hxxps://cinga[.]ngapp[.]online/?clickid=91197263565&cid=9961&tag=@@TAG@@&dkw=tokullectibles[.]shop&pid=249699&yid=opdf&cachecode=9bKWE8tc4FB%2FBW9sSQ7vug%3D%3D&rhi=bfbe5fdf-064e-411f-89c3-195c162df4ef

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cinga.ngapp.online/?clickid=91197263565&cid=9961&tag=@@TAG@@&dkw=tokullectibles.shop&pid=249699&yid=opdf&cachecode=9bKWE8tc4FB%2FBW9sSQ7vug%3D%3D&rhi=bfbe5fdf-064e-411f-89c3-195c162df4ef
Sample260802-tc7hcawdka

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3108	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301597597356690"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\〘｜別退ڴ\ = "msix_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\msix_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\msix_auto_file\shell\Read\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\msix_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.msix\ = "msix_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\msix_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{7FD3C70B-9149-4820-ABDB-EE4AFA8EBF12}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\⎺훱멘먮	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.msix	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\⎺훱멘먮\ = "msix_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\〘｜別退ڴ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\msix_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5212	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1572	OpenWith.exe
5136	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5212	OpenWith.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe
2668	AcroRd32.exe
5568	AcroRd32.exe
5568	AcroRd32.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4776	3744	msedge.exe	86
PID 3744 wrote to memory of 3108	3744	msedge.exe	87
PID 3744 wrote to memory of 4324	3744	msedge.exe	88
PID 3744 wrote to memory of 4324	3744	msedge.exe	88
PID 3744 wrote to memory of 4324	3744	msedge.exe	88
PID 3744 wrote to memory of 4996	3744	msedge.exe	89
PID 3744 wrote to memory of 4996	3744	msedge.exe	89
PID 3744 wrote to memory of 4160	3744	msedge.exe	91
PID 3744 wrote to memory of 4160	3744	msedge.exe	91
PID 3744 wrote to memory of 4160	3744	msedge.exe	91
PID 3744 wrote to memory of 1664	3744	msedge.exe	92
PID 3744 wrote to memory of 1664	3744	msedge.exe	92
PID 3744 wrote to memory of 1664	3744	msedge.exe	92
PID 3744 wrote to memory of 3332	3744	msedge.exe	93
PID 3744 wrote to memory of 4496	3744	msedge.exe	94
PID 3744 wrote to memory of 3332	3744	msedge.exe	93
PID 3744 wrote to memory of 3332	3744	msedge.exe	93
PID 3744 wrote to memory of 4496	3744	msedge.exe	94
PID 3744 wrote to memory of 4496	3744	msedge.exe	94
PID 3744 wrote to memory of 1104	3744	msedge.exe	99
PID 3744 wrote to memory of 1104	3744	msedge.exe	99
PID 3744 wrote to memory of 1104	3744	msedge.exe	99
PID 3744 wrote to memory of 3608	3744	msedge.exe	100
PID 3744 wrote to memory of 1592	3744	msedge.exe	101
PID 3744 wrote to memory of 3608	3744	msedge.exe	100
PID 3744 wrote to memory of 1592	3744	msedge.exe	101
PID 3744 wrote to memory of 1672	3744	msedge.exe	103
PID 3744 wrote to memory of 3092	3744	msedge.exe	111
PID 3744 wrote to memory of 764	3744	msedge.exe	112
PID 3744 wrote to memory of 1000	3744	msedge.exe	113
PID 3744 wrote to memory of 2948	3744	msedge.exe	121
PID 3744 wrote to memory of 3240	3744	msedge.exe	120
PID 3744 wrote to memory of 2948	3744	msedge.exe	121
PID 3744 wrote to memory of 2948	3744	msedge.exe	121
PID 3744 wrote to memory of 3240	3744	msedge.exe	120
PID 3744 wrote to memory of 4416	3744	msedge.exe	122
