1d71018a17ac888f05beee68320823d4a65e14483b59d27350f192d7624e23dd

Analysis

user interaction
yes
max time kernel
449s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 287KB
Sample260802-28ca3shb77
SHA256 1d71018a17ac888f05beee68320823d4a65e14483b59d27350f192d7624e23dd
MD5 3f73933cbcd8e78b40d4086c9a87db1e
SHA1 dfdb96aa9d0a114da8b9a6e88baf0703eadf726a
SHA512 8d5cbf7f3e4388f7af5c879fd8ade4df9d23d4f186d181b5f7283d5163d7381e0646791916c8a67f0570a04e8713a40246590b27bf21edb6b8eff62fcc2508bc
SSDEEP 3072:WQwDcyzq3tkPbIQf0jQ3lzrXH5Yj52hbQQhTHIlWXFhy59eA:WQwDcyzq3aDIQf3rXH5J0+HI6qeA
TLSH
T1F3545B366300B43BB813DDA0A6BE6F4D3C25E12BDC0A46F8B591E930DFE2EB1151566D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3052	msedge.exe
1968	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301861261400694"	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{41860D90-AE70-436D-8784-85357035E425}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
5328	msedge.exe
5328	msedge.exe
6828	chrome.exe
6828	chrome.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
2800	msedge.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe
6688	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5036	2800	msedge.exe	84
PID 2800 wrote to memory of 3052	2800	msedge.exe	85
PID 2800 wrote to memory of 508	2800	msedge.exe	86
PID 2800 wrote to memory of 508	2800	msedge.exe	86
PID 2800 wrote to memory of 508	2800	msedge.exe	86
PID 2800 wrote to memory of 4308	2800	msedge.exe	87
PID 2800 wrote to memory of 4308	2800	msedge.exe	87
PID 2800 wrote to memory of 1228	2800	msedge.exe	89
PID 2800 wrote to memory of 1228	2800	msedge.exe	89
PID 2800 wrote to memory of 1228	2800	msedge.exe	89
PID 2800 wrote to memory of 3748	2800	msedge.exe	90
PID 2800 wrote to memory of 3748	2800	msedge.exe	90
PID 2800 wrote to memory of 3748	2800	msedge.exe	90
PID 2800 wrote to memory of 4820	2800	msedge.exe	91
PID 2800 wrote to memory of 4936	2800	msedge.exe	92
PID 2800 wrote to memory of 4820	2800	msedge.exe	91
PID 2800 wrote to memory of 4820	2800	msedge.exe	91
PID 2800 wrote to memory of 4936	2800	msedge.exe	92
PID 2800 wrote to memory of 4936	2800	msedge.exe	92
PID 2800 wrote to memory of 1168	2800	msedge.exe	99
PID 2800 wrote to memory of 360	2800	msedge.exe	98
PID 2800 wrote to memory of 1168	2800	msedge.exe	99
PID 2800 wrote to memory of 360	2800	msedge.exe	98
PID 2800 wrote to memory of 1568	2800	msedge.exe	101
PID 2800 wrote to memory of 3512	2800	msedge.exe	102
PID 2800 wrote to memory of 3512	2800	msedge.exe	102
PID 2800 wrote to memory of 3512	2800	msedge.exe	102
PID 2800 wrote to memory of 1596	2800	msedge.exe	112
PID 2800 wrote to memory of 3164	2800	msedge.exe	113
PID 2800 wrote to memory of 3352	2800	msedge.exe	114
PID 1668 wrote to memory of 732	1668	chrome.exe	117
PID 1668 wrote to memory of 4864	1668	chrome.exe	118
PID 1668 wrote to memory of 4864	1668	chrome.exe	118
PID 1668 wrote to memory of 1968	1668	chrome.exe	119
PID 1668 wrote to memory of 1168	1668	chrome.exe	120
PID 1668 wrote to memory of 1168	1668	chrome.exe	120
PID 1668 wrote to memory of 2492	1668	chrome.exe	122
PID 1668 wrote to memory of 2492	1668	chrome.exe	122
PID 1668 wrote to memory of 3200	1668	chrome.exe	123
PID 1668 wrote to memory of 3200	1668	chrome.exe	123
PID 1668 wrote to memory of 5148	1668	chrome.exe	124
PID 1668 wrote to memory of 5148	1668	chrome.exe	124
PID 1668 wrote to memory of 5244	1668	chrome.exe	125
PID 1668 wrote to memory of 5244	1668	chrome.exe	125
PID 1668 wrote to memory of 5572	1668	chrome.exe	128
PID 1668 wrote to memory of 5868	1668	chrome.exe	131
PID 1668 wrote to memory of 5868	1668	chrome.exe	131
PID 2800 wrote to memory of 5588	2800	msedge.exe	135
PID 2800 wrote to memory of 5588	2800	msedge.exe	135
PID 1668 wrote to memory of 6032	1668	chrome.exe	136
PID 1668 wrote to memory of 6048	1668	chrome.exe	137
PID 1668 wrote to memory of 6064	1668	chrome.exe	138
PID 1668 wrote to memory of 6012	1668	chrome.exe	140
PID 1668 wrote to memory of 6012	1668	chrome.exe	140
PID 1668 wrote to memory of 3224	1668	chrome.exe	141
PID 1668 wrote to memory of 3224	1668	chrome.exe	141
PID 1668 wrote to memory of 6116	1668	chrome.exe	142
PID 1668 wrote to memory of 6116	1668	chrome.exe	142
PID 2800 wrote to memory of 4196	2800	msedge.exe	143
PID 2800 wrote to memory of 4196	2800	msedge.exe	143
PID 2800 wrote to memory of 4196	2800	msedge.exe	143
PID 2800 wrote to memory of 4272	2800	msedge.exe	144
PID 2800 wrote to memory of 4272	2800	msedge.exe	144
PID 2800 wrote to memory of 5276	2800	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7fff9311c188,0x7fff9311c194,0x7fff9311c1a0
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,7695994617814280793,12096834031110856835,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,8209622064352161174,11233521455626983860,262144 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10079640903746265933,9725719544640973707,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8683972773168877886,16804341876379370451,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15561803206632307063,17028100277272273345,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,16301278789915747549,10429886362371853047,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8500961266576537111,16844474007069161574,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15342539101099694345,8326989109569909958,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,3809290435231564691,13999769955178503000,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,17601093118201689670,6913249390118028044,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,17601093118201689670,6913249390118028044,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5076,i,14880296879730987038,4438448492064580374,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2979960595196693568,3234232536693960526,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,7185156327869201497,6160566195925621327,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,2203293224441670583,8476368915500271199,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,8572369500284884773,8238272624670395011,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4476,i,11505716386102636296,7164304227914494318,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,15559849392731002191,13766600679266040547,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6692,i,4778449372458391811,4493016294361434177,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6992,i,9553012905445197271,5267053048912748619,262144 