af9f0a8753dde765fa534bb56e013713934c515ad1bda9dcea508137d8662e62

Analysis

user interaction
yes
max time kernel
300s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER PO EXWORKS SEA SHIPMENT & AIR FREIGHT (19).pdf
Size 180KB
Sample260807-k6ymvsfa25
SHA256 af9f0a8753dde765fa534bb56e013713934c515ad1bda9dcea508137d8662e62
MD5 fed89df677b0ec145ec808b25ce654b6
SHA1 9ddbc3fc5a09dc1a3157e7bc78bb991e92604c81
SHA512 a98cf558a7efb9f57e7934bace986794370422a240b040ba39e2410581ffc595dc6f0abeafd966f26677e2b6a83f4dac1f88d0767bd89585db1c6f7424b6f5b2
SSDEEP 3072:vxgRjYfBZCd1koffcLR2E4Qq3vuT4zsyzVwD1S2y779gaan272rACpO:vqtCmSd2E433Rz5zVwhS7aabGACc
TLSH
T1DB0412E5646D51A8C0DC80729E7C0163A2CAE1827740A03A353BC9D66DDDD7CFD193FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3332_1065713831\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2172	msedge.exe
4228	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305677226966468"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{005AA4C5-DDBB-4531-8C21-9995AE0BF40A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
1096	chrome.exe
1096	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe
Token: SeShutdownPrivilege	2256	chrome.exe
Token: SeCreatePagefilePrivilege	2256	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1568	AcroRd32.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe
2256	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe
1568	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2416	1568	AcroRd32.exe	85
PID 2416 wrote to memory of 1312	2416	RdrCEF.exe	86
PID 2416 wrote to memory of 4956	2416	RdrCEF.exe	87
PID 2416 wrote to memory of 4956	2416	RdrCEF.exe	87
PID 2416 wrote to memory of 3472	2416	RdrCEF.exe	88
PID 2416 wrote to memory of 3240	2416	RdrCEF.exe	89
PID 2416 wrote to memory of 3240	2416	RdrCEF.exe	89
PID 2416 wrote to memory of 1268	2416	RdrCEF.exe	90
PID 2416 wrote to memory of 208	2416	RdrCEF.exe	91
PID 1568 wrote to memory of 3332	1568	AcroRd32.exe	101
PID 3332 wrote to memory of 3288	3332	msedge.exe	102
PID 3332 wrote to memory of 4436	3332	msedge.exe	104
PID 3332 wrote to memory of 2172	3332	msedge.exe	103
PID 3332 wrote to memory of 4436	3332	msedge.exe	104
PID 3332 wrote to memory of 4436	3332	msedge.exe	104
PID 3332 wrote to memory of 528	3332	msedge.exe	105
PID 3332 wrote to memory of 528	3332	msedge.exe	105
PID 3332 wrote to memory of 4668	3332	msedge.exe	106
PID 3332 wrote to memory of 4668	3332	msedge.exe	106
PID 3332 wrote to memory of 2344	3332	msedge.exe	107
PID 3332 wrote to memory of 4668	3332	msedge.exe	106
PID 3332 wrote to memory of 2344	3332	msedge.exe	107
PID 3332 wrote to memory of 2344	3332	msedge.exe	107
PID 3332 wrote to memory of 3664	3332	msedge.exe	108
PID 3332 wrote to memory of 1144	3332	msedge.exe	109
PID 3332 wrote to memory of 3664	3332	msedge.exe	108
PID 3332 wrote to memory of 3664	3332	msedge.exe	108
PID 3332 wrote to memory of 1144	3332	msedge.exe	109
PID 3332 wrote to memory of 1144	3332	msedge.exe	109
PID 3332 wrote to memory of 2372	3332	msedge.exe	113
PID 3332 wrote to memory of 2372	3332	msedge.exe	113
PID 3332 wrote to memory of 3216	3332	msedge.exe	114
PID 3332 wrote to memory of 3216	3332	msedge.exe	114
PID 3332 wrote to memory of 4936	3332	msedge.exe	116
PID 3332 wrote to memory of 560	3332	msedge.exe	117
PID 3332 wrote to memory of 4936	3332	msedge.exe	116
PID 3332 wrote to memory of 560	3332	msedge.exe	117
