dc53d6a9eb48e95fabc1b7961374f3d68a9c06631fbff590454f7d4b34ac75d1

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/07/2026, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CHUCPLAC PROJECT.pdf
Size 349KB
Sample260728-jqthjasthy
SHA256 dc53d6a9eb48e95fabc1b7961374f3d68a9c06631fbff590454f7d4b34ac75d1
MD5 af88821e3464e24e5784243f041aba8e
SHA1 04768e292cbf7c5cebe835b1b85a4948797367f2
SHA512 c0c70b5cda8561ea4bd98538c7f4f28d6bb322f63839fe15398ad2036f8539aa2be11133cb46c86fd292011f6abe5ebcf9aa8ab2fd56b072b895d33b6334c3c4
SSDEEP 6144:8CmOoDbCC9iDjCX7CCwpQeyDTI5mfiGW1rttOiB9xfe8Twt/Ay31lCt213e4d9Zj:BoDLevQibr3OiB9xWLt3XCt213eU9ZX/
TLSH
T18F7412AFB3B75E58C66EF23BDF860E221E1CCC9F149A8975241407D3B412A7D46690CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery spyware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	sites.google.com
56	drive.google.com
60	drive.google.com
91	sites.google.com
194	sites.google.com
195	sites.google.com
216	drive.google.com
2	sites.google.com
9	sites.google.com
53	sites.google.com
57	drive.google.com
197	sites.google.com
215	drive.google.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_369348769\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1680024323\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1680024323\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_369348769\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4100_949127952\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1680024323\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1680024323\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1519338391\_locales\ta\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	msedge.exe
1636	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296987923327011"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{49AFBFAB-55DB-4D6C-90FF-842C077F9B93}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{61A4EA4C-37C4-44B7-8B80-9AB7BF9F1FBC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1988	AcroRd32.exe
4100	msedge.exe
4100	msedge.exe
4132	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe
1988	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 492	1988	AcroRd32.exe	80
PID 492 wrote to memory of 996	492	RdrCEF.exe	81
PID 492 wrote to memory of 996	492	RdrCEF.exe	81
PID 492 wrote to memory of 472	492	RdrCEF.exe	82
PID 492 wrote to memory of 5312	492	RdrCEF.exe	83
PID 492 wrote to memory of 2936	492	RdrCEF.exe	84
PID 492 wrote to memory of 2936	492	RdrCEF.exe	84
PID 1988 wrote to memory of 4100	1988	AcroRd32.exe	85
PID 4100 wrote to memory of 5188	4100	msedge.exe	86
PID 4100 wrote to memory of 1636	4100	msedge.exe	87
PID 4100 wrote to memory of 2444	4100	msedge.exe	88
PID 4100 wrote to memory of 3724	4100	msedge.exe	89
PID 4100 wrote to memory of 2444	4100	msedge.exe	88
PID 4100 wrote to memory of 2444	4100	msedge.exe	88
PID 4100 wrote to memory of 3724	4100	msedge.exe	89
PID 4100 wrote to memory of 5748	4100	msedge.exe	91
PID 4100 wrote to memory of 5800	4100	msedge.exe	92
PID 4100 wrote to memory of 5748	4100	msedge.exe	91
PID 4100 wrote to memory of 5748	4100	msedge.exe	91
PID 4100 wrote to memory of 5800	4100	msedge.exe	92
PID 4100 wrote to memory of 5800	4100	msedge.exe	92
PID 4100 wrote to memory of 5180	4100	msedge.exe	94
PID 4100 wrote to memory of 5180	4100	msedge.exe	94
PID 4100 wrote to memory of 5180	4100	msedge.exe	94
PID 492 wrote to memory of 5500	492	RdrCEF.exe	95
PID 492 wrote to memory of 3260	492	RdrCEF.exe	96
PID 4100 wrote to memory of 4656	4100	msedge.exe	97
PID 4100 wrote to memory of 4656	4100	msedge.exe	97
PID 4100 wrote to memory of 4656	4100	msedge.exe	97
PID 4100 wrote to memory of 1476	4100	msedge.exe	98
PID 4100 wrote to memory of 5652	4100	msedge.exe	99
PID 4100 wrote to memory of 1476	4100	msedge.exe	98
PID 4100 wrote to memory of 5652	4100	msedge.exe	99
PID 4100 wrote to memory of 1460	4100	msedge.exe	100
PID 4100 wrote to memory of 4744	4100	msedge.exe	102
PID 1460 wrote to memory of 4944	1460	msedge.exe	103
PID 4100 wrote to memory of 5304	4100	msedge.exe	106
PID 4100 wrote to memory of 5304	4100	msedge.exe	106
PID 4100 wrote to memory of 5304	4100	msedge.exe	106
PID 4100 wrote to memory of 3892	4100	msedge.exe	107
PID 4100 wrote to memory of 3892	4100	msedge.exe	107
PID 4100 wrote to memory of 4472	4100	msedge.exe	108
PID 4100 wrote to memory of 756	4100	msedge.exe	109
PID 4100 wrote to memory of 5560	4100	msedge.exe	110
PID 4100 wrote to memory of 3500	4100	msedge.exe	111
PID 4100 wrote to memory of 3500	4100	msedge.exe	111
PID 4100 wrote to memory of 4132	4100	msedge.exe	112
PID 4132 wrote to memory of 5844	4132	msedge.exe	113
PID 4132 wrote to memory of 4644	4132	msedge.exe	114
PID 4132 wrote to memory of 4056	4132	msedge.exe	115
PID 4132 wrote to memory of 4056	4132	msedge.exe	115
PID 4132 wrote to memory of 4056	4132	msedge.exe	115
PID 4132 wrote to memory of 1936	4132	msedge.exe	116
PID 4132 wrote to memory of 1936	4132	msedge.exe	116
PID 4132 wrote to memory of 4664	4132	msedge.exe	119
PID 1988 wrote to memory of 1148	1988	AcroRd32.exe	120
PID 4132 wrote to memory of 3872	4132	msedge.exe	121
PID 4132 wrote to memory of 3872	4132	msedge.exe	121
PID 4132 wrote to memory of 3492	4132	msedge.exe	122
PID 4132 wrote to memory of 3872	4132	msedge.exe	121
PID 4132 wrote to memory of 3492	4132	msedge.exe	122
PID 4132 wrote to memory of 3492	4132	msedge.exe	122