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7024,i,3494392480451449143,1669013152403964307,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6792,i,10400243198572850208,13057444590256080006,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7156,i,8986616625547918944,13148880650896824984,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7320,i,9683062184562261424,13841105010097031878,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,4962445138099601370,15382173163051168279,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,17198759593868011895,15941220320281506371,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:6996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,7582395976678558617,4472429174377111148,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:8
  2⤵
  PID:7076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3760,i,12429222343658459167,7230069767523846655,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7892,i,4841573878742720465,9652865579273503619,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,13182300553963721443,1485003874402421770,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6828,i,15170120074746802781,15015169756192952413,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,11303290983523666016,13685683375360616831,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,15688824491205438669,4673428159764458829,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5040,i,5765831631287066144,7842127262952757596,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,3746371528436900708,2415661448689518575,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,5924554380164549761,15673822094383848973,524288 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7420,i,15745942494581838790,4088513545202705547,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7712,i,8100400138785105101,5269234002974996388,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6700,i,14199561448056140732,6604044896164099401,2097152 --field-trial-handle=2272,i,3948559791812524304,7872970683068327169,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff900ac728,0x7fff900ac734,0x7fff900ac740
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,3459430902717705775,3038758530548644677,262144 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,16334948349918951646,8560302810903689169,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,17602406529804581612,18366735109418239985,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,8337572890496463713,5834116575869833618,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,12086874447769518034,2042582215314874270,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,6779840000995581238,6723490597697939007,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,15803566002374968466,9503781495142319493,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,17423236523064216737,3779173780755520949,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,16103838025636046614,2958390283404924937,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,11738749112253031738,655840966874317439,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3724,i,16078571161195644841,7261721070038773511,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,8440797364738877772,8052631214868547598,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4924,i,3717812193107092292,17370268923382688057,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5820,i,14383536741988341407,12431578793014430878,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5836,i,13735683800450625758,11486893207971512011,2097152 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1224,i,11656379082095890711,11596566571357643226,262144 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,14530130936089091531,9680303684884166845,524288 --field-trial-handle=1948,i,439166852748497481,15587259178100072161,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1540 /prefetch:8
  2⤵
  PID:6224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\invoice6204855761473867505.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6688
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6124
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FD4953A446540B76C558B7B4C96F26D7 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B0FFE26DFC800D4AD8A3D82B910E2285 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B0FFE26DFC800D4AD8A3D82B910E2285 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B75F9B458BC3C3FC67768C5BE730425A --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5A364CD6AC92133353139DE473FC9837 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5A364CD6AC92133353139DE473FC9837 --renderer-client-id=5 --mojo-platform-channel-handle=1984 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=806C81BBAE151348AE419B1417EFE27D --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=64CB476B8E5CECB45CC8B45C638F77CD --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 c47bba5d5e16ee7f12d1e3f2d1fc352aa9af62a3e0aa237e0cef0c0e560e9f7f
MD5 9c8892402cf600f7e57be299de91fcf2
SHA1 bc69856ae8bc1854917b84c48ff0a3897810ee78
