f20d9d16ffdeeefd5bbc546cdb1976c83159e117a89cd9bcc413be58e0024215

Analysis

user interaction
yes
max time kernel
85s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FACTURA_LIVERPOOL_ODM950324V2A_2021070200133021000011 (1).pdf
Size 52KB
Sample260825-e1th3afh46
SHA256 f20d9d16ffdeeefd5bbc546cdb1976c83159e117a89cd9bcc413be58e0024215
MD5 141362506d035ff37bec2508f9652932
SHA1 d492432b591816d2a2a90b82e31ba3f3f62f2c70
SHA512 923e11019dd462faeef5d5d875ed73ef3122b7e33205717066806cdb610046d3f7bfbcefb02d217af0d4f68dd635b101ab58facb11c5bde894b1de1064e166d2
SSDEEP 768:4NRR4dADfXDMQ5chAP5xxtfT6iltwfyPi2RbeepVCNhRo2H6SrFugC1WJ7W/:472d5Q5chABxDT6rqddOpo2rlVJ7e
TLSH
T1873302637D154B3CC112D9D05CA85083CEC895A241EAC4EF363D49C271CAE0AFEADFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1252	msedge.exe
2112	msedge.exe
5488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321058193621814"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{910C63A6-1D3D-40D6-B165-0F16FFBD744B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{62D04046-107F-403B-8403-FBAC413E9E73}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{923211F1-CFB9-41AE-9346-BB918D812219}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2168	AcroRd32.exe
5496	msedge.exe
5496	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe
2168	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 5236	2168	AcroRd32.exe	79
PID 5236 wrote to memory of 4900	5236	RdrCEF.exe	80
PID 5236 wrote to memory of 6068	5236	RdrCEF.exe	81
PID 5236 wrote to memory of 6068	5236	RdrCEF.exe	81
PID 5236 wrote to memory of 4056	5236	RdrCEF.exe	83
PID 5236 wrote to memory of 5516	5236	RdrCEF.exe	84
PID 5236 wrote to memory of 5516	5236	RdrCEF.exe	84
PID 5236 wrote to memory of 1692	5236	RdrCEF.exe	85
PID 5236 wrote to memory of 960	5236	RdrCEF.exe	86
PID 2168 wrote to memory of 5496	2168	AcroRd32.exe	87
PID 5496 wrote to memory of 5708	5496	msedge.exe	88
PID 5496 wrote to memory of 5820	5496	msedge.exe	89
PID 5496 wrote to memory of 1252	5496	msedge.exe	90
PID 5496 wrote to memory of 5820	5496	msedge.exe	89
PID 5496 wrote to memory of 5820	5496	msedge.exe	89
PID 5496 wrote to memory of 2804	5496	msedge.exe	92
PID 5496 wrote to memory of 2804	5496	msedge.exe	92
PID 5496 wrote to memory of 1660	5496	msedge.exe	93
PID 5496 wrote to memory of 5128	5496	msedge.exe	94
PID 5496 wrote to memory of 1660	5496	msedge.exe	93
PID 5496 wrote to memory of 1660	5496	msedge.exe	93
PID 5496 wrote to memory of 5128	5496	msedge.exe	94
PID 5496 wrote to memory of 5128	5496	msedge.exe	94
PID 2168 wrote to memory of 5856	2168	AcroRd32.exe	96
PID 5496 wrote to memory of 4416	5496	msedge.exe	97
PID 5496 wrote to memory of 4416	5496	msedge.exe	97
PID 5496 wrote to memory of 4416	5496	msedge.exe	97
PID 5496 wrote to memory of 5836	5496	msedge.exe	98
PID 5496 wrote to memory of 5836	5496	msedge.exe	98
PID 5496 wrote to memory of 5836	5496	msedge.exe	98
PID 5496 wrote to memory of 4856	5496	msedge.exe	99
PID 5496 wrote to memory of 4856	5496	msedge.exe	99
PID 5496 wrote to memory of 4856	5496	msedge.exe	99
PID 5496 wrote to memory of 1588	5496	msedge.exe	101
PID 5496 wrote to memory of 2340	5496	msedge.exe	102
PID 5496 wrote to memory of 1184	5496	msedge.exe	103
PID 5496 wrote to memory of 5596	5496	msedge.exe	104
PID 5496 wrote to memory of 2340	5496	msedge.exe	102
PID 5496 wrote to memory of 5596	5496	msedge.exe	104
PID 1184 wrote to memory of 4884	1184	msedge.exe	105
PID 5496 wrote to memory of 4732	5496	msedge.exe	108
PID 5496 wrote to memory of 4732	5496	msedge.exe	108
PID 5496 wrote to memory of 4732	5496	msedge.exe	108
PID 5496 wrote to memory of 2432	5496	msedge.exe	109
PID 2432 wrote to memory of 4432	2432	msedge.exe	110
PID 2432 wrote to memory of 2112	2432	msedge.exe	111
PID 2432 wrote to memory of 224	2432	msedge.exe	112
PID 2432 wrote to memory of 224	2432	msedge.exe	112
PID 2432 wrote to memory of 224	2432	msedge.exe	112
PID 2432 wrote to memory of 4620	2432	msedge.exe	113
PID 2432 wrote to memory of 4620	2432	msedge.exe	113
PID 2432 wrote to memory of 2404	2432	msedge.exe	116
PID 2168 wrote to memory of 1848	2168	AcroRd32.exe	117
PID 2432 wrote to memory of 3724	2432	msedge.exe	118
PID 2432 wrote to memory of 3724	2432	msedge.exe	118
PID 2432 wrote to memory of 3724	2432	msedge.exe	118
PID 2432 wrote to memory of 2104	2432	msedge.exe	119
PID 2432 wrote to memory of 2104	2432	msedge.exe	119
PID 2432 wrote to memory of 2104	2432	msedge.exe	119
PID 2432 wrote to memory of 4988	2432	msedge.exe	120
PID 2432 wrote to memory of 2176	2432	msedge.exe	121
PID 2432 wrote to memory of 4988	2432	msedge.exe	120
PID 2432 wrote to memory of 2176	2432	msedge.exe	121
PID 2432 wrote to memory of 5428	2432	msedge.exe	122