PID 3332 wrote to memory of 2256	3332	msedge.exe	119
PID 3332 wrote to memory of 2548	3332	msedge.exe	120
PID 3332 wrote to memory of 2548	3332	msedge.exe	120
PID 3332 wrote to memory of 2188	3332	msedge.exe	121
PID 3332 wrote to memory of 2188	3332	msedge.exe	121
PID 3332 wrote to memory of 2384	3332	msedge.exe	122
PID 3332 wrote to memory of 4148	3332	msedge.exe	123
PID 3332 wrote to memory of 2384	3332	msedge.exe	122
PID 3332 wrote to memory of 4148	3332	msedge.exe	123
PID 3332 wrote to memory of 1188	3332	msedge.exe	124
PID 3332 wrote to memory of 1188	3332	msedge.exe	124
PID 3332 wrote to memory of 2504	3332	msedge.exe	126
PID 3332 wrote to memory of 2504	3332	msedge.exe	126
PID 3332 wrote to memory of 2504	3332	msedge.exe	126
PID 3332 wrote to memory of 1184	3332	msedge.exe	127
PID 3332 wrote to memory of 1184	3332	msedge.exe	127
PID 3332 wrote to memory of 1184	3332	msedge.exe	127
PID 3332 wrote to memory of 1800	3332	msedge.exe	128
PID 3332 wrote to memory of 1800	3332	msedge.exe	128
PID 3332 wrote to memory of 1800	3332	msedge.exe	128
PID 3332 wrote to memory of 4020	3332	msedge.exe	129
PID 3332 wrote to memory of 2836	3332	msedge.exe	130
PID 3332 wrote to memory of 5048	3332	msedge.exe	131
PID 3332 wrote to memory of 1504	3332	msedge.exe	132
PID 3332 wrote to memory of 1504	3332	msedge.exe	132
PID 3332 wrote to memory of 1504	3332	msedge.exe	132
PID 3332 wrote to memory of 924	3332	msedge.exe	133

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER PO EXWORKS SEA SHIPMENT & AIR FREIGHT (19).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D281240D90DBC7509FA29ADEB802B1E8 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AC39CEC796E1B727E67609FEF14D9205 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AC39CEC796E1B727E67609FEF14D9205 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=584670ACCAC7781556007BF77FD24822 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=348929C03F66B6FD68A3555838AF2015 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=348929C03F66B6FD68A3555838AF2015 --renderer-client-id=5 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3240
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C10CC6D9D7B8C8CE6F9F4E28DFFD3302 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1268
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A37C0D17E34DC94E903E9AB61FB55965 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pristinerealty.com.au/0084637411233499-document-share.html
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffcf988c188,0x7ffcf988c194,0x7ffcf988c1a0
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,7368152662902982564,17267946969551530747,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,17135613640289855063,12420334226381388968,262144 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,879901318598601813,3040516271029238020,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:8
    3⤵