SHA512 499593d409da77df362b223034d62d2d30b2f3d0b8743d914b1c71c97887be45d8204422411a237ad0c73d96085b5e2127b4136f8411dde03d106e46c33fc29f
SSDEEP 384:yeEdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:/+eUZsLQCZsL3hUS4
TLSH
T1A053CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a1c00d6e9fcb9a27c56f531e9170d097bd755b8a5b86ccd9868e3be54f2348d1
MD5 5d385a003198e7c75b48f1381db084d9
SHA1 3225370a1c47509f6f7217383d126a0df241b9ce
SHA512 fe829172a38ec69a0176f90559ce30b5cffdc09a9857f480460bc931d6dd7640024f7a6c0c0209d896de41d6067f6908b833c5af979d8d919399ea7a892b647d
TLSH
T1F8E02BB9CA20AD2B0CFD07286459064AE65523172F40856F3A3D96198FB96771596C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 23f6a279626ede2b940770d7f40240cbb99c624189165e61047b81ee633b13e5
MD5 99c46af38a3f1e63a0b3c4721c979492
SHA1 c1880cd2454ba6a64d9706d223ddab042402f179
SHA512 237f58e92638b57ee016ff4081e4784e2457a7491b9c77bbef4e5bce14d0c4ca8868dfa7d25f39bd5223aefd54ae775e0ac0829749ac595b4c6ccd03d5a146ff
TLSH
T1DCC02B048B80050DDB2783B3B02144001BB26FA804029B0310A86289485FDB00402440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 12ab398471c4a6aacf103cebfd3f7df84f75f7aa1f6d9afe906c51fa7379efc3
MD5 8673c3f30520aeda9b63828a8e847d3b
SHA1 4e15c40341c6b4be3db9a6449f1ab926778c26b3
SHA512 5a20bd4f371b8b565bc4019a9148d04531ce63bf23a1cf555009783c6ab9402fb37642c8aba31cb80113fa84328b20fbd997442dc5758a8ef8be480821ef3f76
TLSH
T19AC0925492502134D76EC2B2726785152BF72EB05482AE9266B115DEA8AFEA50012C40
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ccd37e11ecccb658cebbc220fbb901830ca22ee33d2616acb799183dc1c96dfc
MD5 566bd0b786ca2d7d2b9b5e2e1b51ba0e
SHA1 5baaaa3a9ea4b22a9b4df68b1719cb3733a4e5bd
SHA512 0fcd9855cdfd89750e772e12f286b1001d129098312d7eba42977f1a7eaa8c2331daf8252aac3575ca4d622bf0267311cdcdfcc5968032f86bd40f87e47452e9
SSDEEP 48:YALlhbghDthaqCqcaXYfoKsFgmzsNfsHosOcKs05fqzsScsTts/4sL+saqssQa:DRg/0lhaIKyy3yfyHcLceX
TLSH
T129917EB7C7D4C56DC91156F8EB156F2FCE2A0A24532C3C66C8D4AE5B93E2872D21134E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5ecb7686e0fe6c5b47419928e7dd99784a49dcd2c48df820d96e6b012966ce24
MD5 3cd65b22f2814cb2582f9daf2f80e71b
SHA1 5995a8cb3f7be51e1c7b4bfd94a3f792a5561545
SHA512 e8079e731543feef43ebc0e824645a8f3bf79ae083b37757a202a47982144ba131aae0ac1cffbd3ce212340007b452d770efe402c3f233a9b84b58b1fcf95004
TLSH
T1876180F7C3E8C53D895196F8E7156F2FCE2A0A14432C3C66C8D4AE5B93E2871D21564E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cf3251372fee12b1a0eab0085523fea978dc762f4acf525cdc086ea498e7d0d3
MD5 96184b7da619d50a9bdd0db3f36cfc35
SHA1 c3d70eaae90a4d24a6cd51ce78266968f26bf62b
SHA512 0f4fc9730fa9f3e3ee0505be109c7d5707f66e5fc0d5dcd7afc0af180a3c627e7fafe9cc3099fec14db4595a45fe52b92146661f31d07e3eca7200ea188d2558
TLSH
T100818BF793E4C66DC91196F4DB25AF2FCE290A24032C3C66C8D4AE5B93E2472D21534E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 06084fe69e8819914d8ccd648174f0bb5a1202f14c77a3a071eca70ecfe1abbb
MD5 2a3035b1ead962363391d752282df424
SHA1 9c3396507e0df7ba9588e09c8ad990bda0d7149a
SHA512 356265762977f64424f285de48b04006a4075597c3413e53e367473d494e5bb5ea01d0c5fd6f538c9d8a113960ee9d12116f106fdd555ea1b0673d6e708a4dcb
SSDEEP 48:YALlhbghDthaqCqghfaXYfoKsFgmzsNfsHosOcKs05fqzsScsTts/4ssjsO+sJja:DRg/0lZBaIKyy3yfyHcsDjW
TLSH
T19A917EB7C3D8856DC91156F8EB256F2FCE290A24532C3C66C8D4AE5B93E2872D21534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2f2e989f92c6d9e60bc84bb6355e5437ab031901f65b56339edadf7e23396b9e
MD5 93c2bdffd378191e66014d0cefa1a32a
SHA1 47bba43a345bc626f9c60548313b445a05c7c56b
SHA512 e19d1f010e437bde34cbd74484368077f91adac09b42d8ab112f6985f400232fa2a4816ed8647f0de39722e8f0ad0b11c5ca56d720bdd07b85efd317da3d7323
SSDEEP 192:tRFkGQfr2nh29/v72ympJPRp1M6B95Hsb+WNn6SBIDIlP2jzaymVyIsnAUgraJ:tRFkhCUXQ3XP7w/2Ih2/aNe
TLSH
T1ED52B52FAA20693B9DEBD319F9127717E7F5106625902E88E6FC8A2C15E75CC3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 80bccbfd0e59491339281a7e158300a95139b7f2960603b277ed23ef4464738f
MD5 f6d0c93ad3eb99d16fe84797e992f647
SHA1 47b1a6ed7bec792763cdd22a159aa34925661a40
SHA512 45566f78a108c860055b493f3daa50e3378d12e486656c37e5a533fb3b2731e5bd752d2286e9160b4cb7d7a38ebdf130bca6f50aa44de4f503ec88dfbfc54b6b
SSDEEP 192:ZRFkGQfr2nh4Uv72ympAPRp2MJF95Hsb+WNnaa49x2BP2jzayJVyIsnAUgtaJ:ZRFkhCSQQUXx7wzw212/ai8
TLSH
T16F52C62EBA20693B9DEBD319F9267713D7F5102625942E84EAFC8A2C05E75CC3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b1ee4e82e5c616c17cf7f2ed99650da436f282c0cb77de070298f9285cd58c0
MD5 e7f2cf8c9e576033a5a838578ac863f0
SHA1 abaff77652115f3beaf30ef3a99afa8595892853
SHA512 14b69f381294b1b93af45254a341fc2b701a318f4a4a9b0f737ea6eae0212143fc1c3b3c802a25b47f76c0f266f3d7cfe27c4a9ba234a84989b62e53fce59ee1
TLSH
T1DFB0125080065142C00306F4124614EC711C9F11DA0A270143E06A2A88251518128050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59401c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59401c.TMP
Size 96B
SHA256 0b076fe3827e295996191b8768ce212faefd6a3a8cfb8f77d5f4985f92fac163
MD5 852e91a4fae68ef9ef5fffaf9c402efd
SHA1 205ee4395a1f6e9f82550281bc4fee538438164f
SHA512 750f4b00ee2e7f2fdfd94b58d754eed602fe9c5c127e9c30499b62697dc0bb1bb9ddcaf34aaa06f870bc0f8b43e8766312856c8e725118c68ce1595b82619181
TLSH
T197B02280C0822B2BC08203B0288880E832B0CF20CA030A02C3E00E32CC302300A32820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 2e8e3062e34b3cc34e21c6fdc5e7745207ffef43b3eb3ccf6ecb367483e8a35f
MD5 f944691ef2c917040ef9abe5e3a3626b
SHA1 aebf430c4c8d1a5fe02afa5d6122999d5e54e914
SHA512 c026b9df69be096b55bab974a52c1093660780531865f901607c0a55dd21ada0009ab72f7bbcc5f8d78f512f65941deedc9d364db959b234c8ff5a17b1d99057
SSDEEP 3072:t8dLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA8qfd7NtZL8cHQRZEQ6Spsq:t88i0Aw9NDv+qw5ZtA8qZ/ZLW3Exq
TLSH
T113342237AF434E338FC59A7078274F8F57F8A829D064D3866AA837BF59438A63417018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1122c6983806db480ca1c379c180bc9daeaabc1aca10715e2654d89e826cfe95