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA_LIVERPOOL_ODM950324V2A_2021070200133021000011 (1).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5883BC18B03832160E4086A5ACE79E05 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4C2332DBD148D085155543038337911D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4C2332DBD148D085155543038337911D --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAE8D65AD1218E7A69AA4695FBD2677E --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=25427B62622B6C9FDFBFD5181334519E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=25427B62622B6C9FDFBFD5181334519E --renderer-client-id=5 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5516
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B34FC4AC7590DB2F1CCA857BC395EA9 --mojo-platform-channel-handle=2468 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CF094818CEB19D61035E41B6F9CB3238 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2241545817954751217,16533908471331875532,262144 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7695636882545264375,12765788303402754417,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,2872929418820011074,7402157787662726708,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17073051752253234581,1978932819646832889,2097152 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12209207936376497676,4882875170302616855,2097152 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4764,i,3765802478349750716,237913081554037264,2097152 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4996,i,4450946637303192208,10534002345245700360,2097152 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3460,i,16793755405164238456,11545847981704264081,2097152 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,17363745109570943977,15084601792775517582,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,17363745109570943977,15084601792775517582,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11026931819502613865,17118554748635985782,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,4862976053379966208,291806844834577487,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,4857207414929494772,5736266029290738099,524288 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5880,i,14075905336747141245,16219412440191367563,2097152 --field-trial-handle=2132,i,8561218590250949340,11692791607361487866,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,12929335863424647762,18173937573531211357,524288 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
      4⤵
      System Time Discovery
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,10753030355862594920,8945239644758985392,262144 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,2687394977225469147,13945747484034760391,524288 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,9426561324207699512,12835212384787881507,524288 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,9426561324207699512,12835212384787881507,524288 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,4598622002189367517,15319265205233020344,2097152 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5008,i,18377422533026670515,1283932626749848709,2097152 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,8222226809215276083,6596926008226288315,524288 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,2562921659185443937,16100629037553551929,524288 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5900,i,8891419568164898481,3377431483728292583,2097152 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5068,i,13211340125770845033,10338193394438702760,2097152 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5960,i,9724709495786301208,1812068442389977611,2097152 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
      4⤵
      PID:72
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6384,i,10169797230417013898,4735630741324158668,2097152 --field-trial-handle=2124,i,10862736717066179521,17076849163487244875,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
        5⤵
        