PID 4132 wrote to memory of 3468	4132	msedge.exe	123
PID 4132 wrote to memory of 4044	4132	msedge.exe	124

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CHUCPLAC PROJECT.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=37D58ECB7E637EF055E9AE9CD433EEB3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=37D58ECB7E637EF055E9AE9CD433EEB3 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=869EE63874C742717D39D3304999E30D --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=506FB8F41C266EF4EFE20DC80717350F --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CDA75D31A9BD1901640F4AF3CA24B38A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CDA75D31A9BD1901640F4AF3CA24B38A --renderer-client-id=5 --mojo-platform-channel-handle=2384 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A3707D1E571C6A3D17D5840F365EDFFA --mojo-platform-channel-handle=2736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5500
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DEE4D2F79E015CA743460D59960417CD --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sites.google.com/view/wegcyu/home
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffe6045c188,0x7ffe6045c194,0x7ffe6045c1a0
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,15820869374095760193,584869815264434838,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,16497393866457305758,17290768486528012513,262144 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,11153698985899982288,11056782747983343191,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,9051043184095043684,11457828064498596912,2097152 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,12913008806583714587,10324698726900961782,2097152 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5028,i,2298549283495771048,535675829642999559,2097152 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5188,i,7494371568233736989,10229266309783842602,2097152 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,17772477389488180662,12118283272265246175,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10790916080758968478,3871432113672902625,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7293219638485735460,10439169150513440183,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,18423625194093048672,15521931321414453311,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,18423625194093048672,15521931321414453311,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6272,i,10734135701369608306,6374178399081363622,2097152 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,12952910708585811736,5349853429015200606,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,7392538962233186316,13278837094828044042,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,15850463900142458625,14428851318415581321,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,18058850334907943258,1160488014347355209,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:14
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,5100449637949652599,5572964161398668871,524288 --field-trial-handle=2516,i,4762167372667063383,8394226370275798186,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe6045c188,0x7ffe6045c194,0x7ffe6045c1a0
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,3589709141678476158,8644265850404707501,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
      4⤵
      System Time Discovery
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,63687986869471463,13192672200171658922,262144 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,922712222794036785,5987258534269700612,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,5844510882163907101,17980956488448998155,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,5844510882163907101,17980956488448998155,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,6659707208710183737,6780803631013876932,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4976,i,13444242448756070939,6580631294793175671,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,4488959015023361216,452950034547454239,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,5483274018679679158,2583370507959531274,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6028,i,3822017610798143736,12119307997373172280,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6156,i,16974426849649731359,7938872543814160736,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6476,i,2195385411658236092,7680978779537750795,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6716,i,9358167679359805016,2916360508291496065,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6908,i,5855183312071239069,5143422116052451132,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7220,i,7155056774937492886,6865017836776189733,2097152 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,1102163567756360042,9110918907568973738,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,5068474759556098680,7391875237286144388,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,10573278962069948854,14204816093065591652,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,11111020400095857038,7455485457949465732,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,4639824693131755970,18396483278299447686,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,15893185519614142773,14119627140546034278,524288 --field-trial-handle=2536,i,2964607796271451147,15696314504065137400,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