MD5 861e0df17288dbd656ebd25dc2f1fdd9
SHA1 0a55f103e527de11b15a42d113d15f385c60cbda
SHA512 f30f6663529374464ae3ba061610642dc7c162adcd545e92fb9f22e41be15bbe44a86f99c3ba89ca071cd860125f959b831f80b1a13f013efec5d9183f2c7ca8
SSDEEP 3072:4EYdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA8qfd7NtZL8cHQRZEQ6Spsq:4EY8i0Aw9NDv+qw5ZtA8qZ/ZLW3Exq
TLSH
T150342237AF034D338FC69E7468175F8F5BF4A82AD064C786B95C37AFA5478A62817018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 cab461ada3f416dea706a35b81a6612fe48be299be7820d09aaa39ef02823d80
MD5 eb726d91de7431628abb4dcda63e214c
SHA1 1229f42b5a62940c15d67c97b91f08267b79e790
SHA512 bd1fa8c27cc3b542f4ab6c42886626133a7207a8d0d7bd761b9bc73d080c9ebfb9e82f446046de1679b7972397bd50b49a252964903470431b0ffd693d720f12
SSDEEP 3072:6PdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA8qfd7NtZL8cHQRZEQ6Spsq:6P8i0Aw9NDv+qw5ZtA8qZ/ZLW3Exq
TLSH
T1BC342237AF034D338FC69D7468174F8E5BF4A82AD024C746B99C37AFA9078A52817418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 38321736c7983a9e4c79919470e1a5ee59c09f49f5f8b8cdf350bf571e04a851
MD5 52d7c81ff3cf26e0fbfd90344a0fcaa3
SHA1 a09c76c47e9ca3f1641828ab712d341c71a67170
SHA512 b94ea7aab4b24b148d8b9879e13f99aeb15fa842b7a85997f1e45dbdcce0b2e39a4535b04bdc9a56b4290e136ff03e51e589325556f4aa1a232365f3f7f3cfcb
SSDEEP 1536:TMQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Nqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1A5C30237ABC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C83891784289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 6ec5090c3e07b6afa51a0f1a83ba0c5925272bd3b6643249307d71dd2ef698b7
MD5 b2d4f6b5b68a1d70e0e278364fa6ca78
SHA1 99cee13fcc02d56c468242fbc4ba779b639b8904
SHA512 454d7dce48b71b82da7e064676b49592f05e827bca527bf44ff8e630d1a0be7e2a163ffcb5e88380c1be4b6d20d346d0c9b5b9716bfb42fb228f4e402686ead3
SSDEEP 3072:E8dLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA8qfd7NtZL8cHQRZEQ6Spsq:E88i0Aw9NDv+qw5ZtA8qZ/ZLW3Exq
TLSH
T109342237AF434E378FC59A7078274F8F57F8A869D064D3866AA837BF59438A63417018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5a418b587c838f37173823ee7529624b7b6c0b524ebfb156ae9e106d04b527a1
MD5 9be209996fc36a7787a00df4c94fda48
SHA1 62cc8de8a2ad6bbba97d49f228195210e7be17f8
SHA512 3df261402b94084c8b9e2c08d54b144eed3976b69a65b371277d6d3c318fc700b03487dc6b3153c858bc94633982087a7e6d9f1e92692a818d301d430dd1b2aa
SSDEEP 3072:WPdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA8qfd7NtZL8cHQRZEQ6Spsq:WP8i0Aw9NDv+qw5ZtA8qZ/ZLW3Exq
TLSH
T170342237AF034D338FC69E7468174F8F5BF4A82AD024C746B99C37AFA9478A52817418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8fa7095525ec5bbc52a652cfcdf4981df67934596348886fddccedea5c0cb5d9
MD5 f21cd3022fecbe0940a91e413b6fe3d1
SHA1 dd68ebb50937215baf2966181903f6aee0563d38
SHA512 b4890270a32677c5990236590aa055667effc0497182bd5a4c753cb23ba016b5e9ad4e98a5a96347bd4c51fd91ef904f0dbfaf1b8a431d3ca7005f89e8a572dc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T105B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 67357cc53b16b90aeb9858439be12162f2cfde67ff33429c40f9594d44403ca0
MD5 111239836838b489d406ccf66cfb8f47
SHA1 2058cc9c94a8bc317d804e071da1f526b5066e26
SHA512 80de90c14dd55138114217161ff17715341118e890e4db73002410b2dbab51d5f509543f97619ccf78fc5c5483c248a341257e64c7fdf453022b7eb7c8ddda46
TLSH
T186E020E415CCC26D9510E48B527C974C51C03A1EBBC4A915670888CD3001444A7D3DA2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ef

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ef
Size 23KB
SHA256 37ebf3b6800893a65778cbb15e3bf04f4b8a0b11c31efdecee0d17ede3e18005
MD5 7c9771b9d4df79471f1c8355382c94e0
SHA1 294607f430ebbf481296f7661de1643bf4250642
SHA512 ea049527b0f1a372a13f94a35c02effb5aec89603e8369775ac9e5621898dc1bb217e14011fc489140c7e14e19c415e93eb46d4e7aabc91dd62e7d2fbbec62e2
SSDEEP 384:bp00P8vPgiqurHT47JBpFwSncO5/9K67avAQKf3XIZZw426YsKfv616v5Vmrss:bpmgxiHUdBfZcsPf3XIoLPk6RUrss
TLSH
T1BAB2E1D7BDC4407235D3C30CCC4ABABDA7A0762CA6F9E81011E27733A6B561482A4BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fc
Size 50KB
SHA256 a9545471c64a7327d879b1a5f4e769e474e3601324609f46ee3d662cdbaccaf2
MD5 122b8029950e7ec042fdcca03beb986a
SHA1 5493c931234cffcfffddd32c2fb3d0cd9892fe1a
SHA512 809ba90d221dbd860fc91bccc74a93ce67596f8caa86bcdff626ed5f022600b1ed746359c4327be86d8deb0fa338be8a8e6d6aa7b4c0348d5f8db61b0e76e179
SSDEEP 1536:PEAbcgVUZyzfd7pNC2dDcdgtNSlDOM1ligTp:cMcNmFpo2BEDOSli0
TLSH
T12933E1642A8871528BBE2574CA3080F4D264FC967F5639D677E308232EDD61D2CC5AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fd
Size 115KB
SHA256 177cae23a72597293eb712ad5ba0ebdaaad2a0c3d9544079a2ce160555e86374
MD5 99b31c38bd133cb1fb803034dd7bbc45
SHA1 e87483bab14c643c57461e1dfbf40a4009fd9a23
SHA512 4d6b9fa82253af675431be0c4dd2fc418146cf4d3b3abf9b0f86b69ec0128580f8c97dea9376333e5adff302f729b2efbd13fdadea399d559685b44f3c4f1d59
SSDEEP 3072:E1sDa+clMUaI+FW6gvIR4t0944driDdlZXMAo0M:EWabF+8UR4tR4drSMAVM
TLSH
T1CAC3121FAEC5995BCD0314B52A604C6DF6B60D361B7AD37A2C5C6B4C7020FB0AD7C896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 1d6100164096e0db6197866ecec7754a0fe257383a22455b7e0f7619019c0e97
MD5 34a55cf0f4e04b76a75ae54502f96cfa
SHA1 491ad29ef5054f9573c911f544030abcbc7d04dc
SHA512 89dae19d6b1875b239aab3f765ba6ed52684ff4044d1a773c7c6adb7f17164eb512c10b3c06f354e66d5830fed876acfc82680b987e68e20ec5d4e8b2db3a244
SSDEEP 192:Zg7fzPNXn4HCX7bSEdsEO78R0MiKkKJ6EfsghMWRLIXL6Gge3W4PJuqgPXuBhRUL:Zg7bNXn4HI7bndsEOQR0MpkKJrfsghM6
TLSH
T1B9E1EC380A970093FB5B99F0E1F50D5675B380A024835EC63D3096FDD51EB52E9AB2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54cd7fb143bd2c8621525525b5c6e547019466ab56aadff82565f0421d6d6842
MD5 a4d5bad5af516a0c2f25f6d1654efd1f
SHA1 d55c3bb9c942428f68f4b939388a0ee79ecd3dd5
SHA512 186c96f8af881acd614e21f8fe7fd5470ecbce963fb634f98104537726247336d450a3a79ab965025ebdddb1405bf3707d5cc7f04124771476c20aadc8b91367