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10709615322766988993,6166495140750664102,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,11932878755165565690,5878591072015291605,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10221124828954473373,8276954701199371662,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,17977127929312854047,14237162325723800660,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,3386287096804724804,17752927690160677871,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,18007568227661105997,10617003005370701138,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,16940680975097640366,3817563076998372143,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1694056483106314006,2175241558701566778,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10131626566071786262,15185995239058350077,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10131626566071786262,15185995239058350077,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,5647708957226281714,1286911839050944377,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,976176973924835191,3152933354616290596,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,11423903395764697906,2143221079992555122,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4220255234529416604,5213065435313786777,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,12854208049202820051,2035117106112495869,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6580,i,9175767754291537495,17125365989064114062,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5832,i,2169958393404328209,11424471967877700346,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5976,i,9597159170077483000,6077702888465945629,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,5770298990624264773,10142579267374153948,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,1484526839606152012,8463685155531048558,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,2953198660168959354,574103295549800998,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3608,i,15442010608810335440,6236269723321980420,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6404,i,7428086465763576,9202747704299673706,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17862852910123639906,14128826623256750900,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6512,i,2546623059958667083,15902453350353234684,2097152 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,12052790961652736680,11871608804426373466,524288 --field-trial-handle=2920,i,1355684210581469755,15631877115912101796,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcfad4c728,0x7ffcfad4c734,0x7ffcfad4c740
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,1615626415856267722,15403214165634330577,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,10164022850819350701,14109759285422413052,262144 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,17451753679642570806,11358529726965476627,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,17526039537159642235,9747825561675605290,2097152 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,1827107832729219498,2844076145661739791,2097152 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,1771950198718657328,2008821118011305716,2097152 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,12529843854107726862,8087465901891510484,2097152 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,149242391370610384,11787707415140934627,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,17913523545478717155,1045139506488523675,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,1186249030289318801,9894809098609059539,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,11757875660828229635,18158412642413135385,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4332,i,4527025310345539184,10298743314229746280,524288 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  - Modifies registry class
