hxxps://www[.]virtualbox[.]org/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
65s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.virtualbox.org/
Sample260822-xe74fabl7s

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1644	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318980490231134"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\vbox-extpack_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\vbox-extpack_auto_file\shell\Read\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{682E71F9-067D-4889-A65C-82C9BAE6534B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\vbox-extpack_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.vbox-extpack\ = "vbox-extpack_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\vbox-extpack_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.vbox-extpack	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\vbox-extpack_auto_file\shell\Read	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5460	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe
6100	AcroRd32.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1116	3600	msedge.exe	84
PID 3600 wrote to memory of 1644	3600	msedge.exe	85
PID 3600 wrote to memory of 4556	3600	msedge.exe	86
PID 3600 wrote to memory of 4556	3600	msedge.exe	86
PID 3600 wrote to memory of 4556	3600	msedge.exe	86
PID 3600 wrote to memory of 4548	3600	msedge.exe	88
PID 3600 wrote to memory of 4548	3600	msedge.exe	88
PID 3600 wrote to memory of 4064	3600	msedge.exe	89
PID 3600 wrote to memory of 4864	3600	msedge.exe	90
PID 3600 wrote to memory of 4064	3600	msedge.exe	89
PID 3600 wrote to memory of 4064	3600	msedge.exe	89
PID 3600 wrote to memory of 4864	3600	msedge.exe	90
PID 3600 wrote to memory of 4864	3600	msedge.exe	90
PID 3600 wrote to memory of 1328	3600	msedge.exe	91
PID 3600 wrote to memory of 1328	3600	msedge.exe	91
PID 3600 wrote to memory of 1328	3600	msedge.exe	91
PID 3600 wrote to memory of 3016	3600	msedge.exe	92
PID 3600 wrote to memory of 3016	3600	msedge.exe	92
PID 3600 wrote to memory of 3016	3600	msedge.exe	92
PID 3600 wrote to memory of 4228	3600	msedge.exe	97
PID 3600 wrote to memory of 4228	3600	msedge.exe	97
PID 3600 wrote to memory of 4752	3600	msedge.exe	98
PID 3600 wrote to memory of 2396	3600	msedge.exe	99
PID 3600 wrote to memory of 4752	3600	msedge.exe	98
PID 3600 wrote to memory of 2396	3600	msedge.exe	99
PID 3600 wrote to memory of 4512	3600	msedge.exe	103
PID 3600 wrote to memory of 3940	3600	msedge.exe	110
PID 3600 wrote to memory of 3940	3600	msedge.exe	110
PID 3600 wrote to memory of 3368	3600	msedge.exe	109
PID 3600 wrote to memory of 3368	3600	msedge.exe	109
PID 3600 wrote to memory of 3368	3600	msedge.exe	109
PID 3600 wrote to memory of 4360	3600	msedge.exe	113
PID 3600 wrote to memory of 5908	3600	msedge.exe	122
PID 3600 wrote to memory of 5916	3600	msedge.exe	123
PID 3600 wrote to memory of 5924	3600	msedge.exe	124
PID 5460 wrote to memory of 6100	5460	OpenWith.exe	125
PID 3600 wrote to memory of 1284	3600	msedge.exe	129
PID 3600 wrote to memory of 1284	3600	msedge.exe	129
PID 6100 wrote to memory of 3776	6100	AcroRd32.exe	130
PID 3776 wrote to memory of 2420	3776	RdrCEF.exe	131
PID 3776 wrote to memory of 5332	3776	RdrCEF.exe	132
PID 3776 wrote to memory of 5332	3776	RdrCEF.exe	132
PID 3776 wrote to memory of 5672	3776	RdrCEF.exe	133
PID 3776 wrote to memory of 5604	3776	RdrCEF.exe	135