      4⤵
      PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sites.google.com/view/wegcyu/home
  2⤵
  PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 274076b09491f0ef7befa8a13f785174b187c1b7f6195a30b514bef41588ba6a
MD5 71d3f11a7b7141df13269897d734ea9e
SHA1 454f5ca7ac39c5ee2bbca517f3a4444325580dd6
SHA512 122edd74a4fe3fd7c8151e3c126ffc003f8d6d371a6536044839fd675d64b5783fb68e64c5ea2e0a5b066e36b269d0cdf158d96713a9f9e43268e9b7cebbae21
SSDEEP 384:yefdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:S+eUZsLQCZsL3hUS4
TLSH
T1E453CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ea6d4cca36921420fb287b8c2bae509b68a558db3a490014828b67eac1ac91d
MD5 7a68e1215fbfd7a6660aa61ec0335a60
SHA1 ea21f860bafe7fa736ba044204909989b85c5dd1
SHA512 c3fa4a8005c82da0bdd939e92de866ab7127ee7ee97d81e47e35a9295a250f76376a70ca293c75ca93f06cd4d8c9a6031a4263359174de4215849534e6585f4b
TLSH
T101D023F47657F6D1D73D003894D04210353945F1359B47417155DC0DDDF0048E2E79DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b613c7a0f594d60ca2abfc775990087b8811ef6fbc2300933b1ef37368c93bfd
MD5 88e2419caa6fa484309331a48b13c6d2
SHA1 148e88491dee5bec5838cb220a2db2a0645175bc
SHA512 d48bcb60380a6d98c5b0a2ff999d255e63f81ea12064aa8d1ce57d78e02e1d0781fa1b451ffee772bc4c62fc351517f15145fd0296d1dc1b0d536990a83dc4bb
TLSH
T118D023F47796F511CB1F503074C0C271336696F0388ED6615075941DDAF0158D2DF0DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac19373cb3b832c1d65dd1a4b35007448d8cac07daa6a085b65a942e749026c8
MD5 f08f7a2d78c9d19445650519ea8c7ef6
SHA1 401884761fa1ee8464d184d6e68b2c4dc81e6b32
SHA512 e2085bcca613bb0e4a376c69061deb3694a2dbc8e3a067ecc915ec170a8f2574ddf5b2cefa6ef09dfa6f52666418b37be44df058a698f1d8d4e556f70a9896fc
TLSH
T12FD0A7F47696A511CB1B503064C0C261336692E0388A96615065941DAAA0168D2DF09A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3144b8464240bbb191e9aafbc0f6cd8ed060ec94dde1246a22b2a3220af07893
MD5 c8d96d33551d54ea3a2e2d314b1e9999
SHA1 da366c6ae70e42fb61d452b37526bcab641b0148
SHA512 37ae28c42d53556484125c258c93482fb642f6c7e1fca8ba38aca854a3eb4e8aafb130662dc4d73cbc8212400d74e7ee90ea83c9e27d5de99804485f2a42ce51
TLSH
T157E02BE5C822DD2B18FD0719B8545641D74523762A41991F363CD20D8FB463A169691C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f6e1dc9fc28a9ff15ab74815372ade3b22b4465a156d51f25eaeaae042ddd9c4
MD5 c2f6113efca61ce36c5841f1440ba956
SHA1 79a653fc473de401f761e6c847357239f020baab
SHA512 cda78ea67c396baf9c0fa4a1316217c577421519ab4f42993ef371a78a64ae2b46e364d14db3035723f1c304d30755fe9012c9c0c7560fa95981994c6362087e
SSDEEP 768:mE1MxkuKyu6Hq5iZllE1K/G47rF+lPZxgwLY:mE0k9Jkmff7RLY
TLSH
T1E413D57DBA0C4C92EAF7513C1D4B5A79E7B9F923DACD024723A2B122C776B4E084E401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 c2e85a7826248b7608eb46c755f03fce20a2c6a7d611e10f0ef833ac7ebeaf3c
MD5 f3e9d131d703009c2d3df06564be8eb3
SHA1 5ef22c9cc02f930050b051016a8cc1c3b3c2481f
SHA512 bf28f8c265734c91f21ec53feda48abf3ce2ba65ff45f812b9f3a6d65bbf92c88b4f6249e8c748be4b196f60a937a6d78bd9a6ce98a7f934d8bbeaa077e5c58e
SSDEEP 6144:LzL/zL/MRrUTL/ML/8L/MR4ureVL/BuL/HL/UL/:fL/zL/wUTL/ML/8L/k4tL/8L/HL/UL/
TLSH
T1D1B45DFB0951A00BCFA842F5E2033E3DD177055D3DE1E9E9E6780C956825F22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 ccc7fdd0d06fa052d93fb59076d10fdfbcedea222e4fc2c53e11be710777e2a0
MD5 cd7c37050d626ea4425829f3d3395611
SHA1 94033bbcfb4d1a390d6b81c4c0fa8f3a2eabca78
SHA512 fa803b583d2dc2d58f31059dbe4a6fedb9a851ddbc33319ac591d6b598ce755aa6dc24fd941bf930a8e13abdd109b287ff6b702729faaff693e4878565db7374
SSDEEP 3072:evjg65mR3uHsruJDLFEBcX/mId+rZWpYa0LlMAMHId73LW4DuQLP+v7BZsD:erg65LHsSJJXurZhLyAJd77V/qDBC
TLSH
T1F2253AEECB682C42CE6B8774B0E0D9077E712182BA5CC0D39944C5D997D6B8176F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 12.0MB
SHA256 922c7079da8a49f89a7215652c7df3ce28fff29246bc1373e5643fabb376cf91
MD5 2f27b8beaf0901f3247a5aa98cd92a9a
SHA1 5138330c75b00a5e7682ee93355407e05afa5e83
SHA512 fbf7193bc467a8fcafa910460be93ac4bdfb3bdfe08e4546e33ec314696087fcf12d37ca246a324f865eaab3b104df467674237473fbf9d1f44bc832e3da0665
SSDEEP 49152:Ig4Y1L6KgWv/SJoOCeOSYYh0GIgCQ3BVr+8ixBbdjCSdA5ypk:ID22g/1eOAh0GIg3rExTmwZ
TLSH
T1E3C68DEDCA6898C3CD639A30B4F0ED477C7413C3F595C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 a1c31610b832ef982fb9c26b04f7f710b48c04a39a22a56aea6edff8739810c9
MD5 9733ab7ad00ac011eaaee24d2ce44783
SHA1 71fbec2aff1cb4479428a0077c4c353687f6f38a
SHA512 24411b472663b2d0a3df1ac317ea65fc1e220ffd7ac4b55869f8ba3a2617353ba0ac77f2ab8daabbf3993371374ca7036f1c9c0d62d1041bb486cf36201192d0
SSDEEP 96:hoTb0EUJ0GU1yMo+0+NLlF98O0RHfQ4Efyux/RtSBB:mTb2Jm1yV+0cLl38OYHf1U/RUv
TLSH
T116A12E8196893A44EB7167709CEF48F8E3E270BB154F1F4A83849A7C273BE96CD56047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3c6553d71eabda7ca51dc285a944689bb314e37fa094648d292b754e51167fdc
MD5 9cf4901ac39b098a1ae014672052a759
SHA1 605fcb6d8df06255e83fd2f70b123ca14c973516
SHA512 9c4696662e221eb675efd7c3778fd7c5ed440f2a4ad31405bcf04f5296ac49dc7a07bbfd5cd9579333cc72d5e45d9ad6f1a044c4164168cd7797063f9eb55a59
SSDEEP 96:BIwZA/R2DtWGpDTl6SCLFy1Y1mQ5U9bNJ+HSMwG:BNA/R2DtrDTKLFy+dq9bNJ2SMr
TLSH
T154A1BA86A5C03684DFB16670ACEA4CE4A3F27479A40F1F8F9380967D2B3FEE6C915055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c697.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c697.TMP