        PID:344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,14894224712330279568,481331949250698079,524288 --field-trial-handle=2532,i,1428792631412168559,12293486654294943916,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,13382783542134639988,4844070096974404428,262144 --field-trial-handle=2532,i,1428792631412168559,12293486654294943916,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
        5⤵
        
        PID:712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,17647445234548155365,7374708532717802064,524288 --field-trial-handle=2532,i,1428792631412168559,12293486654294943916,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
        5⤵
        
        PID:3404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,6699619168967729629,10357186380412477062,524288 --field-trial-handle=2532,i,1428792631412168559,12293486654294943916,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,6699619168967729629,10357186380412477062,524288 --field-trial-handle=2532,i,1428792631412168559,12293486654294943916,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
        5⤵
        
        PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
  2⤵
  PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 27d4425a1deb7c406727494aa8b02e99c9ec1bb83f94dfeff72a07ad50e266a9
MD5 24a93177f68e0e12dc26b697fe407faa
SHA1 a875412dd5366cf95aaa92b75b062ce694c7e7ab
SHA512 b152265fa2156ac5ff525a9b337a182f122a2f1ce21bdf378f9a642eb7abc6cbb2e35ae756117b6699fd96e731c2b173442c2ab3f6c8b30c8a31ef4ec5a855d0
SSDEEP 384:yetdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:E+eUZsLQCZsL3hUS4
TLSH
T17C53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3938a8b8a3b2829d585c74c71e9bfc40f62fcd1ea60366b6ad41d0f6ceda9299
MD5 fb236d386b0fca02ea6c1adc1c149cfe
SHA1 354b142d2f62592c29214fd3cbbf09a01f9da0a9
SHA512 86512b00062940b74deb1d9e5099b85030be6927dff725b6f585a26de0c1afa77859554c8d3f66069a8843754766bac4f4157a3d42a390963bb57044ea6035cc
TLSH
T1D9D0235456DDFFD6F13E253CB1D1415434AC64D15D021141B444496F4C9529646E2CF9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 391bef93aab7308c2a5669eb4dfe1d78b3754543f9fa4c3d4430aea783457ef2
MD5 3bab4bb08e35a24e07f3e04fbcdb0451
SHA1 6cd742a58928595793013d77b235ce84b6c5b9c9
SHA512 e51aca1d5f2aec9ec4cf588af9e7f6696aa7e17bf2b2ec56c13470a6e8c67266f7cd5d63b1a9ee776e8a4022288363a5edfe7627ff8d0a4d7d9c7d02fd8c104b
TLSH
T128D023A853DFBE45F13F513CF4D1516D356DB4D058014051A445179F484739596E14AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d6a7e67cf2d9006c89139edcafd13a541a288914d0393b95f5d30a69904d9ab
MD5 77b804f3c8362a926ee6d5964e85ecf0
SHA1 a3ff6faaf99b4c519882257c003a82ca4d58f03a
SHA512 04d5cd6b7950cd44feba07b00ce3def91afa667c8acfb52115198d54b0182e3512371ddd3445edaeac50ef172064eaa93ba1ff7f3890121a1caa7fdfd730066a
TLSH
T1AAD023A443CBBF01F03F103CF0D0416D306DB0C058010001A044039F08473A492E14AA
MD5 SHA1 SHA512 TLSH