PID 3744 wrote to memory of 1544	3744	msedge.exe	124
PID 3744 wrote to memory of 1544	3744	msedge.exe	124
PID 3744 wrote to memory of 5328	3744	msedge.exe	128
PID 3744 wrote to memory of 5328	3744	msedge.exe	128
PID 5212 wrote to memory of 5568	5212	OpenWith.exe	129
PID 5568 wrote to memory of 5988	5568	AcroRd32.exe	133
PID 5988 wrote to memory of 5208	5988	RdrCEF.exe	134
PID 5988 wrote to memory of 5280	5988	RdrCEF.exe	135
PID 5988 wrote to memory of 5280	5988	RdrCEF.exe	135
PID 5988 wrote to memory of 5368	5988	RdrCEF.exe	137
PID 5988 wrote to memory of 5460	5988	RdrCEF.exe	138
PID 5988 wrote to memory of 5268	5988	RdrCEF.exe	139
PID 3744 wrote to memory of 5508	3744	msedge.exe	140
PID 3744 wrote to memory of 5508	3744	msedge.exe	140
PID 3744 wrote to memory of 5508	3744	msedge.exe	140
PID 3744 wrote to memory of 3268	3744	msedge.exe	141
PID 3744 wrote to memory of 3268	3744	msedge.exe	141
PID 3744 wrote to memory of 3268	3744	msedge.exe	141
PID 3744 wrote to memory of 4652	3744	msedge.exe	142
PID 3744 wrote to memory of 4536	3744	msedge.exe	147
PID 3744 wrote to memory of 1592	3744	msedge.exe	149
PID 3744 wrote to memory of 1592	3744	msedge.exe	149
PID 3744 wrote to memory of 1592	3744	msedge.exe	149
PID 3744 wrote to memory of 1712	3744	msedge.exe	150

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cinga.ngapp.online/?clickid=91197263565&cid=9961&tag=@@TAG@@&dkw=tokullectibles.shop&pid=249699&yid=opdf&cachecode=9bKWE8tc4FB%2FBW9sSQ7vug%3D%3D&rhi=bfbe5fdf-064e-411f-89c3-195c162df4ef
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,13298389364008417518,5985372622801130645,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,4366579591958012133,4580462391855829831,262144 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,1605629302040844126,10084270451931883943,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,8715132134165420720,940296808457014501,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,14963238747927744177,11395057568614732561,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,6245582949834063719,2600599715362477769,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,3384806457899016620,7181148319646590868,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5144,i,16152062126705032181,17063415252754225361,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,202655084599765134,17427865534852840004,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,14160713568371065327,7991356156715514787,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,2687272811445351634,3904875382046293721,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,2687272811445351634,3904875382046293721,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,5837698987344276784,15413457457077102266,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,9886050273154954880,13646122358038487840,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,3039932931330020719,12415322013645460435,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,5338015536722772021,1533514789299741538,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5572,i,6053299047116240997,7369994725429278880,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,7409259888940590366,16012435615623136882,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,2380890613031547691,11358007055463389449,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,2517143309619987162,13047830210208203734,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5372,i,5687873767463625346,18444761041244064949,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4416,i,11897335790522720886,16233878044414875881,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,12946691038839491893,17123093790641237736,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5768,i,3978318435011517988,18371081733709538924,262144 