Size 2KB
SHA256 9cd65cf0e0b8bbb9b2f4a1d0a44c03bbe7f42c775c41b49d6999ce94fffb64e9
MD5 d2201174ca8bc6b04fa75d254e70ad61
SHA1 1351df5e306727e68bfd24e706650a2ec9d44195
SHA512 0fe644aac1901f3d60d9393885442beb310d0375b06b76ec430d70e4515fb19dc9f485426d59865abbe15435588b3064da15a7a18e0f0b12915e69bd8764dca5
TLSH
T12E410DC946423660F73276B1A1D381F8F371B4BD094F1E92C3849BBD6B1BE65CE52408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 22f05943c50b96d0292b940465b38d1476a0677cb52089285184d89b10cca7eb
MD5 a8ff21fb664b6a0d286170531d5bfd07
SHA1 11a1c7614672eb8f8f1799ee8c8d9ab4fe18c777
SHA512 d52de8020bc5cd7db5fafa4c7cc55fbb0d80bd71ce5a46585cb53ac1d567e64641ee35f25a3432d391e28c529eeb2ba0320fd9e7af4338d31be2938f440b2b54
TLSH
T175E0D89674CBC21D557434865568670CD1C138A2D7A56D135708DCC47A42001B3AD947
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 9b778af50c0dd4ecec50b0acf15c41dc54c56d7f7fbec263572a33b115315e01
MD5 4d04404e7a66a76f02a44cd71c834498
SHA1 56a06a2d5f73dc487012cafcf51eab1be38f6dc0
SHA512 ab272405f2326eea292e7c1ddd17783cc4b377354df0f0d908f0c4b938f05de188cc92b17eff61a78fbcb7a4391934d2485f634bc7839e3518c8a6d0e19f01c1
SSDEEP 48:Tii+7f+UZD4jJ/Bdun23CdayPtwHWxdWx+6VCR+5yq9z+bpyM:2LnD4jJ/Gn23CdOHWr6Vc+5F9z+bpf
TLSH
T1CAE29184E632F6AFCFED1D3EA7C8B2B5C5D8202C95DC1A50137D79E644A86F8684D01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 b194d98da5913747c78c3843d3ab274b1e3eac6283a81d006877369420d99403
MD5 1413e718df11a0ba592c4ecaad44f864
SHA1 ce2c594287de122a77ebf367b2a9a3899fb9f69f
SHA512 bcf237378077db4f7de8b1f774da0fef48435854b60ff872bdd29567791dfaab1de0285325b1f9d69502ae6a63e523500da6c7792d02c322925db5326a231a7c
TLSH
T17FE0260515CAC23B909469978BBDA748C2D23812F3883A42174F8C476101241E3EA2C0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 2cb9c4cab97c0aa03b8a33a99f3b145ec73a683517248740312bb31a4d0123be
MD5 a34ebfe55b06db6f1c4292be127766f5
SHA1 2489185eed59e90e553a0442593f0a79722f6dbe
SHA512 6d96df549e83fbf861fde890dac6b84f5f109e1f1c1bc40fc4795dc509fb14942917ca27df94f5b8e891163ef6ef9f332464c851307a4666a243ef4a27929d90
SSDEEP 48:uzBmw6QU1PzVe5hCPfmh9Z9cBjzaKItdE:6BCxV0cfmTZ9cZzaKOy
TLSH
T1BA9254476F38B813EB451E3A212A4576CC3BE2189FE69C94742844B15DB8442A0789BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 bbe8fda15b424b884149924f04b71add68563b034539342ec32b7c6062f75d47
MD5 8df69dfb67abd7bba586838e727c2eb4
SHA1 fc446d0be5bf51369edc7cb14d8f7b5cad063cde
SHA512 46a3bf6d7287302912ab3bc73a119a006ed5385bbb50a957cb95347737f20b89e1ee5f8bfc6761f7ae15460aa73dbcaf895cc157b4df465d6b61b5db42feb7eb
SSDEEP 96:x8sno5ZJ1HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jmanAgLNYEK:x80+G83uxXBBK31GkSJE+EJH7DNspUM
TLSH
T18814554F5F303712CD6D403669E684A35DBDF43F8B6266C9B8641470CEE3A52A06C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 41KB
SHA256 dc3e13d347836020d0fab1be272248b9efe0b8299122570232d74c4273f9d507
MD5 96baf4bcb03614657944302d59dff72b
SHA1 1b6d79c09a423c808cfeba4c88f4cd6edc9ef3c7
SHA512 d8892310b2803fa161226eaf4740ffa9b482e78ea9cd3e887f450ab67043ea3a7bced0a57d4619aed4a9f56447029e80dfa705abe8d3ac0c1c846ed314e25665
SSDEEP 768:JuCJxAPiyaEao40aGTETgx7JOkMjMA0i6GnsFxRYSlMGsGAC0tAnF3:3AcGTE8xF0n2xyanF3
TLSH
T1CC13445675F9020AF2BB9F7AE8B25BA54C7ABE462D04DC1D58A0620D4C21F40DD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 12KB
SHA256 46d4c53961635edba8527bf6f17dbfa7dba18498bc8b5630a6b6f7e24893c4ef
MD5 f9040fcabac4d9e089532e24a44dbba5
SHA1 bdeb447c9eb1d2627874cbd71acd19f52e24cf58
SHA512 d9703e41cba32031d5cf67279ccd79fc36e35de6267a7107bfd24c503af907fe234d44aff884aab11030e763c6251850abc8e21214f897d395a02e38a8bf0df0
SSDEEP 96:nRCH27JwRr2+gQY04vjIRCu1LmcNjOv2YRtrZeBHBnbBrFD8BTrZKpNP0ErZBFFs:R2EJwRq04sA2LmKytb4DJJnrHotf9yw
TLSH
T11C42A5F7180CE457CA8528E6C6B6FD4DD247993BCED6ED9AD1AC819E16E90343233243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a3f19cbccce05ea2069f5e20bcc01e1d6f1419ea0f9ee22bd5685689f6dafd59
MD5 fa44fdb3eb1abad6a17b06dfc875d5be
SHA1 0ef750f68a6265636cf8b709e2d120634826b810
SHA512 3f6d088d88b5c9264aa4727ecbceb62b5e42ecabe04cab8a5878876badb4b468225e07b22c8083297f08660b771ff17e06ee21cf744d488cd023fc5b8331b7b9
TLSH
T114E0266255CEC22F6284618BCBACB70CC7F13816E7883F865B0D9C85F801444A3A62C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 9ab74e4e5a350dfb7f8abc79cf8054c3af5c491484532a351f510eaea2feafd7
MD5 55974dbcd6460f7258db8f55d5bce172
SHA1 3ed56fa30dd2297da55b5fc66cf8c908623a86d4
SHA512 321070a2c1e93775754b2382b2986419e4afc49bb2c29574e85a8cfa2131da95297522e014cecde3ea5234793eac8fcba31e6c39fb4a686ef4a88556c62893ea
SSDEEP 192:rLaSaxY+3iBczQmKHz5ehn5Xfiv3wCmq6:HvkhAczQmKd+n5XAwNh
TLSH
T152D2097F6E101132C9DB6B3199AE8CD16D2521816243D2FB10BDAD714C347CEBB2E9B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 485d613c63ebe455eeee86c04314a51afe1b9a720d7bbdbd4d54e4ec56ff3e6f
MD5 d293e9f3356cdb89e9f31ff9559f31cc
SHA1 b4882cede362be014bf4126a91b95911eaaf4f74
SHA512 382c3a6d70fbbdf5514cd666c91e8703950c5537a5d7f667d9d5d9265ea178e1d02bacbad336abbd0d74c8fa9444faaa3bd1e4c13dc4bc162991c07ad0f039bb
SSDEEP 192:D1skb2iHiZtO/aij6kPugQkBV6rCoaw/VG73z0d/n62actRR:D1skb2iHiZtO/aiGkPugQkH6rCoaw/VT
TLSH
T15802CAF7C3E88A2DD91156F4EB196F1FCE1D0914432C3D5A88E4AE5BA3F2471E21168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 4885ebbb9b349da9ad935addd635835fc5dd1f987b4d9a830cab16bd9fd0a6d2
MD5 0f32a1c124fd02d8900dfa5ebdddae42
SHA1 1ea8afd105fa7a22c76659b1f490d14760d3a40d