Submit Download

40e70132-e07b-4f52-b750-b957fcaadd4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40e70132-e07b-4f52-b750-b957fcaadd4e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ac52c44477e88c57a203f44d031b5f51e623f5d6160e0479f377fa521757a30e
MD5 1dd2a65ec9fbe3f1d9aa272c4f5fb6f1
SHA1 21f38adf6d92f87053775cbfe00a85c5b5210524
SHA512 9d0c3de2cb05453382b3ef84265e0e30be751f6d798a20fea7ff7ea447f5282a892e5e1142d28e76b6524fad3251724ae27c76550950c79f4e92664ca3aad90e
TLSH
T1EAE02BE5C822AC2B09FD072968504743D741236A3E40494F3B7D810C8FB463A299A95C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 fb1cd7fcca8c1deeda84d53491cfd4857b911852601155632c08b412fdf44559
MD5 3720542ca5a093fc75df1488bf4205f8
SHA1 b97ba86897374ec80fa7ff5aa644759de66119fe
SHA512 dd52a46c65cc1343dc0a2ede2b64b7e40e14cb86153a1babf13007b851162e565f08cca4a8d0b29c2172d530f4333f053d34cea2e9f33b604793e00d4bdabb63
SSDEEP 384:WUAF0e0PfYEvjLA3KPFbozYxkFtJ5IuHQ86YnyV:e+5PfzvjLJPF0sxOauHQS
TLSH
T13C13823E72494D5EEAC37D3C061B1A7427F9F861D6C6430733F2B2A9432AF46994EA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f3743362856536a9f1729ef204bd782bc8184207d5ebf8fbae6f8b88bf585743
MD5 474c897fbc9fc14f6a0aeda169862f8d
SHA1 6696fbd95e5f26449f43e008247dd1f6877a3394
SHA512 5fe9701fe0a9f3d82e784f55def95b5ff50cbc2769fba6d67731bd8508ba04b9611f236fc8e7b4e26df11fbf676620cd1dac9cbbb347330c2e2f7da28b2783cf
SSDEEP 1536:3nkLeCJL/GyL/xzStZfZNND9xTYU71CL/oL/AA7hT/PdC3F8UfBuaIoIjXb/N:3cL/zL/piXqU70L/oL/fbC18UfMZ5Xh
TLSH
T1D04461FB1851A01BCFA812F5E2033E3DD177455D2DE1E9E9E67C0C852825F22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 769d51e8e0062dfdd3605613eac634215442001f6a97899750c75abf29f1f15e
MD5 454103987f70889c3fc6282b33573fc2
SHA1 1928ce984e8942ff5a7566e5dec3e8293ca4f350
SHA512 8043ebf0ff51ed9124d4249d33590d62da51ff8708eebdffd21bfbbecae0254a6ae4929fd6e1c9ccbffbd263d19072862b365450fda0f839a99c12288239709c
SSDEEP 24576:Awb6olBm8YHLJycM/mewHJEB7b6WzkBGSMAoOqq1k1c+Q4OpYGuIZnuprbF2:Awe8YHLZTpEsW2GS9oOZe1dBTAu9
TLSH
T10D867DEDCA6898C3CD639930B1F0ED477C7413C3F595C1D68898C684026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e6810a5e5c9904a5f17246bcdf3f523e22c3aa780fdd8b84d45feae6c7f5c051
MD5 8b4f9f4a1c6aead7f159dd78e77a0051
SHA1 6c360feeb5edb10ff06cc7d8f6df97326c157203
SHA512 bf4a7c9c0e1f67a6b3470dda8fdf5dda1afa83d7ce85c294c47e9869a0f920a57dce627e0b17673b9d7060ef1ab736300de0857f4cf14ce85f1f28c84f11306a
TLSH
T148516E7576BC44AEF3533E70A98392937DE0708F78535D832ED0E8F5971AA221D51344
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 db9662456351f7215213d4d9c0084753407da7339ae9ec15bca2b0bc56905ebc
MD5 f4091596b51010dda98538e9b5a84ccc