TLSH
T1326170394B134883F32A02F0F1C2162639B381940AA79E4A3D64D9FD692DB26CCD93CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 44ab7100c54b8795cb57d1a8ced5c13156ebdd3347d85811228a343914360f8b
MD5 aa846812dc7859713fdebe513cb65acc
SHA1 5529c3c3a1cbcb3a86e256093742fd8d2e5c3609
SHA512 7871a90cc5ca13b6c44a18ef02a3a5ff58e2fbb90b5c522b2443598e162ae309e3060261f5e292c6ec0dc38fa30034a12c72af6265c870dd17f02c08778b9537
SSDEEP 192:BRf7fvPNXn4HCXnbMeMsEO7VnRBMiKk+x6EfsghMWZDEXL6Gge3WvPJuqgPXuB9P:BRf7vNXn4HInb3MsEOhnRBMpk+xrfsgx
TLSH
T16BE10D3806570483FB5B89F0E1F50D5675B380A024935EC63C3095FDE60EB92E9AB2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 902ca383a33635e5b09a863b23dfe280b526a3bf61594114cd27aba737264c8d
MD5 6eb1a6e3368da05267d44f2ec5e45178
SHA1 ca9d0f7611b62195b6dcde4393b9191dea11ccc6
SHA512 d6ef8750df4e2ffc6077735961ca720cfc4c26f21c387ee4c4bd64f11159bcb0303be6841fd8aca0bf951a6b9d77d8c6191d70197f6f417a58bb92e6f84ef68f
SSDEEP 192:nA7fvPNXn4CCXrbdmsFsEO7mRVMgKr+H6EfsghfWg67XL6Gge3WpPJZqgPXuB9ME:nA7vNXn4CIrbIsFsEOSRVMPr+HrfsghS
TLSH
T1ABF10D3406674083FB5B99F0E1F50D5675B380A024935EC63D3095FDE50EB52E9AA3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 8f102efd484835c861e470a4ae037c62255289ee0ee84402ea2897abd39e4335
MD5 36c58e682b22c15ae16baba94e2a5211
SHA1 7845ea87518dc6858ee901bed078869c8234aeab
SHA512 087d5ade50b59c3484e3bc191df1f5b73d666fd361ba6f7e6c61e3694e6e9ffd90a4c8fee240dc5470f5b68f6ea163a87386400feffd72890397451f480712c7
SSDEEP 192:aRf7fvPNXn4HCXnbEeMsEO7VnRBMiKk+x6EfsghMWZD7XL6Gge3WvPJuqgPXuB9b:aRf7vNXn4HInbPMsEOhnRBMpk+xrfsg0
TLSH
T123E10D3806970483FB5B99F0E1F50D56767380A024935EC63C3095FDE60EB92E9AB2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588ab7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588ab7.TMP
Size 3KB
SHA256 ab83210a4ed2e87f3b642b6cd42b0d4b67b6877398fee03dba1bfd61464699ac
MD5 fdbcfb4834829afa870e6779414b0c36
SHA1 d618893c9b87b29bff58b153a2649cbdc52b72f2
SHA512 b071deb4fce92e082b1e7bf47ec460e35d2800f35e5961c82151bf48739936ee94ad21ba8a7799df03435adfac1abcffdb630ca12f62c2cdb10af51a784adbcd
TLSH
T1C96183394B134883F32B06F0F4C2162A397381944AA79D463D54C9FD691DB27CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 3a66cabc687ae4b739c6b5e35c8e9c804a97121f9396709bc515b2eb56f90178
MD5 fb457bfe1edd5a3c07552fcef9df7f06
SHA1 48c3666a71e0eb33b95c1db82dba0bed3cca10c0
SHA512 b6f036c3a51f02d313cff31219c2ad59350d544d011ea59afca0d91cf2ad0e4262a790c67a7ccb88b3296733652a5126375ea95e63446d98bd7e224fd80f5a0b
SSDEEP 192:DR/BVT4cgmB3RThZQ7DuMTd7NkxQiMaE/uxBq/GRN57dF7Gcwx:DR/BVT4cgmB3RThZQ7DBTNNkxQiMaE/L
TLSH
T15E02ACF7C7D9822DC91152F4AB256F1BCE1D0915432C3C1A88E8AF5BA3F2871E15279E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 475aaf67de62ebf353860ab39ad3c2584735266a65ba5d26eed6fb27ccfecefc
MD5 114b578a848bf3a14c1e9171710daf0a
SHA1 ec50292bed46cd59aa733919fd46d08615bf58f1
SHA512 cf6de1a76e9b7d5b9ffb59e3ed567c414d7524e36edafd57252e1d88c9aefdb66e21d7a2fce54ce7460eb33a6f33f88aede76b453cf3e9e1566376c9ffe53748
SSDEEP 192:DR/BVT4cgmB3RTh1C0IQ7DuMTd7NkxQiMaE/uxBq/GU57dF7GcBNPRS4x6x:DR/BVT4cgmB3RTh1C0IQ7DBTNNkxQiMW
TLSH
T113228CF7C7D9822DC81152F4AB25AF1BCE1D0955432C3C1A88E8AF5BA3F2471E15279E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bbf48fcbfb89b3538ee6d35d068c1f8315fa7422d7fe8c669e98416d68da1e9f
MD5 eb9dcdd628f82e7b4b425627f8c49825
SHA1 33474b6b3cde550b33741d4aebb7256490fb18a4
SHA512 92b5de2b9e1aed8e53c5337fca8949c0e28328d8d9bc23c93cb1fb818d053e313ef3c3a079dc00770a731a66ee0badcf43ba0e950ed31a2bec7f5bda6bdd1a32
TLSH
T17A519BB7C3D5877E880156F0AA246E2BCD2D064A423C3C16C9E4EF5B63F24B1E10219F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2a63046f33a5aa66cbcd94bccf1ed29324fee8babfa414db871168086819f150
MD5 4056d2b14aba324822d583ae33e88d99
SHA1 5639d6425e726eb3a19061f223acf2201d564458
SHA512 2c5c97a9fd65d71cac84722117b5496e6fad905070a3acc875a1876819273c1cb11b9c3d4e892ba6b4cfff72e4f978b63b22e004f4e95272045d77ebb49bd23d
TLSH
T112D022332606B0B6AD6CBE8641AEAC8FC32610600AC2EDD520D4989C453246D160B244
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a5063.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a5063.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00965827d3f853beb1de566032f1e046b1737ad12c5a66c2a75b3817015f9760
MD5 f82ebd9c8552a228a2b093e671fb921f
SHA1 8158b2b81eaf9e5dd47cbd4be30b32dfa70aeeee
SHA512 b654e1bcbcea32dc29192152158695de5c3b9c60a35667a9d77290367ebaa2fc565ded8deeb2f78d4acf4a7eae90c9662756a8bc1f40f50807f6719e7029c70c
SSDEEP 192:sxZARcyM/jK1Ml8Mkv/fLsKnnbqIdpdrHW6+WNGYHj4kBYIgrJ:sxZAGMv/fLs8bjJHbGz9
TLSH
T1274209016B346977CCDFD209FA557F53D6F50472A2900E54A9FCDA1C05E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 44667256fce322b9df3c3ffc05105b7fec220d984c0875f8dcddcbd38c6a82ac
MD5 b75441cf9d59fd461c00604adc9446bb
SHA1 f9ed718a5e3f1c88152cf2379fe04a520cc77e2d
SHA512 92b59c593c25a76c998b4ffe415e045f0f3ae75093acc6e85dd3b02e7a1949e27b965720fb220009213af56d3ef2efc0b61e55de399f285415fb206ebe561996
SSDEEP 384:sxZtnfeqwm1v/fLs8sqxJHbig/3bXXnhPc2X:sFfhwm1v/fXsYHbNb+2X
TLSH
T17C82F85266208D77CCEBD519F9267F53E6F80462D9900E5CA9FCD91C04EAAFD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 dff0d67e7fac31be0201aa8807f3c4efa6f79925855ed3c5b8964a7bec1ddc3f
MD5 aada473f4778208f3117daf4c468b393
SHA1 eb4fcdf8676f0e802b90845bc7ce01ada842464d
SHA512 fd45dd503052f6735fb363c1bab01c207210638ba07dca96c02a494cbc1046d8f6b4d30ebc3c16494f1a5afd9edfa6af35f84db8c83e50790238ec42a7130168
SSDEEP 384:sxZtnfesm1v/fLs8sFxrHbig/3bXXnhPc2X:sFfXm1v/fXsjHbNb+2X
TLSH
T19382F85266208D77CCEBD619F9267F53D6F80462D9900E9CA9FCD91C04EA6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 86486dfdbcac876d2fbeb0e1c42651af213c6f003491dfe06252c3b2f100e0a7
MD5 5c13e78b244b677a06d8dd2f9a8f4ae0
SHA1 8dbdfeeb7737ee09eb21acf78b0305120a84bf55
SHA512 817eb206978c1231426222e878088febfbaa77ce4784494b116f54f78903baa4ee51abbe8362dc81bbcf05ab046c0552094d0b97a3751b7c1f7b7a247ef3b946