SHA512 24f76094af7a18eac7e85fc953bc5114c5468eb88c2c109860a4019425eaf7ede86dab377589b854b53560dcfdd5d6c579fc750223411bca528a78a63168bf97
SSDEEP 192:D1z/AZ3ylwIpKvTDIlS00aij6krzZ2a+zQJuXkAcYoaRXzwgbgQ75TczOb/IfMIt:D1z/AZ3ylwIpKvTDIlS00aiGkrzZ2a+m
TLSH
T1E732A9F7C3E8862DC91152F4AB156F1FCE1D0914432C3D6AC9E8AF4BA3E2471E21665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9bcdba5c5aadfffe40cb0b505d0336e8b6d674f52535a06dac25d01938b9af68
MD5 e1157749131075985a5ed042975d3c1d
SHA1 ca4379b14323109e159503f932b028a4339ef0e7
SHA512 ea9e06be039f65be2c02c7e75a6390dd0b4381d99e4ed27862ec277346438e1d31a70247377090fcd7af94e7523560d8d567c7c9cb8b2103859133bd4c670d26
TLSH
T1E9213DEB95BAB42B702C5DBF2E097C091975A53153511CF6DB9E417CB0E4CF34A12426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 a2e9fd231891c438946ca0c843723afe3cf2bf15af7c3e4bc8701f06ff88ddbf
MD5 6d62937490c8bb9dfd586e6106afdccc
SHA1 ee5aff455ce2dec572224d6b994c0458542b9d96
SHA512 a2196987ae805bf1de21f8b702108e266997a90d6a8acf3cd1c136fb4c7210b0c063ee770ef177ffe1a8916d42575a094496b4a1c5b5b4e40641ca90ad99f06f
SSDEEP 384:sxZ3nb4xj/fKs8BWvqpV7or80Ka1Y/bqrQ/5rYaOP+/:sfbaj/f6BYqpWM/bqe5oW/
TLSH
T1E8A2094665208877DCD7D619FA257F62DAF91563DA904E48DAFCCE0C00EA6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 3a750d2b71d89dbc593c7d8584644d8a04027e78b75700a16930fca50cf42f89
MD5 584129a01b6c5a1fa77560a87f097bc6
SHA1 3877f419cc3e0bd406afd44b7d0d2dfb2a6bc3ab
SHA512 241ef31a0b18f5f0da28d00573b4cd631401f32a0d6ef0768386875a383bb72e5881a37bb4db4247a6de5748357fd2e79d3b4fc8c91f3711e165cc5489fc295d
SSDEEP 384:sxZ3nb1xj/fKs3WvOpV7or80KyV1r/bqr7fI9OYaOP+/:sfbzj/fJYOpWZX/bqXoLW/
TLSH
T12BA2E94765208877DCD7D619FA257F62DAF91523CA914E48DAFCCE0C10EA6FD2212C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 69912bf0745567f40dec1e4cead4c81dfc14c0329f823f5bedcdb7c2c5ffe379
MD5 1276ce7f377d172ec76d46ae47b27cc1
SHA1 ccbb599a1211c9d58bbbe16cca4fad78d5bfdf58
SHA512 7735b221659f28fa520ff6720a22f3991b3159105fd530e35d321ee886a5bf6231714576a723fdf25ce2050b81ba317ed0520b2a8800d5e7a858d7d2a843f2b0
SSDEEP 384:sxZ3nb4Xj/fKs8NpV7orp0Ka1Y/bqlQ/5b2aOP+/:sfbmj/f6NprM/bqg52W/
TLSH
T12592F94666208877DCCBD619FA257F52D6F91563DA904E489AFCCE0C04EA6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bbace1c67560654f8fe3ce3b31fc53cac4bc9a71676b5844fe9f22a8d71f5db8
MD5 8d7d65a3d4ce187c500f22230542caf5
SHA1 890ccab4fdd01a341e4b299dc07d82c31e216e12
SHA512 32b408794893384ed6e801d4e6987af65fb9f2ec4a7ceefbfcae779d58e8d0bf3679646fa1cdba2f75e02f15f9c7c26db2fd69a44ba61676decf98fd5f244d88
SSDEEP 192:sxZaR7yMqZjK1Ml8MPj/fKs23mAuKQ7PgYsp0RzodpEa/W6+WNKCR/Y0Z4xonIgN:sxZa4Xj/fKs2NuV7orp0af/bJ/5NjJH
TLSH
T19A62E9166A345977DCDBD319FA457B93D6F91523D2904E44AAFCCB0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 ed19fb25b79a41906328f5fb1c8829cf2e525941c441a3a9139aa57b8bfbc791
MD5 0796c69c6619349cfc0839d727691517
SHA1 140f908c4b64160c5606881acc9aaefe1b45e558
SHA512 f1f9f2236e3b1c2f7f52ae1bb1904f0172afa637d7211f5b7909115e4ed482a394939ebfa67c6d80e60dd3de9efa72e1e845baff6589440faea7a7ee1315914f
SSDEEP 768:XwZh38Dv24G7pLuLfGFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32Gq9LlY:XwZh38Dv24mEfGFWRm6GQFmu1jaK2Gq4
TLSH
T12B030A3B280CCB7E4F844E9CED267F8A6DE8028B96988D5447FA494C03C66EF15174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 fb0a28a3e446db2176b670c9046b995ad0d69096767d51cce1834a4a0dbc8360
MD5 b260655a6a9a3aa891fe451bd28993ad
SHA1 01a81f22e5fb8d4e57a431c64dd4062e0a5688b8
SHA512 1bb2b8fdfb82283d67271adc6fed0b4297f2ba25f2b29578ea174af923f11af7aeb6aa568bb517da600075cdd67ddefe8d5b7349da8d4dabe12bb144abaee3d1
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fGq9LlO:XwZh38Dv2SkEnZFWRm6GQFmu1jaKfGqu
TLSH
T126030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C03C66EF15174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
Size 72B
SHA256 dd5f1b4063103260ab5fa90e050be7a51d81909c457d9b43151fd8f192331c7f
MD5 28b3c42fa725977f4bcdc48f788a5bef
SHA1 216b825a453e263ff8437bc060e2e34ccdbdcc2a
SHA512 9bab0622d2864e185f3d7cf8c3121dda21cb3757a44817afd051bfb761932ef5e8f675c820ffc6b3282ebc439f4e6e35d60b9ea6d7785e1f6bc9801e6decd336
TLSH
T1BAA0022011752440C00B86B85703029457055C25400B4B0EC09156E58861C6E8912654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
Size 72B
SHA256 3377d0b89d1723f4d8595d446b4c9186e1364bf7d667605b1480a6eedade40a0
MD5 e0e7e8c52b39b78bbe7565b2e7a5f934
SHA1 4d1b166b3cfb4327a5b41aa1b386797ab60b4360
SHA512 da3301a7ad8bdc45db9af7b3c1bf6e89db030e4d8776ec017a302ee61bef488c1df0e2e4852850baf00ee9ec2a1da49a8c64d56e798ae981079a5e75754cc72a
TLSH
T182A002F483B62C41F84B07B1564601556314DD160237C7064AD109598851AAC6652496
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c6b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index~RFe58c6b6.TMP
Size 72B
SHA256 04cbd499061ac4d0c09219abf08b486f25095e2183e6d83445cb69b8bd95773c
MD5 7fd70d611f6f0c77cce93721fabf1f72
SHA1 f089a3bca55476e45c67023259716a9d82c8f4be
SHA512 e7f06711f3937c6e925939a21e5aeb8aee8b4d2d77ae1e433dfa209636bea437c3b4259dcef01ba2ce1dcabab7fc6bbf7f00012b1e09958cbd2cf01ab48052ca
TLSH
T102A0026552984541D8000670D90143606705EE139502C32744D1046DCC974D94D01550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 2KB
SHA256 41f820c1c2c1dc63a7ffe184ddfc3936a71c491b13a19d7f257d14de3cb3cbb8
MD5 06abd86b9db200e3b5992ec259a8e0b4
SHA1 22090288daa8dc2f7deb8fd6bcc16e1521c16574
