dabc981ead8fbf222516a89d607ad517663653d10a87869c9c3210503624ca4675d8e2162b2d0e8a125030d17c1
SSDEEP 48:YALlNjlOmW/jemW/jLgyjzPhVphVhAsJFVRsJcvfo7CCAstzBmW5syR6mWWMsbmz:DDOOb911NRvaZ1zBaan2U6TNwQ
TLSH
T17D818BF3C3E9862DC91156F4EB147E2BCE190914832C3D5AC9E4AF1BA3E24B1D105A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 33029ad56100545cf9f16575541115af4dae2cbbcb87c118bf6b331566090c82
MD5 7c6c1506734302e70902cbf044a2e0eb
SHA1 3b079e7989cf237b5eecec37ca3e8612a373b5d4
SHA512 2667e1f72ddbd4bdc3bc68081f9b7902c129c18828b8ef693c2330aa8765c3a1d206cc31e68abf7cd9977cca8e45fce7b9fe38d5f270fc8702f82c11c1b89806
SSDEEP 192:sxR3RbCr/fxshsR9ZONn9mzoA8pirEd/g6+WNUWAn/egJD906S4GEhIgJEYJ:sxR3Er/fxsh8zOZ9bl/5u/eiS0C8
TLSH
T1E242A4566A28693B5CCBD21DFB55BF53D6F92032A1D02E44FBFC960C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 18cf5c8b17716ba05a1c6923f30228cb26ec7fb3b4d1637b082a5d73149fb0d2
MD5 f40d75af068e71afd8b1f07212f24b74
SHA1 7227470ef8c1f14e9b109910b0a3692e0afd3c11
SHA512 bfde3fdd119817ecd79be0713f70c8e4be5bf3812db60ac6c99de9c1615546c6f39feb50824506f3bca25024f3b97a8eb1f90caf7c2c8a12c537767361eae090
SSDEEP 192:sxRURbCr/fxshLR9ZONn9mzoA8pirElO/g6+WNUnDAn/egJD916S4GEhIgDKEYJ:sxRUEr/fxshVzOZ9bA/5V/eTS0V8
TLSH
T1CD42A556A928693B5CC7D21DBB55BF53D2F95032A1D02E44BBFC9A0C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bd9cce0c838c5f71caae078f922c466e6792799cbfb604137d2fb605cdc0ef07
MD5 b3a8571cb1c9466899aa155bd262ecfb
SHA1 9f3202c2d2db8879e6e8f0e4fe473b4e86afa247
SHA512 85bf66f7057ebfe54a0783ac0223ab07eb9b4bb0b0af6019dcaaada7efa84b9ce5302675f600281012e2520c001e22ee609a89626ace0f625159cc386659ed33
SSDEEP 192:sxR+RbCr/fxshLR9ZONnXzoA8p4rSEO/g6+WNf4DrsZegqD9I6S4GEhIgDKEjaYJ:sxR+Er/fxshVzOZ+D/5pZe1S0Vja8
TLSH
T17142C656AA28693B5CC7D21DFB55BF53D2F96032A1D01E45BBFC9B0C04EA6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 490517fb1ea38810b63ead1aedca0de92f3ba9139de8676de9b0d03012eab4cf
MD5 f1a0c381bc4fca63862c1ede4320879c
SHA1 1e018dba2bebddfc7bf1ed56855de14137d415c1
SHA512 261f022b793f5fc1ca2c674aaa7f96c7a9902229d3c894e5d3edd03aab6e5a7d4d5e6ae8065f4760d65e26e07852813cd0aa3f93d65bdedb810f39b4cde71d77
SSDEEP 192:sxRURbCr/fxshsR9ZONn9mzoA8pirElO/g6+WNUnDAn/egJD906S4GEhIgDYEYJ:sxRUEr/fxsh8zOZ9bA/5V/eiS0P8
TLSH
T13042A456A928693B5CCBD21DFB55BF53D2F95432A1D02E44FBFC9A0C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 46599230f9f151a2b92ba0d81aff8332bb199fd8e7f252ac604f464d045075b3
MD5 022fd306b7626374075448d9a2471f2c
SHA1 1a1d624792c748c27ccaffb2fdf8cc4bba1490ff
SHA512 3b0382719b9e50f9dc911ea2a9186e64fa97d4e429e28c8bb6b891dfb191ff4d614aa0a07228411bfd31692d374c40215db055aedc3b55154ab389e7bae2448f