PID 3776 wrote to memory of 5800	3776	RdrCEF.exe	136
PID 3600 wrote to memory of 5292	3600	msedge.exe	139
PID 3600 wrote to memory of 5292	3600	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.virtualbox.org/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc4c01c188,0x7ffc4c01c194,0x7ffc4c01c1a0
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11946232761817969372,18437346102061801480,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,15698712368889305566,14975024849337211426,262144 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,14976401796913085180,403004749968013670,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2338995249609847919,3875781424827737656,2097152 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,11311484122264012109,7683565037069523977,2097152 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,16198952591939966265,10247866253824522783,2097152 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8803325036537775689,7817915427231623679,2097152 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,6694652101656688680,15120220981168916486,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,3394154298482037419,18274717890143296170,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4417097410697917593,11640021516187333044,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16793605234100796624,8160048368323405361,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16793605234100796624,8160048368323405361,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6352,i,3361472643025671885,3281012912706276705,2097152 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,3487562527569340798,11790391028339254244,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3542035163535249521,4011156464169768623,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,9562196461589937407,855273258501998857,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3728859198419597472,11930002130531194535,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,867403563120929802,12609084998931170936,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,14743648146359199576,5249574070295649860,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,9411579320096137710,1140140800434734656,524288 --field-trial-handle=2284,i,187995461237120516,9445457917101945640,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E6A2134150DE7512351FF7BFA1AEB10B --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1B4A1761A8FDB1FE34D27BDEF5662423 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1B4A1761A8FDB1FE34D27BDEF5662423 --renderer-client-id=2 --mojo-platform-channel-handle=1700 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=482A8D7108B58F20DFE0CA8C144DB3CD --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5672
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8ACC8460F4F0F7DE7D6916973D3624EF --mojo-platform-channel-handle=1900 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=138C64EE15DAC30977ECF21F577C850A --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 9c1a8859be7fb41c4ce19281fa92b16f55b5ae589a6fa6cf1b99c58cbf07a972
MD5 2c7153ae1e208a8506ea596111259304
SHA1 1b724f62e9c96d83de43ed0924c7a99aa090b084
SHA512 b3591034751048f8878e19ce6d2a9208d82f47332f637f4eb733c1c2aba3e0a68255fb61b7f168a9a5ce9d6162d0c90192f1d717a09f0f3e9cfae3b47e0eb2c9