SHA512 fdf93ad99897ca3f87b26a770acd4c249e0ecd83d8dd82291991c975f0674137ae08e1a15f3db2ab0bd9182f793dc58dc58ba6c2a0e3aa9d432429bdc8cb2b50
TLSH
T19951C70E4C861A57DDAC22F368BB04C427B560DE6688DE1B649CA134FCC3A6D2D6A621
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8920d963-b7c1-4a91-8f92-0f6e43eb1c65\index-dir\the-real-index
Size 72B
SHA256 7803fb4cc2afcd29cc40c6f7342d28521e0f3600741e0f2565cc41d367ed0d00
MD5 f82ebf302536afefa8f744c0acd4916d
SHA1 437f797b3cadae16d215bfac1068664829b9ad0b
SHA512 613324aa34349bac0a39a2f814a267358df118bf7f65435c44bafb60bc7df95f3ed676c274f67b97178a811bde368ebad2094c499728a98d552454a97b8ea915
TLSH
T16EA0023049410703D3665AFC262701921301592F460C074282DEE4B4C8B86416371711
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8920d963-b7c1-4a91-8f92-0f6e43eb1c65\index-dir\the-real-index
Size 72B
SHA256 44adb12220e43976938a10d023e7071770fade4d401153e39be24ead75076e2d
MD5 7cb7b010b7fccec062e56cc04505e3ec
SHA1 4d333869405e7a161f2a4e411f892fe62cdb40f9
SHA512 36cecfab323653648cec35f7042a3634a9a6d827b326a449eba1a18d5779ae73fff25c684f5d65051a3d75ac4640bbdb3f706e0293dc796efbc0c994cd39eb1b
TLSH
T134A002100D52650AD6414378244F014562154A278207138153E8ECA4EC71A9243391A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
Size 72B
SHA256 fdd923b3bd19cd47a817b0ae5a1b6ab92393d2dd7aa8fcf67ff56d87aca0b180
MD5 a67a5a5ec65c66b73494cbdc0b2664a0
SHA1 49991da42ced3d6ef6ce8f25d221c47a521524ef
SHA512 4e2378990762a406fe765abd00dc700e5de170ac59bb9d6d78fc0af1039df9f1d5c58a5ff9ddab1b58222625ac3c67a112b06fb26262ae1e8479c61a2f2d2de7
TLSH
T148A0025403C49200C10351B21953C251B2818C100145530DB1D61885C8E08C4615100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c697.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index~RFe58c697.TMP
Size 72B
SHA256 d83a621e8d715d80d56cf4edaa1ba127f6ab7fccae3add1dc7d75bacd6105ceb
MD5 044f5b63c31bbc06c7e7a9109d255fae
SHA1 4973118fd424250f0602fa2ef9ecebcde300bf31
SHA512 6d029d674437834ab2d1603769b22d9313e587ff8f31e14931639892104fe5ffa16ff17bba5a110753705a1a00a8f599911f6c4fb130b320b32ee004fba1e00c
TLSH
T12BA0022003840006C91262F2365A42415314EB21110DA71750971448CC678C44D4150C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 4cc8ddfd9cc52c1e2d9ebb2fab26935e36f5bce62fa1b8e79c3f5632190c7c58
MD5 0f1f70afd22de6241786655c28b85931
SHA1 aea5ca29f618e187c6365bf02a7348c643ff10bc
SHA512 ea464771e5cbc020a5b9600538a56e3642dd5622ec6333124f1d97e26890a22053712837dab8eb298341bb288e3d5bcf1ff11f74ae66c54539b1279f01aad7cd
TLSH
T106F027B72DE32C19F96BC3E6103245B4050578698564EC5F145BB6D790B1734249DC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b932d378caa95572f17b0a6d8c87e084dac7bc1427d15f48f48085157bda0a10
MD5 2d3f3984293d6de49b09f42f35300441
SHA1 9fb34763d881a684051d15287ef2076b5d838873
SHA512 9ab67a7c58b580c9f5770e2fe421b0853a1ded23be26f74ccc27562224d1e120d186308eb2b25a598b0a83c7d4ffaa1b9a2f4efe2427bec96eb630131d7fc51a
TLSH
T140F027B72DE32C19F96BC3E6103145B4050578698564EC5F145BB6D790B1734245DC72
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 9KB
SHA256 d12a7b8febb24abdebb35626d7612e76b6f2f8d49af6b42e1c8af51b3cd5220d
MD5 aeb62c8175ce8f2241eca6dbf73c305b
SHA1 e54c0149d4d2f3f5fc3bc3dbec235d99a7dbf389
SHA512 bc4306112fda954f813e70057d4d1af1eea5744c9b7b9ee9076c22aeddbe704a302feb0a43e2b456e1873c9e9188e933698c1674faddb95eeefbb76dd14b2b6a
SSDEEP 96:F1m5HyJp6Wqsjprmp6W0pYapFpSyap9NgpIip9N2p9kNY:F1YHKTjj9mT0KajO5gd52kY
TLSH
T158228AE3DA149053C9C9A6EB2039F6E9541DCA067FFF87A511BD8F6E52412D63328B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 0d7bb6835010f0fa8f256e155b867a1e4fae0db72aff5ba1cf3b5cd7bed4068a
MD5 b23b05ba979b385a7cd5e0fb9827b41d
SHA1 df1a8af6c627909220bb56d56cd48fd6dd0b94b0
SHA512 f51c42815895ceea3a384462d35af78f26a3712e314473664a87632a1cd3b507751086814ba261f331a8f58fd139d2547119289b0b8142cbfa96344f6208272a
TLSH
T1C6E0866255CAC1BE619B21870AA89708D2E57827E7C83E126F8DCD9A7542685B2B2181
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 8b3208a98bca80e852e51be7ef96d718010d2dec160f32e03297f192a28a1779
MD5 6144a65e8d9ce742b674e10d028594e3
SHA1 ae3b4e639820a05792a17e8b8f3546cc5183cfb6
SHA512 b59f605f36a4964b24c07f4ea26bfbfdd7c9508dc70a1fa8489d56a78b64869fab97565d63854ece4711b699185bbb90e69b3901aebe4a78b7175bfc5dd21697
TLSH
T11AA00270994E908CC40A06B554B6524463004CEA21091305459FA298CDA194051DA112
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8b090be5e6bd8e349a22f8ca4a62b42a0a5483dd8721abcc11d29f7530b468ae
MD5 92415067869845e9447d9591017249a0
SHA1 252391f76798ea47869fa91027ceffbbe46c1241
SHA512 ce50c94506d73e25e0355e77c8e4b91a09b13a32a901b0a0882653e356f9e32ff5560adc8313681c0d28f8a7f35e3128356bb5b8305b464cb1079dfc173bbeea
TLSH
T1CEB012507B0AF057E94D053182A0FFE42EA0E80200028E238C4ECF220E871D82C231C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 84d59f91fd4b0b0d597dd1ed4a4fc37b78088b832495215f2afd57bffc15bfbd
MD5 55ece2cac69b5a284153d182ec20bdd4
SHA1 f45242965157f53fe819e7a9a50eb8eddd071e6e
SHA512 c3c1f29e3d1e8ee3997f4ced5925f3bb7a4d3401d43ae61c6488fcc403df0c294684ca98028aa694e4ee223bd0a5706e1ad9fa1c8469001581886d36a5f6add0
TLSH
T1A2E0203125CAC32F71CA348B4679F70CD3E37812D7C829212F0ED85462465417753140
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0de5c2ad4cc9b14f2ad40e268aea3009f95253bb77577710ace3d7d09b0e2a6a
MD5 881020ec857c4f6e032061d1ecc0fb50
SHA1 42fea2b89122ed6e9c6e5979ff7af93727a046df