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwUYc16MropilRJ:azfW/dE7J0Wg/XfHfu1jaHUYy6XpiV
TLSH
T19BD2DA7B640CCE7F4F800ADDAD1A7ADF6DA802CB9698CD5047FD941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d0b34db5fe1bf50a0ed90872fcd28f73e4563513ae5c071d1fc36b65cd36f2c2
MD5 7edb28a28ff34330651c6ced189903b4
SHA1 2a51c8b3670e95ea8cf504a7d71c0f9c1587dd2f
SHA512 572e1323f2ad02d18e4b135b2b3f20db796d77e7be5ba3bec44d4c86d88840deab60608d72093ae80a5d1c1926f27cde689ef49dd36784da9d78fa264375b33c
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHwBUAyeSIWWLbgIIK4Ng6Icoob6/9GKG0/:CVCbvlfj2LQ/3dGgJ8NVIbTMHwBUAyeb
TLSH
T19E91AD44313B029038BD6B0C9279CD1BD1C2B4623119E93F77AA01A55F6BE239DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 428946f0ff87d9c53e344f1a2567fc6d69bf315d47cc9a3aca41df5409339d3d
MD5 99289109ead4c325af1bd10d8836e714
SHA1 a96f51c97f7b24321b6e0b17d57fc551ec0479bc
SHA512 35ca469c6dc94097de567f12db2d4ccfd140e7228b630a4d0e3a8340aa8caefcdd5fb82a8c15af84d9a72df87596feeb66f443e6a78d936b02586d401f1485b1
SSDEEP 384:nmtNn/s3n9SaR38NIksHGogeGbJ4WZlf8hyEGHoU7GtKy2rEoajo4cdR8eHhVOD9:mj+953UoeJZi0XQqrEnjN3Gac1Fzb9M/
TLSH
T186F2AF356D659EB38CDAD38576473B92BFE016A389C40E98DBC9AB0C05876EC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2897ce0405a586abd83aa2f15b04ede30acf14d6feb3d021caf7c7827dffca2d
MD5 f190bd09bebc24aa4e9bb85c40ad7a90
SHA1 76c8c0bdfdd1f9d0ae319868d453d753a3c0d9de
SHA512 a67eb4ddb0655c4efc6f4d3440a0a7b1caa5f2dc4982935f9f79e98a4b2216f68f227009fa78c371e48adb171e27fd40c928da0caab79c7a8c3fefd3571f7f49
SSDEEP 384:nX9tNn/s3n9SJ38NxksHGogeGQJ44eft5yEGHoU7GtK22rEoajo4cdR8eHhVODj5:Nj+9m3doVJOsXQerEnjN3Gac1Fzb9M/
TLSH
T1C61327F598D79972C89E8387637E2E46AEFCD55375880994BBC85E0CCC825BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7050c87064c73d8575312afdf1d55bfe1be61e1a1397fcab30320ee00112a94a
MD5 4f1608624e6bb81e5ada997c7e32f8b2
SHA1 da47de63efcc2a45858ec32bd32ab1c665057314
SHA512 cda0ee5b9200123bcb8247c669d61590a33bb1bb68ee4020c8b5a72fedb710214d19eb1ade75e2a7abdbac11af206a7c3f74d7f940309b6ea504354e2ee52899
SSDEEP 768:rrv+4UNbdS3Cmi0+rEnjN3Gac1Ze6eVH1SCz:rbsbg35+QnjMa/6EH1V
TLSH
T15403C03669A89EB38CEBE385718776037FF4125386940BE4C6CD6B0D069B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f2c8df8622f23baf99c4d8b28894bf9a773234ee6752e716d9c587beb12ec782
MD5 19caffd92e97dfc22f4d7abfca91f15d
SHA1 e98ef23a290292c8c99a1c8649df3383ab5cfa79
SHA512 2fc578f9bce87c8f2bc71caddab2a0317bad43ac384fbf5ccf120e9eda9891ba75c82e6f4459cbf330a9bfa8465282da66a0d2e195e316d134aedd33aa901305
SSDEEP 768:krv+4UNbdS3aoTJZi0XQsrEnjN3Gac1Fzb9MQ:kbsbg3aqXhQnjMaIb+Q
TLSH