SSDEEP 384:yeFdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:8+eUZsLQCZsL3hUS4
TLSH
T11453CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c21323f2d95302b273af4897854eab0ce7f66d4fda39375ce51bba0b31d0944
MD5 bc01226f5ab8c6e0e0d7ae19d30424c6
SHA1 45bbc3571a87d4b704d96f5d2604db97d60e1095
SHA512 f5a38063efcb9e1a9ed067e243e9395dc8e34923b3a7cf3adf02f557c828af234d6114ea4524a2e0978dc614354641827fa3f0ea1ed92db5b4613a8da7bb626e
TLSH
T1CD710939151E08B1E3592CF04AE1250730B6ADD7F9670E76C1E09E33152FF21B93D509
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd5f.TMP
Size 3KB
SHA256 a9c085e107d97c9e425395fd8ccf57b126e0fa11a8b8db9e1beb2aa3124d6e3b
MD5 89bac574a38fe948e17945df353d2229
SHA1 3ab3a4a59b2e0af59546e0b38415c30acf59970f
SHA512 a9e90bac07559e4afd3dadf277770c07bae54c53f73d56bffeb83e242c63ceadbabdefed70933b4b892393abb682916cced340cfdf225a23487ec098ba44db1c
TLSH
T16761E5380A2E0871E39A2CF156D5320720B6BDEBFA561E75C2E49E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2a3db4b34044ea414e5e378bf5d4b9f51cdac01f35625f275146a94cf2001ce1
MD5 c7787c76fa14632e53f6dd88a9c7d702
SHA1 4e1e1175e70ae364552753a46db0e183245d25be
SHA512 589e2b5cf2f0cb50a162cb42f185d8c7bfe09f5de19e7fbaf6cb3de68823fc0529737fdbd63b3f92c16f30eb3614e0452b2542c9b7ccf88eea0be9e9051ac183
SSDEEP 192:sxZYWRnyM/jK1Ml8Mky/fHsnDAEIdp/YHW6+WN/1S/Y9INsaNIgrJ:sxZFhMy/fHsnDkQHbg/V9
TLSH
T11742D8166A349E77CCCBD209FA55BF53D6F9047292940E44A9FCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 726dabc1b48920dc5423bacf045f2e334e077b4190e9b60d06ef6c741336626e
MD5 48f9d67034cb0cd211ef90e79f774968
SHA1 953d2fdee2d9de3339df6792298c55176aa67d6f
SHA512 16217531893177807a78b99236ee73db7e607a46c024805e4d0ec0c72b4ce32d885c36636811bb893663ffd2e0bea743a9ba17f5a52a2e35dab1e753472f3dde
SSDEEP 192:sxZYWRnyM/jK1Ml8M9y/fHsTDAEIdp/YHW6+WN/1S/Y9INsaNIg5aJ:sxZFh1y/fHsTDkQHbg/VU
TLSH
T13252D8166A349E77CCCBD20DFA45BF53D6F9447292940E44A9FC8A1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 24391eac6a8a66aee7562ba1780da19b50ce115b8535de288a9cf731fe9ff3e6
MD5 f11835d63e0372e41bbc679ce2c7915e
SHA1 ad600b4cac7a26857f37330a604bee25900ad580
SHA512 040d3b715bed1c23aa8eb653a6961718504d0d620610fcb9f3e9766917325e67ffcec7431792968799e31a6936d10dddfaeddb42794d20f1c531f6c2073a9e95
SSDEEP 768:Pwcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNYrodg6p:Pwcv21wWvu+Z+u1jaeFLeRNjdZ
TLSH
T181D20B2B280CCB7E4F841E9CED2AAF866ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 9561c39ef5a81dd8fca0038517a2f4114db8191ef78b51246ace7b5d28340bca
MD5 0cce0d1b9e49f6e0640de4edea1d4907
SHA1 bb3be3a647c6b9d4a0fd7f04056e8b48b1ab5b31
SHA512 078d89965f06c760e6fa256adf86e8a5aec04e55bf4eb0fe4abf673f341a1f10599aade28e9ce37d370e4cb7235d6cafacad2201e625f5cf6b78bb900f188af9
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyC6CwK3qOg:mTLqHPPbg
TLSH
T18AB14E12317B06527C7E2808A396893A9E4635A3341CF56F7BBC00B61F6AE521DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594982.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594982.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 074b785f235015e8fe1730d8243d5c38cf17f64486c79386c690c396cb89f0b1
MD5 7cc2b6225810205500820dec44f0da23
SHA1 7230b11c9f533e26eef19ad20a48989b746ab6ab
SHA512 596737102dedd7bd962fd7730f3fbeb184220374174147c67d7ae33af08de6eef9e249233b8becfee7a0215dad28fe6eb2510231e3ac03b9262b895717b3cd03
SSDEEP 192:uPm+xasuheOwQxMGsNW+QV2aD+YLeSlQmiU1h4hQ54e+CGlOdmche3UJi+ql9hx7:5ZcIhsNW+WziozgQme+CMOfehvLTPZeU