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5252,i,7810274061708701656,14725095083169597274,2097152 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,15499832860066330431,18275509122803664124,524288 --field-trial-handle=2288,i,1198845834262393265,14233095387265185901,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\NetGuard.msix"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6E6B46D331ED9C329D841261C58A3FCC --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=626BB51D6E8CF551D17F8E0BF86932BD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=626BB51D6E8CF551D17F8E0BF86932BD --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5280
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F831B79145B2F0141F5C16D93CCC7FC2 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5368
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BD52ED65E16E24029B9B4FD608A3C241 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DC88800C53477B6A516B4492FE11FCC8 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5268
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4B873C50D51D17E9E563C5D406CAD89F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4B873C50D51D17E9E563C5D406CAD89F --renderer-client-id=8 --mojo-platform-channel-handle=1328 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3120

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\NetGuard (1).msix"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 88b16d3840dc1dc65205285943eab8668887984c4333d1f2b353b948b778ff2c
MD5 42c96a13171d9e6ad6fe7993cbd5bb44
SHA1 cb6a4734a53456b81ac15fea372389c35b8569ad
SHA512 c611a3b3cf2043d2c5ff63619a7e27ff0ef29a0d5d7430320aa5964efbdcdffe8246ee821e2b68aabfd3578561207a1f6e8e32a92f2317dbd2c0c4863d10aed3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 8877e266736eef7a45f6169c23ce6d6430af490a6bd46bf68fed5f1758630648
MD5 7e6edf72a3b0278c091410aa4556f73f
SHA1 ff70398ce542702a58af840eb362afa4270039ae
SHA512 edd60857208a4a077a1c9d8eca26517477bb4049589139eb79fa6840fe8f79a5e57c730ac7b7ac109ceb9f9bdfafcfe6fce3d420a579667fc9dfde46585f691a
TLSH
T134E0DF5C1693C7A90B0398C7E0AEBF5CC1E07105EECCD9EE7747EAC824454145285DA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fe0f8596599bd17d8d73087a9a50c6244cd5eb8dfa8177301c7683f405374817
MD5 04ec5841cc101b137b3d0f844efa1f09
SHA1 31f5a549d8501f1608ac30dfee1dbb217018d225
SHA512 1dd508461cd9165f81ea9f405c23389c18ef93a4295693d3066aa4db6c6d1c36fea51bedcc1de1fdf26fc2ff36a335f05215b9a45f8c8540096aded311b45a95
TLSH
T16971605A07C240FDD73013B8D5E00D013572CBAE26CBBC9152A599FF7D167634D6D526
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db57.TMP
Size 3KB
SHA256 1be4c16e0c22bfdb6e4f506b30210daa38d9d71f2cf5980d212008cb40dc0ec8
MD5 4e890cb4e02ec8ee572e7038a30d7c89
SHA1 6d6cc945ec7c8eebabead87ff52aeb36432abd86
SHA512 4c7c7632e849c47fdcbeaed2cf29fb477b3f9e3c919cb4ef7240eaddde11cb59cab756e5513f2989c0f9b0bffb3b495264d34e799e1e1989707b519f2ed3c426
TLSH
T123615F5A07C240FDEB301378D5E00D013571CFBA2ACBBD9452A498FF7D16B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 174cfde6394c53e49f666fdbe2e6f90ad971651495d315d5cccd40ce34abd914
MD5 baafdb3cd50f6a7ae2e58aa8cc1a0380
SHA1 7e205a143a7232f68d28c5cb3fcce9896ee62339
SHA512 40c364bf3807a5702e9b9f4ddcf747cb09f0799b2a2e96c7c0af475b52a01e34dbb94837ace5f0f4508425cd21a714244bf44d6c1ce808b89d4e473279d597ca
SSDEEP 192:D7ckk+lDgggDJls/pEYifjxpJSQfcG+6HiLVGvlPl:D7ckk+lDgggDJls/pEYifjxpJSQfcGLN