SSDEEP 192:sxZARcyM/jK1Ml8Myv/fLsKnnbqIdpdrHW6+WNGYHj4kBYIg5wJ:sxZAGav/fLs8bjJHbGzu
TLSH
T1DE420801AB346977CCDFD209FA467F53D6F50472A2900E54A9FCDA1C01E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 34KB
SHA256 a68c5d743d380845de6ede47ba9da5f834fd30c31b86f33b62f2959da65cbdb7
MD5 604bf5a2b2c5ff6ec17ff8732435a286
SHA1 6fa716d57bd73a1477cea26ea86419cec30c44fd
SHA512 601c29fca50737f87ac3cada328d09ff8f2bdcdada179e2fea32c04e1b22b30264a54c6b5a4eb7ab13c1e544829da8f721b9dabdd6bf339a51821c5a9cf58b9d
SSDEEP 384:sxZtnTeqwm4v/fLs8L66s8qMpRiYnazAW8pZS15posJWeT+4QSR+KFHb/o5qg/vv:sFThwm4v/fXL4Mnc7WeT+4QyHb/CD+2X
TLSH
T13FF219469520C877CED39D18A83D7E33DAAC00529A85CEDE59ECCA1C01DE5FD6B07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3451c9f0ac882d9ce918b7c1490756137c3017c33f603b8273e42c48d342470a
MD5 eb49e113e624f2b7137e730c1b2ec877
SHA1 270c4800c0038faf2ac6a58e88bf3bbe9185be41
SHA512 6af485cb49651fac2bc6be73dc6427b828171b6b8bae2544eef0eb8fe05d308cf0f3b706d695277a2468ca0a14335849077018ef31edcd99769107492520c81a
SSDEEP 192:sxZARcyM/jK1Ml8Myv/fLsKnnsqIdpdrHW6+WNGYHhJkBYIg5iJ:sxZAeav/fLs8sjJHbGIc
TLSH
T14452F851AA345D7BCCDBD20DFA567F53D6F50472A2900E54A9FCDA1C01E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 03f8fc0857f967737bd4cb2e0b8c6d23199579f00777df234aef6a5f7e098a32
MD5 dceb825c677d512c1191e09e02f19188
SHA1 72b7500d188587efd90d89206a2401ae290c11a6
SHA512 1b80ea0bd91605b23c68a1054016af7237a68f669d18e2813ed54c6ba5f5586fc762cd3aa310787fb85ee9cb41618ad46f2a2c86acefbb499cbd9647b0fe3d77
SSDEEP 768:ErUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RJroV00k:ErUZYTMWvg0Pou1ja7eLZmRiJk
TLSH
T161D20B2B280CCB7E4F844E5DEC2A6F967ED801CB5A984D5447EA884C03CB7EF512659B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\387120b6-5e9a-46d9-8f34-8370f23346b1\index-dir\the-real-index
Size 96B
SHA256 7a6d3931c83c6aac50dde7b2cb6922a715c891d0db788d59ff852224b69f6a19
MD5 32d4a1c8186dacddab71f9c4b958416f
SHA1 000d9eaf7f4eb2689fd91522b73a213e873e4548
SHA512 edd75150042163a67dd5f417c8d19c56100ade17fbbc79e2b3ed51b5fedb3dc9cf6d075f7c0798cfe624131c559c812ea4ac205ee241d0ca996acddbd7c9b778
TLSH
T164B0241531115153C03107F001C10DF333305C500307311113F15034F50434304071C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a89a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\387120b6-5e9a-46d9-8f34-8370f23346b1\index-dir\the-real-index~RFe5a89a4.TMP
Size 48B
SHA256 360e3307c975f685c62e5dc05c4eaa208bd61f52ffaccf64c5be6729680c9bee
MD5 9ce49a13f4b7de2d2608173b67cb0794
SHA1 c7aa69c7c23847110b4bc51ed80fefa1291bf5aa
SHA512 cefdec5a44a4733c4f3c9a751da4471a393e4201c6a64dbff6660e1b83490e5b2fd3ab9a741f5f56fbc61c02e8343f134842fde7c3c501c3d876b05551ebed0c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3fd05fbd-3e32-4e30-bd9a-0e5447caf720\index-dir\the-real-index
Size 72B
SHA256 f08fbd6a5774534f7ebaaf13672f2af052952e7e9ca133b916149abe4ca4f272
MD5 14764e1b2f8646adf8f4d993428cbdd5
SHA1 e5aa5eb44a5edc607922cf0c81f7356e9d112bfd
SHA512 7382748849571a57dd6b2f08ec95a6027efa54b838c3ab7d27c44e365dccea1e6e56115da8d2b25b39029a0822e82fbb0502d9ab0ad8638eeb1eaf7710135dfa
TLSH
T1BAA00220F584027AC6D08B7251A351E122214A1002171A42D2B7F574DB512986119802
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a89b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3fd05fbd-3e32-4e30-bd9a-0e5447caf720\index-dir\the-real-index~RFe5a89b3.TMP
Size 48B
SHA256 b181d026171fd923d00b5adeaaf969906c6862d6dcfdb078d711208492366441
MD5 871f56891508ed54dedeeddb0d63f0e6
SHA1 119e39868b58bb95b247a644ad0b4e81eff64214
SHA512 6bef8936af9fb761ff8988266a0f73b412511a06e030bb0378c747824996283bfe86855253e739068f90ffcc35452dab5193bbf7ce83a2740aaa475da0176d37
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 5a5979e038eb75a91391d8954b8ef3e76de44d6e243b9a776d6efcb40ce60562
MD5 5a61b1618397306378d9a76f8c9697db
SHA1 f37533cc558c8364601619e627b31a5057d06e89
SHA512 f76aca8aa8a5a964c655d18a7b64166c83bdbe4fae49487e371eceef96408a3f9b1729ebc8be4b818c8b5899de497ebf1173c872e177f22aaba3d11d7765b572
TLSH
T158A002218F804406C02215B175A303413310C8E05200734748A105D8FD557445D4141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 932cc7ccdc3d457a2b4abb116e2fe842f9cd6bfcc9eade7fa3f69b0bed14c12e
MD5 3a7b0eebd31ded63445564fa0a502c64
SHA1 8c03dd6dc76824e10cd7173656b2a1a0f5de2f18
SHA512 8a9812ca31cae31ace9ca8d75d3069339389eee1b4538f337cdead6d752be9a28d8b82704abe79947ea5043d744398f3ca8cca8ea1f6be4f6c56324d7383c905
TLSH
T10DA0022612C00119C10312F525AB0141229BDA5C1211230579A1C499D8A05464D6148C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 a34ee8d8ae077dd4debb5b62d5011be5590332a9d73ab665a2e1bb693714f977
MD5 62222c00074dd64bf2b4f8a70bad2ff6
SHA1 78b0f14284e3938784eabccd386f4b80a7db0916
SHA512 bf6fbf923f3d3e55d743eeafefcb01a18220cd33d0baa9daee5a187845e826c20db2f4a906dc2becd416d7e047a3ac31aaa52e162422d96617e54b6dbac7f0c7
TLSH
T1EB51B70E4D463A6AC9AC11732CFB18D437B564DE5648DE17A4DCA430BCC77292D2D216
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 235b5b44808ba024151a42edc7c4ae0ad623f8c33c376495677e20550fffc5da
MD5 53b8fe669482d1c007491dda82e2990a
SHA1 8ca3f814d2f216e21ab5b86a816bbe18739c8f97
SHA512 89a679bf5262135500ed65bebc2ae84f158c3be10a8fc606d61393653ea8719d91552a2082ae259e17ed9625039234be4be6e511f1cd399a70f31412fcd0a193
TLSH
T1FF51C74D0E609A5BECB841B215F364A437B0A8CD5A21DA236CEC2131ED8375E2D1B7AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fdde.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe59fdde.TMP
Size 2KB
SHA256 cde21e54b840ff648d23107db3f69bfab390bc3eb3df87a02114a4a036b41eb3
MD5 b1060ac975b2621ed7ac7f981023d1e7
SHA1 9de69b3a4074d8317c1434d892444e3cd6bce8b4
SHA512 d67c718c7a4a7345c97e749fd1da1f4164d9574b86f362b8e2740baf0c6e4da8ccf10c52c627530ab2935ca1105a43bf5bb7ba1397d24d8ff415e0df9d105b93
TLSH
T10D51B84A4D818639E89440B30DE378B8333A68008655BF5374BC5636AC9279E3E1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\index-dir\the-real-index