TLSH
T1B1827D726C746C765BF7A545B84B36075FBC8033DAC82F90D9DCAF1C01EB2A8130A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 40d673a3b10bdb5f74fc913ea4ee10a566597fa43e2a2c63319e067bcf27161c
MD5 beb8409c16c54d4f49b8e5a05272025f
SHA1 847e84f44fcbafcea82d4e50c5f7525973648247
SHA512 95777ef7de2df89ea4a3a4d6a9d83239042a7c4c7d4f306e5e8624d5d9ab1d4dd1c7852f5338dc460d9e308572430e561cfde3a4817d7630d5db6f8bbdac1068
SSDEEP 192:u/f+xasuheOwQxM9sNWYeQV2aD+YLeSUQmiU1h4hQ54e+CGlOdmche3UJi+ql9h1:aZcIWsNWzWziLzgQme+CMOfehvLTPZeU
TLSH
T1F5927D722C756C765AF7E545B84B36076FBC8033D6C82F90D9ECAF1D01DB2A8230A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ac3be6c5f4dd27b71b50941b132680fe663933f73306a2fada551450397dacbb
MD5 38a471b355aadbf0c5c407b6c071b02a
SHA1 24991eaf18f91ffeaa57cbe0fdc18fdb1e3d4a81
SHA512 37a19733abbacd1fa9d17b91893156445ed7149c4cb58251930153f8b627e7131a39679812422a97f68a5420214a28310c079e4b0657cec5f64ff465110517cc
SSDEEP 192:JONVh6v+YLNQmiUyhchBZh+CGlOdmuuskEU6:JON/6vz/G0BZh+CMON9U6
TLSH
T13A020935BD682CAB9FB2AE45F58737175FA8213BE6912F80D9D82E1C01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a3b160b58d4c14d1e97d289e4f003d7c437e591e7db9947a246bb8c893ff63d9
MD5 85448986a6c017cdf2ae97a262f22f01
SHA1 639a8e41fea0306580daf930d02fccb2ea075c89
SHA512 3258c66f8b2d390e6d32a466e4d66883d22d45e2880dca46662c7abe64bd60fafc8812d13d0e4dca3c6073358defd74003e1dc689d00ff8d2bf466a72b54f1fc
SSDEEP 192:uONH6v+YLDQmiUyhWhByh+CGlOdmcheoCH+qlU6:uONH6vzRGyByh+CMOfmhU6
TLSH
T187121936B9686C6B5EE2A944F48735139FA85137EA857FC0D5DC3E2C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d091d2a348d1144afa1a416a9d98f0e55b8c7b5c49ee22982a2cc642e1a91ff3
MD5 d0fd72f821f73452a647f7a81ab66ddc
SHA1 c4bb90e16eceb03d407505fdf8340d302fe1cfd2
SHA512 eb8fb060ddb9fa2dbcb9f8f83bdab70bde69ec5819c5914c80614298e68c17bafbb33bc5168ae835e4a923e297082ca2f91dfd4b1682282bab5d531bfb331c3e
SSDEEP 192:uPf+xasuheOwQxM9sNWYBQV2aD+YLeSUQmiU1h4hQ54e+CGlOdmche3UJi+ql9h1:yZcIWsNWqWziLzgQme+CMOfehvLTPZeU
TLSH
T1E9827D726C756C765AF7E545B84B36075FBC8073D6C82F90D9ECAF1C01EB2A8230A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e7d8622-b672-4ab2-ba13-b0115618e761.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e7d8622-b672-4ab2-ba13-b0115618e761.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d70ad2f8f832d18dad0ad6e09e1a59d6aeddf48affec9155105fa716f3dd2121
MD5 e747e7ebdbc1d6dc68b08ebe121d340c
SHA1 fcf98f917833a1aea4bd8028030c54e5a17476b0
SHA512 175cb18a7078de1a8098eee5f0ded9b6d58781a8e0d47caa321b85833a9362ccef76b4b3c25717b47f22909b190985b7fa71195d3b5f5d275b9b1b60cf17550a
TLSH
T1AE412858B6E91148B3B77F56ABF6A86D487F79732F0BD45D00110E4E0626E40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack

Path C:\Users\Admin\Downloads\Oracle_VirtualBox_Extension_Pack-7.2.16.vbox-extpack
Size 19.1MB
SHA256 d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689
MD5 4ae6162cf91048793b8804364f63edf3
SHA1 88bc33aec9d82a71bf24da437ddbead2b8ad39f0
SHA512 31ae4ffe9508bc90478cfb6d7816e936c7dd13395a18e9dcfd664f7716263943a7c411657ac1a47927ae30fe518dd2ef8cd011daa808628de3f4d9ad42d35b8b
SSDEEP 393216:xFYK4ywPPbNUuBH2accTVQEXYVNaK+gGXpeAvPlvfHxT0l2EpW9hQ:xFYKa7NUPUVRXYVNa7DYCPlvmD4E
TLSH
T1C717331F0AA70060BADB573BBBC7F1063D46014DEDDE1CC91AAE44F63ADAC5D60158AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download