TLSH
T187E18EF3C3D48A6EDD3112F076146E6FDD2D0A1847183D2AC9D5AF5BA7D14B0D10265E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4fc25b586fb1649b90e5821d6c3cd56f32664eb9b623f3d0b6051583e9de256f
MD5 cd64e005d696d8b2f0d5548d8472776f
SHA1 fecd96213bbd6a290c9968651b20ae66dcb1ca80
SHA512 bc78142bbc2a3607bcc4c3e8264136aea7ca33e3559b78461a9dced872a2616c25123927f9166e807f9e9875e186d3de2b94a12665406ff64eba55e34380aa76
SSDEEP 192:sxZrNZyM/jK1Ml8M9cJ/fLs5XwsIdpi1HW6+WNDHTFYwW2AtsIg5aJ:sxZrH1cJ/fLs5Xw1uHbHFrs
TLSH
T17152D711AB34A977CCDBD20DBA41BF53D6F9056292940E54AAFCDA1C05E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 176e4340b7a5c6f07f3c55e750240d36c58a7387d9922bd5a14ededd1a059d06
MD5 afcf15372811e271d5c9fae1e69e497a
SHA1 14a3d09087257844f274f3de83dd5e3a92b16180
SHA512 4afd1a0c62d73922c9edf52ec8d2b4ef67abeea10a74bcc37f7498129a373ba791b460890636506c7dc09c26e120fdac72fcfeb1e7e3122342b306aa25bdbfdd
SSDEEP 192:sxZrNZyM/jK1Ml8UQv9cJ/fLs5XwsIdpi1HW6+WNDiGtYw7LtsIg5aJ:sxZrHqlcJ/fLs5Xw1uHbjt4s
TLSH
T17052E811A634AA77CCDBD20DBA51BF53D6F9447292940E44AAFCDA1C05E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 68d1666f725d8de17eb8827ea1e01829bf4f43524868abd7f6ad7643f94eb00d
MD5 f8f562cf5ae89fe66644e7b7bcae7ad1
SHA1 2674f89a1031b2376ed1abaf8b47907dd6dd4e8c
SHA512 29c2b7d9e30c8a67f863b91a7cc38bc089589491ff6506b0956abe7a3a51ff9f373121e90c40d592aa5cce6c8b6df06d89e84140f11a33d534c1c9330c53657a
SSDEEP 192:sxZURZyM/jK1Ml8MkcJ/fLs5nwsIdpg1HW6+WNDA5/YwgDtsIgrJ:sxZU7McJ/fLs5nw1cHbU//9
TLSH
T17B42F8116B34A97BCCDBD209BA45BF53D6F9056292940E54AAFCDA1C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27303677622c8cc3c9c0140e8402681e5662c5971ba7267edd72d16905282125
MD5 a118bf2ca9bb60b54d9f712be03f76a5
SHA1 805a89b5f50393f272eaef8fe3c5c955db08688c
SHA512 51376da0b15f078aef9be54b17dded4200949aecd82f0fda66de59506ec5c9c637f55adf237a9ce48f7b91e57b60882a17e31d1e7e8eb4c9eee64acacb00a2c0
SSDEEP 192:sxZURZyM/jK1Ml8M9cJ/fLs5XwsIdpi1HW6+WNDx9dYwrQtsIg5aJ:sxZU71cJ/fLs5Xw1uHbfdps
TLSH
T1CA52E811AB34A977CCDBD20DBA41BF53D6F9447292940E54AAFCDA1C05E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d79065b1b75617577b24465633c584b0ba3f7ec05d2f32cee8f98294496e178d
MD5 cbaac43f21e5fa01d91dd3516b0af486
SHA1 265304777431ddb41f2937f0ab64508a31135682
SHA512 5b556af9d78139651176f15df58b58f92be2f3ff131b8e80bb7b1902767a6ba9bb0167bad183b3dd7758b8b5f623e19313e9fb009d1d1422ce7211fa92a4a652
SSDEEP 768:Mp4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dbroh2c6az:Mp4jeXmWvmKLEu1jacPLZQdob9
TLSH
T1A7D2093B284CCB7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3157e2c787bafad8dd270017c76460462300c2ce6be83bbb05aa7f17e500e9e5
MD5 a2af84ef2217c4d3149b6f8ebedde8bc
SHA1 98e3f334be9e7e1e34e49d95dd061b2ca65c4b70
SHA512 6d2e68ad08398675e7bd72a5646e62e14a7e355b7e0d56e97efe03459085a278fce4017924459a39fcab82032bf1e84c85d2e46b594c05d93ec0afd0f85e0e24
SSDEEP 48:K8mIfKji0vyWmTKGQ44+GItlInm+KYLA0+suu1FkV1I5K2U0Tyd:K8mQKjiWe9eKmwp1SK2UiC
TLSH
T11091450171BB53016C3F2B1C85658A6EAA81B663357C652BBBEC04720E66F508EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5954fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5954fc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aae38377ae6d6a22f2e4c8e4c393f1d9b1adfdc8369586c1399eaf923631e901
MD5 5ee2b160f750a61b5efe222d19b67b22
SHA1 02b060467b5f77218e659fcf5548dd2624bcdeb2
SHA512 4158b56b9c59dffc9a33439bff877b69e62dbeb8dd2b0ad87af44681dfbb100f15ab4729bac2107d546202f81db5432a2f0f11f5a5a745e25309937b98ccbaf5
SSDEEP 384:aiFPZcIImsNA8TUNTUlIl7ozeU6inf+g8GYZX4+2fWF6ZnTKwBODNZOCc50:RFHZ7wgyzeUfU4lg6ZnewBKZOr0
TLSH