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4412,i,13821977404836066727,14734000837390513468,262144 --field-trial-handle=1960,i,15783231616930834316,104729613364635704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3332_1065713831\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 84abedd10779aaadc6e5edb053b65eb8ce8edf1458e4577173c9cd1963d4c9fb
MD5 1f08a827def01fc206aadda528009320
SHA1 8dc3e613b4621def8ee42c302599e2577c1e4ee3
SHA512 35b576147ed30d4d8b36ccd55cb32dbbd419e309b869b197a8b319075a4744abe87f3f3f8b5c1bab21e5fe1e5c199a59116a9a7aa70ccb1d6fcffd67b9c7a290
SSDEEP 384:yeudThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:F+eUZsLQCZsL3hUS4
TLSH
T15B53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d261c05a86364a5e9b7f1fc97ba7322f4d54c0f7badb992a38c807771c41a9c2
MD5 9805a110751589c3bedb1ecde1b829b6
SHA1 96d48325e98e823edea41f87d1311d93f5deba01
SHA512 be677ef02a3f6d8c0e9a6360aa0ad35045e54c2a3739ab582169fec92530d4d13e907682a5ccd7578863d01329b96deaf62527e7a4301315d69ca175e202109c
TLSH
T1A0E02BA9C921AC2718FD471954140A89E754139B2A90564F3A3D7118CFB4A3A41C6C7C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ea61f90dbe8e04a3f55f92f415ade5737eb3f1b1cb237adbafcf82006ed139d3
MD5 f00a7203b2cf73cc69eb8079198c4c7d
SHA1 67c2be1b7918aae0282b26b07b67f41a0072f6b3
SHA512 1d46ff7a5414dc7e937a0ca3412888585359896693c73cfdbb5757f03bee6dce0e1bb2fe69c6fb1aba4045adf4bdf02701543f6f065235fc8b8f8a75ec9d3bda
TLSH
T11D5189B7D3E48A7DC91192F49B216E1FCE2D0A14121C3D66C9D4AE5B83E2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 56015dc0949551650820a563d8be02574fd22c7b5985377d2f5476c12c55cb6c
MD5 eaf19a17c51c04c2eba86d1957c17917
SHA1 d7163c347fe41cbc8805d2c136e9e5bd8eba2360
SHA512 3edfb92368510a4a896bba97d051e19d06de83e90262c5bdf6730e263f5018a52ae1b5304936f549cbde378d5d1056fa3bfd0101ad33ccbab28f95507ce3b1f4
SSDEEP 192:fRbeEI5XwC0uvDMv7spAPRp22F9wHsb+WNnHk0Isekwu06VyIsnAUgtaJ:fRb3WXzTDYYUX/FKwE0xey8
TLSH
T12242C63EBA55683B5CCAD21AF9227B13D7F9202521942E54E6FCC92C14EB8CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 de9b959783788bd6077d757129d10cfb44b2068e142a67f4b9d0456755e3caeb
MD5 be745eb4bf54235b3c544ff1b4985061
SHA1 76f0ed66555343aac9349ab062fffeb09c458fab
SHA512 44fec76c80d45f5cc9e0e820312bf8f6dab311f0a0f783eddf9e4742567689903eb3714a068b662f92d09b5a0b0400db90c9d04eaeef9e3ac1bbabe0a5c501af
TLSH
T168B0124080015191C04A03B02142649873146F21960E1F4967E16D33C835561C415094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b44e5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b44e5.TMP
Size 96B
SHA256 8267407c99fed316f88a498151135450def441f34a21e65595be75d6285c5d70
MD5 e4e1b8d067a25860916207a85ed51224
SHA1 a78cb45ebf2e052d745bf1b79c5881676ee3f323
SHA512 a99208772f8d6b908100e1841c1ae2d33372cf7283a9e8d0879e527147e83eaf6981651ed526eec67d7a5ddc5310982399f2b8213266221eaa1b03c9601adf8b
TLSH
T1A9B02200C2022302C00203B030A0C0F8B020CF30CE032323C3E03F22CC30E3800220B8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5fc624e13f0c55f8d30c721b807089a6c7a9c1fa7f3d6b2c24a8e6f717172fba
MD5 cc4d081702f6c9144e8cd201470b3a2d
SHA1 426980f7bc24d4bcd9b93ef50d8f865219f1041b
SHA512 bd1140b36d138e00feb7bb4c7e6dba3c06d815e3b68add4f343ef88f9d58f5f703be090302c572bc6c297375272afba8842bce563b5369ce2dfc8e33035bd165
SSDEEP 6144:dAXpQJ3xwMSbzUzjVWOhm7Rkm1tYpBeh2BAo8:dAXpg3Gxz2jkX9oBGcAo8
TLSH