Size 72B
SHA256 c054967b2e6d0bfe59500c4f7929898997a15b2689082ab7ef70881f9d1bc78d
MD5 5f488905de64418a1ed608be0ce2bd67
SHA1 4f9a625677a66db53b6435b17a8372a6f664a890
SHA512 81eb7e4f8e02ea0225224c09f12334a4296d24f819d6feffd558116e17b6f577e38ec011f5e84289eab4e4905eb5a69a41a3a9fca1fcd5b4ef97e170c1a75904
TLSH
T1F7A0023121958041C001AEF1E153339033549C1A8113C70B50A6045BCEE559C47011E4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 65d31e3ede96f572188be250d540bd4687bfc8d9d42e1a07f5316410e947aa40
MD5 be7ca0610cfaae1a5786cf4a756c8dab
SHA1 d484102b53b57328982c789eea2226a869f9d23b
SHA512 70d31f1fbfbd8e4829c44a82c91029a90d81c4c0ae0fa2592fba55d155564b7f175850c34468744b909862fb9c91bd4e57ce0d63e8d27add43b592bdfa7e28ce
TLSH
T1B8F028F37FFB1914BCBFC7D5547164A406127CA8C548ED8E0556B15650B23552059CB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 67193d96512b09b206146ed6a7beff666a8972060d0191edc82199d70adc23b3
MD5 01f15706af5bc37fbdbfefb77433bd1a
SHA1 940e1a62ed2a592c5a21f3629aba4526956196aa
SHA512 76f3020dd33a763b0dd634e9b6aaebdbee2b9829f9808b67213aab416d6960f515052a41a9b5fdbcb400cd0f90b16b846b61428c02258c7dafd835dc9a848388
TLSH
T1CEF052F37FFB2824BC6FC7E684B0A8A841227C68C54CAD8E01A7B19220B33112449D73
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 fca8208347c04316bec8df1572ea6a91f951980adc1189403e4e18d24dcd9c2b
MD5 0b318378ed66c153586fcfc2d140f95a
SHA1 d7138e3098367009adde58f4eae45815fa3f864f
SHA512 8792ffdd53e21e12621e645ff948f7e8b799ebd275cf980f1b427de27d164454b9f7e32c5490c679c6a17eeec44a5521862ef591768e54c040fe39d7cf77de57
TLSH
T18BF028F37FFB2914BCBFC7D65475A8A405117C688549ED4E0156B19650B2315205DCB3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 856a9072151bf490cf3aa4ea8f1a117cb55e6aa7c303555af95c9f3095e71231
MD5 9e2e6faf4de45b0dcacae989039e7938
SHA1 39be111a1570e76bdff781e0e71f7a1b3db47fa1
SHA512 3210faa3acd9982a2bdd2f9ed209bb4d9beb94296fb3cc6f1bf6ec1f2d5548006756c97ed607014e17542efbb77f703650d4c145c20ddb2715b5e7c5283b49c4
TLSH
T171A00221CD549051C0950370AA7181887ED19DB88B05371556BD015CC9792608596144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a50e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a50e0.TMP
Size 48B
SHA256 8ac16e49c4020a5391ff0de06f427a45dc1e407fb359745472beb0877238d7a7
MD5 63392f84d8506988b2bc5b852383cfd9
SHA1 d77f94202e404704f16bbf598513eb0a3d9052da
SHA512 0800962eb9933e7e2ad909987cb24b89b2ab43e2f922fa45f4a989aa7ed21e062b94cdb3cd9e2cb8fcaea743aea6bab313dbbc581c4d935f4e8cd707e18946ec
MD5 SHA1 SHA512

Submit Download

0ee341710841e26a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\0ee341710841e26a_0
Size 191KB
SHA256 a43ecc236d138f1d90211b0f97b8a0d892b57fb2b68925370dc9ee0897c4b359
MD5 e4103dafacf9ecee3441f40238474f04
SHA1 2939a98db21650ed417351a5c5d618e78e512c91
SHA512 f3e69240b34eaf441af23d305e09a8f2c6b814e9fe352d904831a2145b4a2bb71fe2be8f37b7311968edaa7dd13c55a0d6e110b9caa38c671a128a6303ef0226
SSDEEP 1536:+o/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:HSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T129146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6dc330a894addceb5a1bd22ea2ea7562e21d69074096524516ea8d9f2deb933d
MD5 bdd96b3fc7a9e16e2c54ac4f2fa9d63e
SHA1 25e21dd36ea14e5e7475dfead0ab458a949c9eb6
SHA512 806eea2ecbfd04e8456f25e71a9435f042adf75215d755198da5cf28a755ad47f32f00f489454694a2a0f67dd76b69725e4fc72e8c8ce6cb3cc234eca7bc8ddf
TLSH
T134A002A003C10D42EC0023F055E543842718D9515131931355F59148DFB36845A2E504
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 af206b753c35ee33682e8fa766d411263575e5505d22ba75361ee2c6af260b76
MD5 2a7ac472530517acf2a2cde25d1394a8
SHA1 e1b8183ef06f1939cd9edc8d31cd9b0bee471870
SHA512 28eeddaa57ce6d8aaf8f18ea9649798ec3cdfe9cd6fdbf2484a7df61e41689884ab49f7bb1fc5719d9b51fd10f8e8667f5ee06ff66a44fa04694c9fde8dc8591
SSDEEP 96:KA1eK2AUkQKJW6+DuKY033yKUAyGbOKUok:E2bppRdt
TLSH
T1ACD1184A70BA52413C7E2A489254971B8FC271633228B42B7FAD01B29D67D21DEFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592699.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592699.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3a3e3e73d95aea51662c1c9eb03068532019e11ba8c7aad0cbed111a89a30a38
MD5 985f16b487b732377579150526232ee9
SHA1 712449c517bf5210f78374d75436dbe271a910ee
SHA512 1ae68082846789ad24b3aa95d3281d8977ae5b36d66d70f02b513ee58c1df537bddba9002c3358255fc7a4f5f350affceb78e939b59a50d6cb0db0de81432028
SSDEEP 192:uuLsN0sQCJt+ZUdQmiU1Hnw4zX5Obd+jqjzorvmsX8ySJrS4QZEcqwU8:1sN0svzbB/zX5od+685X8tJr+ZESU8
TLSH
T11B320931A928AC675EE3F185F44B32139FA85567DB842F94C2ED1F1C01DB6AC131B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 192adf6d8eac12bcf68632578b3b9a6b78fa3007bec463a5ef32df055a13b8fc
MD5 e966ba5edb25935a1ce4529cca084259
SHA1 bdbd212f1255204839d1ba4f501072ad2f0ae1bc
SHA512 03204aaeef0f25b6c2b4c9bdd01d55db789b955d53ded5058881d9cb4cbac6d6296d4cf0b14041e2a34d40571fbe311fdf2d22a6accb14a2c92369f519bd5960
SSDEEP 192:yONo61VWQmiUyG/gGX5Obd+jqjzorvmk/aZ43FOgU6:yONo6WzgGX5od+68UZeOgU6
TLSH
T12D02D835A8687C6B8EE3BE49B44736135FA92177EA542F84D6EC1B1C00D769C2316C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5934bdfacc8e2296bf4f68c80240001f98354b6be9a2adeba396837a5f07ae57
MD5 00d04fb20953306952d149b03a2d0eca
SHA1 8fb3b8399ff573c1b75917cf9e4e51cec63432df
SHA512 b1d7391c77e895fff08ff806e0c843b33e9d3e96f21c21b031d29f89b9f47a21ac3a7dc89df2fafc42a8ce1e886c512d4501310e0e53ee9a06e17c61d4f65313
SSDEEP 384:mZcIlsN0MvzbB/zX5od+685X8tJr+ZES6HlytEDq1H:0lITO0Gh+Zdoy6DqN
TLSH
T154927C3155346C365EA7F185F48B36038EF89427EBC46FD892ED6B2C01DA6A8131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b4f484a29b7c6e13b7a259ab19e61f60de1a7c1c23f381a73451c1fe085c5377
MD5 44680386949931d3b5024ae7cc6f961f
SHA1 566a565e82edc4b0056f5fe18bf03093da741445
SHA512 2abd6ca5482d58d6ac204e47ab4f4710b8bc5943788d08677835ed0b376ba81854de40d7d81cb2d2340c3d4df468f64b0319cab48e878de5c7f91724564233af