T120D219F248DB9836DD9EA707A77E2D034DBCC063B5946A94B3985A1CCC561BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 182281ebb13b868793fd594e2a26c29f2e5dae3913318342b0b85dc6795e808b
MD5 d906d2c1dc4793984b4598bc077841e4
SHA1 ae5a2dd2b498da6f8ae94c46d53d703f0bf67b71
SHA512 f9f9ce80f6c70e29bfb4afa28a34cf079e2ba0ccff19328fbbf64c7d59ceae424e5d2e584bce60bf69a297c4764fc1d278aa381178c1f4982458fb1ec535d704
SSDEEP 384:aiFNZcIIasNA8TUNTUlIl7ozeUlinf+g8GYZX4+2fWF6ZnTKwBODNZOCc50:RFVx7wgyzeRfU4lg6ZnewBKZOr0
TLSH
T1F7D218F248DB9836DD9EA707A77E2D038DBCC163B5946A94B3985A0CCC561BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1341fb13f16dacca47f0e5b7ed82cef59c1dce209eadd164d3c288f9d764e122
MD5 0d8a6d0aa81c3ca7d5362fbfa25db6c6
SHA1 8df3ba690acdc0f52271e07209ce6cd3a6174c34
SHA512 89af9253c9cb50c382088300fe4122ade98596b24da7a76065c02d8e3dbe850c6d62056ac6d8e8680c26fe5ecdf6a9578f7bcb143e060d9e2b529629f539a81f
SSDEEP 384:aiF0ZcIImsND8TUNTUlIl7ozeUTinf+g8GYZX4+2fJF6ZnTKwBODNZOCc50:RFyZCwgyzeLfU4lb6ZnewBKZOr0
TLSH
T155D218F248DB9836DD9EA707A73E2D038DBCC063B5946A94B3985A1CCC561BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ffaea81a108a77cc5b0b9702b72eb02d6aa4ecffc0c3afa5247cc676caecb126
MD5 7f2a6518b2a8ffd8d37081d6d072da2e
SHA1 7598ecec78f66f507d686429ba4b16d59f540e43
SHA512 88bb4a8cc5f2c25e7c1240e6aa98b8b98a65048dd545b22ac47d7e3ee4988c27737525be4fc0c2b2b0d762b5b3b5cf333eeb71a9189d9173c2fbf1b251f8d916
SSDEEP 384:8ZcIhsNx8ozeU7inf+g8GYZX4+2f1F6ZnTKwBODNZOCc50:qh8zeHfU4lX6ZnewBKZOr0
TLSH
T11D928F715D3CAC779DD2B245F44B22174EF89167E6D42F98E6ED6F1C00A96AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 90feb64fe8652504d2293cf45cff380cdcc8d9ccd5727cce597056d9b40c4e22
MD5 db98bc55eba5bb55c553e2aff8a8b80d
SHA1 a6b56e0fbca8dd66fcd85191810197f234ae782b
SHA512 4b754f635701d5489f12e04e439bac3d26d47aa1e4efbc037500796f0e0b049c90793ca85969e0b51c0acd7b49710db295340958ec89d95ca4b09c4acd610b35
SSDEEP 384:EZcIhsNx/ozeU7inf+g8GYZX4+2f1F6ZnTKwBODNZOCc50:ihLzeHfU4lX6ZnewBKZOr0
TLSH
T16F928E715D3CAC779DD2B105F44B22174EF89167E6D42F94E6ED6F1C00996AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31d1c64de21b10a35bd63c4539b955477edec3ef7ee8cb8f40bb75bb477a5353
MD5 c05711c6ac98fa1cdf78189528dff443
SHA1 649d12bdf2c6bbdce5253f792328a84f3fd9799f
SHA512 3a2946cdba57a06cd997b6979682d61051dc1086ca4b5eac85f44022de41074a4c3df910792d96a0ec3b06712ed5d3c5b91075b4e37132c31c20c68cbaa8cce0
SSDEEP 192:EONl6hZ0QmiUyqipc/+jVWjzorGYW5wOZ6BlnU6:EONl6oUpu+g8GYV26nnU6
TLSH
T1E902DB35A9786C779EE2AE46F48727235FE4112BAD956F84DAEC1F1C00C769C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d93be04de9aa277923a8f0a6f888a1292756ccacc17206b2b5624a5f5f39827
MD5 9c764609f82c7e1565ca456cce8f982c
SHA1 678b11069496ddac30ae90be9388a1135e58238a
SHA512 7237feb14eb16678ce11a6d3cabb120504a3ac84cd0a8751ad5dd0484a562384e51a75ad20cad292401f58ff3490cab9ce1c7d7a51ed062bcd1d859de962843a
SSDEEP 192:5ONSV6hZwQmiUyBiVc/+jVWjzorGYZX4+2f05cOq63qafU6:5ONU6k1Vu+g8GYZX4+2fH96ZU6
TLSH
T1EC120C326968EC679DD2A641F04B36135EE5511BDEC57F94E6EC1F1C00DF6AC134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bbd0aa6-5af7-40a1-9359-118f889aa031.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4bbd0aa6-5af7-40a1-9359-118f889aa031.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7420518bd325a51d8e41e6e12f7adbd73b00be40c82e247610a46ae31d651f89
MD5 4a588cea7eb9d47860b55cafff1fb060
SHA1 90b0f4799006c4260f27c789fa7d76d8046cf5d7
SHA512 1773db14503382cc76f5348d34888ed2114760c2b49052b19b05107d37656bc7eb13cf931b7b09405708a147cf2f1039f2f35fab03ebe0d8c50fafbccf68a655
TLSH
T177410798B6EA1048B3B37F5A9FF6A86D447B79772E0BD45E10110D4F4A23A40C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download