T1DF3423272C2BAD3AA8747B0B304D112C4FF1DDB1C1556FD699F8560472F9AD12B8B970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 473f981a072a2ee794bfd2c2925f72c65cb7dcc262fc678c6906f2de8c71a53b
MD5 af2678d073165598d7c3d3cebb19ea55
SHA1 62ee4edecfe748277991cebecf1822a26e8f379b
SHA512 68aedb74519ec550ce08e13fdbcd38945e8a645023613270266d77c80e90a73246e859a5b9ec7b94f810b80fcd732349da059b0154f8eb06c74a5a9eba79e923
SSDEEP 6144:EdAXpQJ3xwMSbzUzjVWOhm7Rkm1tYpBeh2BAo8:aAXpg3Gxz2jkX9oBGcAo8
TLSH
T18D3413373C27AD36A8B46A0E304D21284FF0DEB2C6549FD6A5EC550472FEAD52E4B870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 680abef6ef5d8d2a8289d285d7ba27c32f4a912a83e85abd48277438e6fbe718
MD5 538ffe38c89ecf7c905eea6e06861497
SHA1 4c14eede5d6b2131f25f42766ede6d378df6988d
SHA512 be2cb2c617bbe4111391f9b4733577d9abc944d9a0eedcba33edaef0188a14bc5031f95630e94945d1f71e90739f8613d164f5680984e4df11fcfb63f66195e3
SSDEEP 6144:uAXpQJ3xwMSbzUzjVWOhm7Rkm1tYpBeh2BAo8:uAXpg3Gxz2jkX9oBGcAo8
TLSH
T1E93423272C2BAD3AA8787B0B304D112C4FF0DDB1C1556FD699F8560472F9AD52B8B970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9a4e94306b8535518e24aa167949f2dbea30ca8b9f4d80c6759c523173bf93d5
MD5 95d29efdbcd986c8aa53bbde72407b4a
SHA1 2d148f6bbfac5e340a763d757f73cd7f6f6cb2c0
SHA512 d30b76a27ca083305ccb1c66887eb7566d4f4187787cf940afb9a055d24f202936800ec58c9fad06dfb7ce0b206b152c1b25f95e9426d4c16856b35bfbe4cf14
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:qm7Rkm1tYpBeh2BAoK
TLSH
T131C3123B5D75EC779979A70EB08E0B1F1EF149A2D920DE92C8D86A0477E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 981a87ca90fd73b46761b624799af0fba8ddc36edb2ff526cb17fec69271be06
MD5 f2468d67878bcad0392ae42c5ea47187
SHA1 27bf66a0785ac6c7f0baf09e26afbd911f3627cf
SHA512 e79cd91bb4d4e0bf731d153dc1ce40692fc76bb3de1584843038a63cdf6dce3d6245959ed572373def6101395027f9a75fe94bebae16343ff45b8e290c6e8183
TLSH
T198713076314104A1F7221532F3C26208317B8EEAF6F3EFB0AD5827B5A73CB15D61A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1474.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1474.TMP
Size 3KB
SHA256 4d7482237431d6bcddbcbacc3ea1156528163e4284991a86320e30e82d4061b1
MD5 f7e8fd87ef5a9899975ceeba24aa1d2d
SHA1 f11df7d141fca5a2179bc68c4d2a13aa474c3177
SHA512 4e4a5e17b945e5a4854cacfc096eea3fd119b1122d8dcddd807d1a0e3908050d173af662e4a480f97aedae0ab6c70150836bd0a91f3ed14d39e6dc8b7031c0db
TLSH
T1A57130B6314104A1F7221532F3C26208317B8EEAF5F3AFB0ED5827B5A73CB15D65A158
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f86e9331366358665bed20fda4c94935d96c696aac68aaa07c81f20c07a88597
MD5 ee0679ed3a7d741358ce130663d42867
SHA1 9c1579634beb0a5a53858d458b9524655f0843a1
SHA512 291d8c5fbb216238dfa9469421d5e2192f3390ff7f9bd6560d2a8b9e007ca5ff8914a2c640e4444082eb8c9fc0664b390aaa1a9d47d697d84d11617b98de248b
SSDEEP 3:MsEllllkEthXllkl2zE/lhowull:/M/xT02zJl
TLSH
T1DA440245AB80040AC90911306452C3602370D4700612674324910C325CC96500C01205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4004f57ea6d346df33c230441b8c4d4fd3f4f255535c2ec775e724e5d0a3d167
MD5 0522813854c5a457f39e1c99975c5023
SHA1 02dd400e301fb80f66f62173bf7afa74d9873b5c
SHA512 41aca114834695e0eae12d28578cdf4cb6345fc4fba8040beadc961a0fd018e6645c4a4926604a8ef690e52b4404acbe51f10d03fe68e275e0b4504bb9498d6d
TLSH
T1A731ADF3C3E8856E890156F0BA186E1BCE2D0A55432C3D5AC5E4AF2F93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c0750b960fa7e090dff19c88af7625d8c0567e1cd86231b91dbb0acc387e2c7f
MD5 78eb59df43254d804d28fefaecf76892
SHA1 c10a05a9bd19b8de4bc14edeae5344069bf7fa82