SHA512 6814b86f5b23e60acfa9dc57a130ca0aaa2c8ac1789550a407930b6bf39d358e69948fba5ab54550bd3ad0e445cb4c8668d5c92f38f9aeebe118ef1945bf986e
TLSH
T138E07D7159CAC63F505075874AFCAB0DD2F17C1AD3C93A025F0C4C64B551501FBB61C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 ce99cc1c2921a250b63ca385844ecf594b883ebc9fa4b9e9410bbf19659b623a
MD5 562278509dd9dce2f96cb69a62ed620b
SHA1 fbb0cb3413fe8da4c4af62675c5ac13bcf7aead6
SHA512 d9f324d4ff501a6e19000646cc79ded53fb5b3e39c1008ca068cbc578c04f8bf7baa18c172162910400154f2f97ff3fb6217f85130e8c062fc9316ae1ac3baad
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlH3BbhX5:ctGj+BCNC5qFVpKxHxbh5
TLSH
T18CC2781632FA02023C7D791D87A597371A42B1A33068E93B7BE914B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 29KB
SHA256 342cf2745330c832d76475493aa931c1796805bc38582e22abd0fac64cbcaa4b
MD5 c20fe95b37422f29de712f12f2e5a7fd
SHA1 ebb7b5f8d5a6d3a256b465e981522e3adaad44a5
SHA512 142fea86f3f56482c75a018f0b2d2eba90dfbeedc8d2550c1aa3eb1594f8a6f1893ea4063554691130f7ffe273d2e04a414b0f3b014d11bd17c6d619637bb4c0
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlH3BbhX81/cfg:ctGj+BCNC5qFVpKxHxbh89co
TLSH
T113D2A91232BA02023C7D791C83E597375A82B1A37418E93B7BE914B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f17d9477ab32504c6a488d99ecedd5eb304cb0e3918c8fadd41a96e15ad288ec
MD5 fba96168e799085539bd1c14042ba2ad
SHA1 d28a9fa8c445b4e54e7b18e33b89f8f6ed11e1cf
SHA512 54ae0be45e6032120d4d11ff2d419817b4242b9422be8965b896effd05cfd177a19248a5f43d823ad92af4630fed87045bb029065e99742ae9e1b2b0ba788c5d
SSDEEP 192:FvoWTkRfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aA2fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T15724640A7B747001DDE7E9725CB080771A3CB16ECF22A6D15DB254698DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 9fd2240407eab8d83ed33143e7490a10667ca9f913fb6f417b6afb69805c566c
MD5 f397543e2c1791f227f1bb688f6afe33
SHA1 02a18859086a0592115aa051cb082fce01c8d326
SHA512 7a487dfec08948a3cd6c8ce16f6506b2b7b3df8b92212ec7d99283e812a5e10300e948fa2c55a9cdac25b48f463de968763b35ab46e7303d55439e2671378c45
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBg0RA++8Gt:DEK3tjkSI5IUltGhp22iSBgapW
TLSH
T1C852AF9BFE342216DCD947358AC001E1BE7A913DCFC2DA0265E514211FB4A91A32EADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ae13370d-3191-44fc-b121-232d17b771d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae13370d-3191-44fc-b121-232d17b771d2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 d107943bc93091177b8d4cd4b653c819a0307ed5ed3eca4ee4239600eee6fb3b
MD5 37b301aa47d55a0fe5b1957a698dabfb
SHA1 254004e3537e18659c4222ee52e50316c388af3b
SHA512 e3885ebabef3991e3a743beb0379525aa195fa724a5a75e053af990b66b7ed5a96077cc19ce8b882d146992a1c830069e392d6dde798b09eae542431a28402c0
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BLQXIIImbGMIMslYcYF:FQ8sNis/NQXIIImbGMIMuBY
TLSH
T17A5284592B061B7BD05E5FB702A98B941FC5C9C2467632AD30611C8F8CF3A5787C92F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 2c686507b2ae2f03d246405d4256e6ca9f86fa840f2cdebc6f6cb6a1359f0b6b
MD5 d9cff494ab8a548a3331d54f691d1813
SHA1 0559f4c732a0ba891d44ed259b7619ec7768fa06
SHA512 8ee7e664a82910450c8e1416a5a214242671ccf6d0b429482539f14e6053593d8941b925a625d8e7da449b6a86306827bca7172e1806f48893e122cb6e2c9478
TLSH
T164E0805175C5C27F6095218706799758D2D13D17FB842A551F0ECC5B6501144F7D91C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 209bddb590b7bb8ffc54c72cc7aa3ce6c607163300e6134e61e9cd482bd05a93
MD5 81fa6539c087c3cd31f212344a994f6b
SHA1 97e66b91e8a6697efc87090464aa67634717604d
SHA512 510f7b8dede7ca78e19dbd421aca9e48880fa8d7880f2dbd495be82d872247c3229ba4ce312cb2b3d1241601c6c79009a7a5a401b0e8cf395af14d37045597b6
TLSH
T1EC219051F320C109E18E873EA02AAB361328E8029FFCED1F447924256D76B015E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 131514d4bab66c5c45708e87cd198684d071b7d47c802a599456f6108755f899
MD5 342513d4dcbdc72b6e186dc729d67d4e
SHA1 87f828e790aa6398bb242e2e11359ba752f82ab6
SHA512 7f977114fcfafefd064dc4a62f954c15ac5e7fed4195740d29af0a229d6fcde56eaadf94134a894e01648105953bc675100b12729fee3e30d7d56a2b46222484
TLSH
T130E02611B9CAC2BF909121870AB9E788C2D23C13FB882F421F0ECD4BA901141F7EE1C1
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 466999e53f4a667ee79b31854e4eb4d434f076b5a3947e5f2f12d57ae15ce48b
MD5 8ee5983f0501683ec1c605b247082fac
SHA1 4e35b9b3f39d2d90ff14633ba1461a991bc26511
SHA512 1f61280db84d527a9c3341e54ff5b470f454fb16fbc82f119468e222534d6b94c7b2bd8110b094c9bf7157cb8ce4935cfdb6eed12bcdb23139c553b474bd657a
SSDEEP 3:MsEllllkEthXllkl2zEelwbylll:/M/xT02zNwK
TLSH
T12044040C7FC41445D51C1030C515C3500374DC301715574334570413DCD7D400D01140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 b0515f5fd89e88d416ee42f0de143fdaca9b2b8c3fd8d87cb5340ed8624577ee
MD5 3a07dd9b511d098f727dcc67ac4de217
SHA1 62f8328c9a9a28c042089870841497a806ea6e1b
SHA512 b666eaf0a4fbf906e226c7f3aa4f33dab7407fdccffc4a7be8b81672247317870fdfbd52ea24b5841ef784c35bc3f4b440545e5881fae603d0965181c6ed6513
SSDEEP 384:niiFPZcIy8Nv8TUNTUlIRGTtk6JO621zCfbLoNuIn/9gXz+LtOObjI9G6w7n5HAm:pFHyswgbD68Ootn/9QKLt29Mz
TLSH
T196D24B36DC99CAB7EDEB8A99B78A7643DEE01173C6CC8AC4D5D85E0C009709D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a2bcbdd46419363696c6a523da64a44fcb9ecb88338a81dbfc47f37758de8f38
MD5 6800f2727feba7cfd6743438573ae106
SHA1 080daa7b8ee000310723f592da16a7e60cdb7feb
SHA512 48d8a779f6d5f9474ba42d6d1008b0a5afec598f94f779a446ae6f4801750e232f75a780e9ebcf60f332d4c02d4853d6a2c86a795773e2eb8bf9adce0160cb66