T1EA13C0357968DEB38CEBD28571877653BFF416A389D40BA8DAC96B0C05875EC230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b72fe7dabe65a92bf4ffc73d5abd40296e77ba8e908314d824ee046c23c7e8a6
MD5 0a0db7bf6c11ea30de88f1996e0f1a5c
SHA1 d9fea9365f9779c0d049acc845b6529bc8b144ea
SHA512 9f62e3897f36c09f28146dfc6ebce44ea09c170655beb9af4836a3b4d9af4917e94edf9e1634c41c8141f43add2ead6283afd33b0c15caa85d54a758e92c42f6
SSDEEP 384:nptNn/s3n9SaR38NIJsHGogeGbJ4WZlf8hyEGHoU7GtKy2rEoajo4cdR8eHhVOD9:pj+953BoeJZi0XQqrEnjN3Gac1Fzb9M/
TLSH
T173F2AF356D659EB38CDAD38576473B93BFE016A389C40E98DBC9AB0C05876EC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 711a6953ebf21611423d1c764a95cfc5eaffeb8e353d7729bbc01ad29958cd1b
MD5 202f463df30ed12cc156d96b15944a3e
SHA1 9b56f41fd9872d7bb90fd051c14d9eb3be5b112b
SHA512 7f903b574a1b23f4ce9f4be8d646b06e5b5b56968bc5bd4e4eab187aa450c8ebda3fbcbb4af15a27a8ceb9e8c14ebfedefa1fc0c452484b8a4acf79de0ff6779
SSDEEP 384:nX9tNn/s3n9SH38NxksHGogeQhJJ24eft5yEGHoU7GtK22rEoajo4cdR8eHhVOD9:Nj+983doeJJgsXQerEnjN3Gac1Fzb9M/
TLSH
T1301328F598D79973C89E8387637E6E46AEFCC55375880994BBC85E0CCC825BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4ee85918457f2c96766e938a2de30272cafd1d56886b55617ab4caa4f5302fd6
MD5 68833fbfd211b9bcf5e60876c4bb6261
SHA1 4ee4163ad1d4adc1fcd9168818c50c0399a95e3a
SHA512 c06aa48f29681420a32e5a8b9b1b0115a75d3492b98b3669ae0a4a9c6c18b7cceefe7ad1af70b560385b0619bb1015064437f0d4c73d17a9d13004781cef7402
SSDEEP 384:nX9tNn/s3n9SrR38NIksHGogeGQJ44Hfc5yEGHoU7Gt9y2rEoajo4cdR8eHhVOD9:Nj+963UoVJKsXQ7rEnjN3Gac1Fzb9M/
TLSH
T18A1327F598D79972C89E8387637E6E46AEFCC55375880994BBC85E0CCC825BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4172e5927cf95db567b9325965060eefe6f1636b0cbcf4312c92a9307de43e78
MD5 2ed5818d489f66e1f5a4a09c43c386a0
SHA1 00a260d5419db48df6dc2287c6c792cffffc2c0c
SHA512 8f347aa6c36b1f60e4317abc8915b61e426fe68735044bac919f9db9b5e3212209ab3ed227be17838ce9a17e64f7a308a35010334c01b9131013c73c212f2f25
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5d8ef4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5d8ef4.TMP
Size 392B
SHA256 b5795624535166eead676eca3ed8aa0cb4138a73e2fe2f5af9978880e8063b70
MD5 1c20debb10fe6c5875b64643a6372382
SHA1 bf8abe49c107cbe29c6102ca91e469b7a96596f5
SHA512 a108c8e3645d94dd9c71b2c73d8588b324b5882e3773db39072edcd9f9531a091def6f8f08e1029f492bf4c5ef3ff0e2375bfa17bc2d945641a0b1c38e8e55e3
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

34e60aa2-7cfe-4b41-83fc-965ca9ad219c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\34e60aa2-7cfe-4b41-83fc-965ca9ad219c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4452_854189155\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download