SHA512 017fbee14e8107306d27241896333898495e1f16af352d4a7a5a88b8c6e48599685ca13fe89bcbcc22ff14557f9d968ec20419ad8c3b2eac5e659a4f9b575a3a
TLSH
T14231ADF3C3E8856E890156F0BA186E1BCE2D0A55432C3D5AC5E4AF2F93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fb6a97225b233c5047cc8c0636ab96dafc1e484de15c778616ac11037e2053ff
MD5 c8f5cb16e401315242fd9a3183b5e6b4
SHA1 e258cce58e355257c4efdb71da23ba41248cdc39
SHA512 dcd5fdc1a1cfd09c1807af578fb6202eff94d666a7b859c5f16bffb3e90473544642d435cf7533c6a2fe55f135b10b69134d0d986631ba20ef4b14631619cff7
SSDEEP 192:sxZHRKyM/jK1Ml8MjI/fasKfIBioIdpJHW6+WNGYIwYFSzIg4J:sxZHk7I/fasKfgWJHbG6Lc
TLSH
T165520915AB346D77CCDBD209BA457F53D6F80473A2900E44A9FCDA1C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 80347b6907dbcc202f15c6466d843aa1b68a2109b92425d006cf293ea84f9cbd
MD5 ed51d5532e68d89610c746294c9447f6
SHA1 bfe63aad43f7a9dac448c21d7b4a7c2960a7ca9f
SHA512 271787bb699e8811d770cea0d356d3a1e767c863b29545b3efea784d17b0723d5e9272be7cd34278003d0f7b37497a54562ec11b09fe3bf0d0addb8f6ccf4612
SSDEEP 192:sxZHRKyM/jK1Ml8VjI/fasEWpVdaIBiNIdpZ/HW6+WNo/H/YAv0kszIgbPJ:sxZHkUI/fasEWvdaglxHbI/MLt
TLSH
T11562F855AA346D77CCDBD208FA457F63D6F80473A2900E54A9FCDA1C05E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ce0ce31c4f284e72e7bb39432a0c50074c0f20c144cca524dddfd86d43b1be7c
MD5 dfbcfe515784887f17ebf67b0d05c59f
SHA1 cd75e81768a530aa31b0b37c486199a2945a1e22
SHA512 3133e0e4589666c131e1921560d932a186c8caf6d7696506b4f44b6369c44a3ab70c89bf689e211fda89f914c62f476f9efc81308ee707f765ece09f7cd4e89c
SSDEEP 768:A+sqxGz7pLuLfJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfkY4Ll6AR97ror:A+sqxGlEfJlWvJD6Tu1jaWkY4LAs9IfT
TLSH
T1A0F20C3B6D4CCB7E4F804E9CED2A7E9A6DE8018B96D8C95447FA840C03C76EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a4daef8a33334dbbff68432f73d5e514f980565b65f38584d64c37289261de99
MD5 e1997bf5eb84584c8cc5731c26134d37
SHA1 79bae61f563830432754cfecdc8d9a47472224b3
SHA512 221b67b3954264ef7331eab852678b5398ec626fbcf3362f39a72ff1d517d6a33270a36ce94420762c856b7e8011847e7a6ec8d040b03d161e6caadbdc5c5db4
SSDEEP 96:KYbaKYIKS2IKrqmqcAKdqOjaKwIaia4K7iMz:ExHDvEx/b
TLSH
T124E11972323B421238BF2919E36E85375E4132A33918A57F7B7850620E67E615DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab19e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab19e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20d8343a75c35173cc6f6e329829de6f303d2396bed6a66331b9c66fedf53d89
MD5 3f219c129c75169e6da794bdeee2ccef
SHA1 2b3a38bab9e60d9d6ddfe09f074287f2eae111a0
SHA512 8b8366729d11618eaa59dec627002006f88bcf65b37df314f86d6fab8e2ca9a0a2b01895601ff6ac2130de041881e9ac75ab776c5dfd360bc725253f45a54d14
SSDEEP 192:tONL6JkRtQmiUyeSW+RN7+Fd10H+CvK/gsh3ATR4U6:tONL6UrcW+RNQdA+CvK/lVU6
TLSH
T19802C8356C382C7B9EF26D0AB48B37175FA8206BFA956B94D6E81F0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a096e52007358b108f74e70cef43c0d6aed1319e5d1e14c34d6614a29211422d
MD5 d206da17268aeccd9c6c7a7578800e85
SHA1 88c9d91fe288a442a85bd5814c1d4def7858dbb6
SHA512 8b9c755367baa4a79aeb19621e14e9ea3e0d3d056e9a429a16933e8fc153e719fadcdb0699a5eaccd21ef6bd99b704d2a8ad87ac1085360e1de26c5ed4819de8
SSDEEP 192:DON26JkRMQmiUyMSL+RN7+Fd10H+CvK/gpUQ2iVc0qs5U6:DON26UcQL+RNQdA+CvK/i2FUU6
TLSH
T10612E9316C386C775EE66805F48B36535FA821B7ED866F94E2E84F0C01DB79C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8e17194971c206c4e93aa709b2047d22f87b05ba2309ef9d94ac6a44891ef3bb