SSDEEP 384:nciFPZcI28Nv8TUNTUlIRGTtk6Jf+oz621zCfbLoNuIn/9gXzGHtOObjI9G6w7nz:HFH2swgbM+oz68Ootn/9QCHt29Mz
TLSH
T191F2AFF598D78A72E89E4B57A37D6E0299FCD123B5884A84F7D44D0CCC860BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f4b11e2e89b1c4afaa8d00ddea72c80ce648b98994ce2fa6258a3b32823c8ba9
MD5 2a30773470d008e8ae7452ba40faba0b
SHA1 9d40303b036d98180a139567b3aee0d50918e899
SHA512 6682fa6b45c136323fbd013db0c9d0d38cf56ad01cbe0ccd7c5ba5941893d62a28ee20cd0350e7600cc19aaf3930433cd6c4118a92083f264be0d2bf51fddaf6
SSDEEP 384:nTiFBZcIy8Nq8TUNTUlIR+Ttk68G621zCfbLoNuIn/9gXz+ryASWXwkhl9LkmtOn:+FJytwgvA68Ootn/9QKrFS8j9/t29MS
TLSH
T1FBF23AB1D894CEE7A8E6DAC9A749F502ADE40233C58C898CE2F4BD7D305F4BD1706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 85b10a406cb5d2e41f0a49340219e9c19449e56b38fdc1095f1a51f20cef5beb
MD5 0386fbc20887f9fda29f66bf1337af1b
SHA1 e946f107976cb54308231fffbcbcdb2551ad5552
SHA512 69515103c582560e63a8e085633f1eb3a20489ade8bdbb0406b88f20b97590dab73d105c02bb35ff5e473da86263a089939d285fce4a958e639baf2192601dbf
SSDEEP 384:nTiFBZcIy8Nq8TUNTUlIR+Ttk68l621zCfbLoNuIn/9gXz+ryASWXwkhl9LkmtOn:+FJytwgvr68Ootn/9QKrFS8j9/t29MS
TLSH
T111F23AB5D894CEE7A8E6DAC9A749F502ADE40233C58C898CE2F4BD7D305F4BD1706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a58d16cfd220f4d49d356fdcae93d19523456dade70e5d04be784d00a4a0b440
MD5 f4e607c5a318861824ffe53b0a4caf77
SHA1 5698dcd260483c7622378791d76172da150e8a58
SHA512 2f202f1e054077a96557eb1b75044fc3ed0e1d62906000da9b99be8e4449595496e9d67e04fa69bc26202f2b4c12da1424f5e110d358d9fad0407fb0fb8c9484
SSDEEP 384:nTiFiZcI+38Nq8TUNTUlIR+Ttk68E621zCfbLoNuIn/9gXz+rrOObjI9G6w7n5tq:+FQ+3twgvC68Ootn/9QKrr29MS
TLSH
T1FFD24B76DC99CAB7EDEB8F9AA78976039EE01173C6DC4AC4D9D85E0C00970AD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 8bec582639af8701731756041688d2b3ca94acccd95bb2eb70d33e3baf2a07d2
MD5 274a0ea80a4ef9d12659c2a795d9288e
SHA1 ba9ff98e55bf3c9c6014ae6cb9e1a293481f9ba8
SHA512 cdd11606a1d49347de8c231e4cd263cd861ca0520ece43274ce20c74e95505bf1790e025cc4110f9954abbd3fcad1907ea050a92c2704cc7b9b9832c1b57d2e4
SSDEEP 384:nIiF9CcmyWCs38Nf8TUNTUlIxBrk6oykF1zCfbLoNuIn/9XSAwT6ty/7IgA:TFccps3Uwg4GkzOotn/9XSAUC
TLSH
T1BBB23A36EC98CABBEDE64F99E74EB643DEE01273C5885AD4DAD81D0C009719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ee41e77b4797625ebf64c0fa661b1a5bb5d50769091a1412bb286012890f71c8
MD5 b3fad8a24fcb0aff36bd0bf474de2f44
SHA1 58a40099517fd4b0f193d940b4f35efffe62876d
SHA512 8504c1a8057045d7c8ccb19e3d9ddafc494c2e48057f72cd0d6b7afc7c7f6bf3548dd131c2a64dcb2084c4ba43858a818886f6146bd09d383c0d2f7bde420203
SSDEEP 384:nWiF9CcmyWCs38NW8TUNTUlIxBrk6pnyy1zCfbLoNuIn/9gXz+RrwT6ty/7IgA:9Fccps39wg4AygOotn/9QKRrUC
TLSH
T169B23939EC99CABBECE64F99A74AB603DEE01273C58C5AC4DAD81D0C009719D170BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0207363281358b8bc64487b7df1d43698eba493f872d33bb86f9b3d60dff85a9
MD5 73bc69b88c6e3e40ad612b42810b485c
SHA1 96b0fcaccf12e8ef313e88dffd13ce6e0397ad67
SHA512 f3fe73b74c46bd356b21a45a919df6bf48b9c60d077762547af55c66ec431ad9ca9c622c97aa9ace1dffdf673f9528bb6a9e960b0084e24285e9cf9f7b3c0da7
SSDEEP 384:nCiFiZcI+38Nq8TUNTUlIRNrk67Wx1zCfbLoNuIn/9gXz+rrOObjI9G6w7n5ty/f:JFQ+3twgQTHOotn/9QKrr29MS
TLSH
T167D24B76EC59CAB7EDEB8F9AA74A76039EE01173C6DC4AC4D9D85E0C00970AD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 418b11469c88292bd634b386e978673fbe4262d8cd0a337eac9183a06de935bc
MD5 9605e4bf7f431785894fd88ed89b2b79
SHA1 777532e298eb53f2bd720870939f805eb7380fde
SHA512 00b76122fa9a952bf65b040ab877076ad0cfd6f15580804939914d83c0f1b24b84fe31424d560355e4a6cc47b601fdf37af1c227a8f6f285e60346adb86732c1
SSDEEP 12:TLH8PFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3is85mQQtAdTzcQAJmdHx:TLc5UOl0afDdWec9sJ+WLho3fsuZB5fc
TLSH
T18D92DF23BD252027E89B5B7AB88349D10DF9129FC9ABB404DAE04D6109A2AC1A6441F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8ee88cc089ae2bb679ac8e19ad170c366ec321bf24104aa93c4e034a7dbaef83
MD5 63a42d54f24de95a1d7c4971659a01ec
SHA1 043fafe1aaa3e7e925cc034244f1e1e2aa2213e1
SHA512 7e0bdee70b1864c3c04faf144596e408cc79a01124e2981c38635fc6069e4a606fe4a3b3e09a78c74ef09fe0a0674cfe2f02d2313a21299cc44f5d7f76433950
SSDEEP 3:MsEllllkEthXllkl2zEelN++/l:/M/xT02zN
TLSH
T1A444040C7FCC1405C55D30304411C3701370DC100D15574334510413DCD75D01C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f7eec3815a7e60024403df69d4f6927040805841a0a2eeb1b24171b0ef2ec295
MD5 67d1e4cd31b40011371163d920e55d4f
SHA1 f40ba227fb1549770d9c2840e956df2bbb500499
SHA512 f49cc8af790576eeae1d4aff5265654edd7fcb116d850cfe23073b2529e83ba28f914f69b7c48763e53471ff889c13ada27c36e914de5a89efd115f81ca81fa1
TLSH
T12A5160D04C7D5BC1D5BD0A6E748B38FC82E8D725F5A4347C68A8E9990AB922C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 46386edf89c84883c32311beee9e65cbca0d45050d3a86dc63ce98090974defa
MD5 22fac1a245376c276b50c2eb26b43123
SHA1 80d451549239e6b568d49149be3a51f02043f8bc
SHA512 ea86a1728ba09b82deb1a807f131c3ad6e1e062ade06551cc22970f99ad32ed7cd6b294b2ac4a9907745e14bb36730ea9f0d4c36763062ac93e4f7117d964553
TLSH
T1EA515FD04C395AC1D5BD0E6F748B38FC81E8D735F0A0387C6898E9990ABA62C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1680024323\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4664-1492-0x00000169D4A40000-0x00000169D5A40000-memory.dmp

Download

memory/4744-300-0x000002BBC23B0000-0x000002BBC33B0000-memory.dmp

Download