SSDEEP 384:jZcIlsN0NvzbB/zX5od+685X8tJr+ZES6HlytEDq1H:7lDTO0Gh+Zdoy6DqN
TLSH
T1B7927C3155346C375EE7F185F48B36038EF89417EBC46FD492ED6B2C01DA6A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e7d2bedaffaf71dd70a7fdc102890de283f08d91a607e8c6792b4a17831fb9f2
MD5 efb42e67729880bf21880c2d3b805a00
SHA1 55a6688c0b8470ece314265cab700176007d96dd
SHA512 90afee93a831ea8c69ff5343f7cd3fcea6b7eab5ee6a21a2ef74f652a3929629a59cbe6edcf3a63086f02a0f61974b5f43c4bec1a57b72e62874b8ab55a6c7ee
SSDEEP 384:aiFJZcIJ+sNA8TUNTUlIRsTmCGrzX5od+685X8tJrMZES6HlytEDq1H:RFBURwg1vO0GhMZdoy6DqN
TLSH
T10BB26C3299649D3BAEFBA645F48F31038FF45067DAD4AED493ED5A2C01D61E8130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 4daf8aab48d2997102fe9c7398bb14e18daf2e816fcb3bfd41039714ae670ef0
MD5 5d23b8b138a8806e9e9778c02b399a12
SHA1 89766a001b190cb1608265178120e63c727e1a83
SHA512 1896b2d13f8ad76c3c40c4d83ac0eb761596d3ea29658829a46b183cc833e2f5ee292c852ef45c2073d8acb12c85bcbba8d4eadffded2ee34c7e1fc7a688b060
SSDEEP 384:aiFPZcIJtsNf8TUNTUlIlsT1PqA2zX5od+685X8tJrMZES6HlytEDq1H:RFHDkwg9AqO0GhMZdoy6DqN
TLSH
T1A5B25C3295649D3BAEBBA684F84F31038FF45067DAD4AED4A3ED5E2C01D61E8134BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21afb706ae6f752f3f6c11bcb0463b630b374310c64fb1bdad96e32e137e3937
MD5 152ccae99f2bf24b76dbe643311e4738
SHA1 d16877c8e9a8e1627ee2379ac87e3bb003c3f389
SHA512 4dd409646b191d558eee64a86859b24e8c4d69c92b993d2aeb2e742eb3948ec25506cab3200395b2089d49c5af4f8fec4dbb87e6e85ce694037d55676e342029
SSDEEP 192:XONd61lWQmiUyZ/dGX5Obd+jqjzorvmsX8ySJrejJZEcqwU6:XONd6CqdGX5od+685X8tJraZESU6
TLSH
T12112F9326468BC6B5DE2F585F48B31139FA85127DB497F94D2EC2B1C01DB6AC231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5e6d0aa06d8638b62d92e87d4f836b2d1e7d3ef2835542392366316ce994f6a9
MD5 7da17391b187493a44a038dc30a2372f
SHA1 39259ef3b7fd9b0acf2123a82dda90549302a180
SHA512 e9388c7758d9ce955bd80caa4a6b021f13a5534d11fcb839e2e2798eb31061cccee3021a395aa2b50fb1825d4376242d547320a33e7ae48b023a01c10deaf728
SSDEEP 384:aiFuZcIJPsN88TUNTUlIlNvzbB/zX5od+685X8tJr8ZES6HlytEDq1H:RFMdVwgBTO0Gh8Zdoy6DqN
TLSH
T123B26D3255649D3BAEB7A685F88F31038FF45067DAD4AED493ED5E2C01D61E8130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 82a8752a922dddb9cbe60cd0efc11f1e55e8a03e4e012ebeb2ed4afb45878750
MD5 de0dd0a3aa7ad8d078a9ebb59cc75078
SHA1 de1cae2020f1b656ac880b88e74b457d7fa1dc02
SHA512 5fe4f82240e5ff195d9cb9ba417ed21c0705a42d3232650778e265fb3fc30bcd8ac1f6d30839c101e8fa1242291158300e872b4380b125284918828b0c22bf67
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d5e6e723d1e50236d42252bc5b7b6c5833236ecbeb481e506b808010a9c85623
MD5 4c837d7c73a2376a285d32f212a2a51b
SHA1 29866148e134c0a793530ef4bb10135fd6456ffe
SHA512 93033bf41750d810ead1aa29e4ca03691462a4ea5b5c3ece4e20c9e1f083b6a9ec9ee79e934ad22ed1205967d421d4cf188b74a2ecfbe0213e24b2b55d4557ad
TLSH
T149E00192D30200BBC06C037140CB2A243BF1E02017E7870B652452BC3C233003E30E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c6c5c594a0f9ec5909c12eb8c5d86a2cb6048ed43293035fc26d010d48fb6c0
MD5 bec33b657dd091c9745b2f11fbef6bd1
SHA1 453a8fc39f7ea36d9e7782e43f5f6d692824854d
SHA512 1d2c522c6fa1d9240f9ee715468e52231cbde0867ffe16ba1f9256854af1761d14c6f2585dd62ec981255d619df134c049b46737fc1eefe8027889d9d24df892
TLSH
T1BAE00252D30200BBD02C0370008B1B243BF2D02117F28307553052BC3C233002D30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ae058184fb5f0d4280ac7f5826d427402968acb0339c9e9b6d2d7105ffbe292d
MD5 203147b26fcfe328688a3bcf097a86b5
SHA1 9cb008ac410c4f8482cf738bd9cd50cb61e3ac85
SHA512 d1769580464b325d5d52af3658714d17e48d6426af04b4e6c397ce1b71728e61090fedfdf24e03367f8a80dd52ef64c9632ab9fe763b8295b4730af86f73f434
TLSH
T17AE00492930201BBC06C037100CB2F643BB1D02017E68B4B667052BC3C323003E38E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ac2c1f09931ec3eeaf7eb1a386acff4a89500bbf57c91cacf403d0d056e3480d
MD5 a8b2d1ff999da59090b4b68393a8b87e
SHA1 9e4c443c6a044900464068273e963ebd1ff832f4
SHA512 7a30bb28c671393f1a4f2ff7c62d8e12fa86d66baf4a2dcefe6db5d3030ed28b3ff57589353c9804b9ce4360a7082e425b72c8bec92741d1aec2f92f0641211d
TLSH
T127E00992D30200BBC06C0371408B2F243FF1E02017E6870B673452BC3C323003E30A40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a1ce0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1ce0.TMP
Size 392B
SHA256 d7f536a6964a4ba8d3d1210e1f79bc0b2827441e6f55dcaf52004a96abf71146
MD5 168070dc655bc19df85e76c1b62a9804
SHA1 eb795c70089209c29f48a155f21c228936d8af61
SHA512 c4d34b17d19e6190dea3bd57e2a9cef46e58e138e2c43b6a7bf03a4923c0af7c5308518a071bd0a4ad7e16ed24f6abcfba43e242d9ca9418dc85b9b929309962
MD5 SHA1 SHA512

Submit Download

79233536-b415-473b-91ef-fe0133ca6d2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\79233536-b415-473b-91ef-fe0133ca6d2e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 83d612ffc66708b3e89a661acfa72be6ea2343efa47f76bfb85be989ebf54926
MD5 3e78afab5969f838333cf6edb6903c64
SHA1 1ea2fc14d696237490b679e66008d465e26bc727
SHA512 80bf338618ecd7b868425f7fc0051432b7358cf89f68ac346f81b8b448211cc45d6f7d7eb7ff3b231501860670d949eb7ccbdc001558e909c0471b001b376857
TLSH
T154414A9CA6FE1048B3B37E4A9BF6A85D447BB9731F0AD09D10110D4E0A26B40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

invoice6204855761473867505.pdf

Path C:\Users\Admin\Downloads\invoice6204855761473867505.pdf
Size 78KB
SHA256 eb028837c35e3a2dacbe8778d7b080de7bfdc0b28730a75b024bfba36863a709
MD5 b3a0ec13e1a6d71207f0f894708bf046
SHA1 980f868936efb96b42ce72229c86ffdf950de334
SHA512 7952b27c34d605f0ad84b7d168a18c149921340e1c174cc8f246000b4fdabf25351aa390f87bb5a12b91faef6916042a91495242289618aa1fd85675549ade2b
SSDEEP 1536:giLKAamE1V+m8Amgp8J85iFlZawFi0S1t9ulaMUSsnE9NEgmsuA9htqFmG:dKAZELBmQ8J8m7aGKMbUSsnE9NwtA9hc
TLSH
T1B573D038C634C589F8D712747D2A7C8A4BDF78B282C6B6F11C2A87921A44E7C6441EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download