MD5 976a0c7db40f9a686e0dba265287b8d8
SHA1 021304e0904c85110a4f5a887aa1a5a39e85c520
SHA512 50fe6e313d71ebd8021d667373f359d7d8aa6784c61037b8ed2800174a01a49e6e412f64a37eb335299219960d315f80e7732b00eac9e52ed48f368f744e5b69
SSDEEP 384:nkZcIIsNrD/5pb0biZpVRNQdA+CvK/i2SUf5UrzW:CIk/zPPHQuHyK2SUSW
TLSH
T19F928D702C386C3765EAA505B48733538FF85077E9C52F98E2ED9F2D019A6982B0791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 328c5570a4b077bbdf048ff671fcc93e7c5348240772bf8cddfccb639f7b6d28
MD5 97a0845fe402c7cbe2c790ac3bef8ce2
SHA1 ef29a00d32854045903a60a48ee7386743d21c39
SHA512 949dbddeb6dcebb66438110cca212bc48b8240dd874a76a77112dcc3ec56156b1114586c2c1b3ab597553ca542690ac529d8b8f05531c1d9a719ebccd15f4f3e
SSDEEP 384:nkiFPZcIsmsN18TUNTUlIlD/5pb0biZpZDf4ZRNQdA+CvK/i2vUf5UrzW:/FHF4wgp/zPMZHQuHyK2vUSW
TLSH
T135C24A719C64DE3BB9F79B81B64632878EF400A3D9C95AC8DAD99E1C00872DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b036528d8ff42831020f81c49eab475237b839361128bd4bde9d5ac642ddd884
MD5 7c72de20ab6c1949b0ce310b9fa8931b
SHA1 8c0a4565b8300701514d93b66e4cd6b21943afd8
SHA512 4fbbb7bd866cf662515c8df684c2fb92553f39bb1448a6213bae0dd0fae567b9f7212e5425dd6214073d1465e1aabee6c667b6ac537eb78a6910d1bdc9a8f35a
SSDEEP 384:nGZcIIsNrA/5pb0b2ZpVRNQdA+CvK/i27Uf5UrzW:UIV/znPHQuHyK27USW
TLSH
T1BE928D702C386C3765EAA505B48B33534FF85077E9C52F98E2ED9F2D019A6982B0781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 67390bf760ffcb247186bd870297224e54e077b181da9af29259e352dd5db79d
MD5 11380cb110968be4fac8f92d069b671c
SHA1 7f89ada4a2afc1012f0052d43c1dd4ad4d127205
SHA512 acd94228f977b684c521ba48219c30e0ee7ae3ed8351f8477b5251f92c02af8b41e62338e70a74378703b4a762620b2e76f35eaa4d2227261c43e3e0068c05f0
SSDEEP 384:nYZcIIsNrD/5pb0b2ZpVRNQdA+CvK/i27Uf5UrzW:mIk/znPHQuHyK27USW
TLSH
T1BE928D702C386C3765EAA505B48733538FF85077E9C52F98E2ED9F2D019A6982B0791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 6929171e8d4efd7fda519b90e74a15401a95877bc993dd636c32e6cd252b55ce
MD5 24fa55e2e6c591d7938d8244d918b487
SHA1 c2e53d06658d9af3ac5bdf200e55b971030b1129
SHA512 38a7c02261908c31310b60c9c57af29c04b3d0d31c77037a79e243c3b56ba74e0ba8f0d228647c4114f6cf3c865af1d0b4907df603129b9f742a84fbebffe211
SSDEEP 384:nkiF/ZcIsesN/8TUNTUlIlD/5pb0biypZDfhZRNQdA+CvK/i2YdhA8tQZ/oo9wkz:/FXVmwgp/zkdZHQuHyK2Yw8to9mwSW
TLSH
T162E239B1D8648DB7A8E2DBC5A246F2465EE40173C98D999CE6F8BD2C209F5FC0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9995673d16a6602c012307c8b4f3a284e0c48de30a6ac90384a8a19e6eba0961
MD5 64870078c560910b3bcfec3ca0072afd
SHA1 10b39218ba4c6be1e9f86ecd1dee1858b6a3ef99
SHA512 857376a0530b6bb3df625be6caf7c458482f0f51e3f614e919e96626cbc6a0b34bcc9443527bfc940321f5bb132a56fbf3240577c97ce4f22f3a37d421efadc0
TLSH
T120410BA9B7FA1108B3B76F569BF6A8AD447BB9672F0AD15D10010D4E0A27A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

092fbeb7-d875-4d0d-a225-dd4582ed8754.tmp

Path C:\Users\Admin\AppData\Local\Temp\092fbeb7-d875-4d0d-a225-dd4582ed8754.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

dcdaa318-034f-4400-99fa-ae7b2d8a3d31.tmp

Path C:\Users\Admin\AppData\Local\Temp\dcdaa318-034f-4400-99fa-ae7b2d8a3d31.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

281cb08c-0b90-4ffb-b652-8f23c3c60b2e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_1592454806\281cb08c-0b90-4ffb-b652-8f23c3c60b2e.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_2008620239\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download