SHA1 bc246ac8d18cd7cb9d106ed78f3d7cabc102d907
SHA512 acb39890e3f4866bf9c25c2beab56e736b3a1ed253d74f44b43ef4d46cb20bddbaf820c399dc320bd72a42b077297c4b2d56a2ae5d2de8437219df69baddad6a
TLSH
T101E0D8A499C6C11F9B643583526C570DC2953553E7C6EF036700A8C47743051F281546
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 2f36eac6fd226600f002e75d33275d85b9dafafe82068e35b388d35c3484429f
MD5 1eb4df172c1a527b0991eb19d8048e36
SHA1 d579f8cda0b8f281c18fb510f94a86a544854c39
SHA512 b2fcae61c3c5787c936760bae78c97034497040d5e866a5064c1d31ce1ca270ba0e427d8fbcc37071fbed76d1a8a64df0a38f5d5c676250a699a660746e7f5f8
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jcMAW5L+XK5fKFtI6ZYUqYp67:Tyi+7f+UZD4jJ/BtAWxWCKFOOYUTpg
TLSH
T151E2E28C3B11F511C4ED733EB0D2C6E05EFC682C864DB1B1923898768C52AA2F49F15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e5a8fc264ca2f7d3a8fe0c7fa59d9ace40571d829ded35e1d089fef5686453b3
MD5 a38c8bdba69d58a9ac5d5946b980f714
SHA1 87130b01745e67fe989eacc0846dd8fb2c9c5d5a
SHA512 2718b2ad77d667ba32df06377d1b28ac649a7a524295c54d9148a9e7961318b66e8f20d7a94c561217adff09b22def36fd169bb77c37041e63028726e121fe1c
TLSH
T128E026240ACCC17AD5EC789BAB7C4709C3E0390BA388FD02670E9C847201E61E3EA290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 6e6c98fe7bc76d8b6b93eda52650a581cc15be68de2db711e7aa01416f4ee838
MD5 5a27b20f7268cfd094b915ab4af70474
SHA1 bb3213b4cd20caaeb37fbfc7b6a2aeddc369c731
SHA512 b3203bf1382c88f6856facecabd583ae25fe3bbcc7c61c6d80e464e73ef0ad4b4ddf4631fd846672ddce6e759f4bebb60215558cd34641c8c3aacf9b43e1a41a
TLSH
T101E0D8744DCDC11A9698214B5B186709C3B03526E78DBE012B09AD8AB102008E2C61C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 1a4f740fdf23f71a09bfda383660011cad7885be8f5d0a85f0cf9f822a184450
MD5 6354f0a82c3e9fa15cc8d26eb7ca56aa
SHA1 995d5e11b606d679cf7a4946434945dcb02601ed
SHA512 72f87c5290d20ab4f7c14deea56cbc96a1b62038c4681919e6746ea94c1fc5042171af94e2e0088d9bf9ac766d8e6a647732b2a68e5bee07bb3a451ca5e2c952
SSDEEP 48:T2SLopFMatSaw/auUOt8BMoSwv6zLEtgmQZDcMAwH:iSeMatUaAKEc6HfZPAA
TLSH
T1F492624E1F306521C0B08B36EDD485632F7C101DC3A37A59AD2460F3CC92AAFF4091AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a8de9936374483de676955de2effe15a991c7367f0787211ab709094c7785013
MD5 48e4b005d2f95912a216230054f0a37a
SHA1 c41abd722ad6282b1c128b15e091bd9715c34918
SHA512 0dd4344b26c8ccf2f5a51c9bbc412a3e85a0282ddc2b974e5c339b1137c45ace1d0638e9e1882d1c68af7d64fbeb39603efc09223110a80a9183d3e90d6fb934
TLSH
T13631B0F783F4856ECA1196F0AB18BE2FDE1D0511432C7D9A89E4AE2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 d3cd1204780728c557f7d3cfcec42bf1b5c84c606c12060eb3c50d8eb1f01446
MD5 4eca5d14abf33b33d9f10751f0fd89b5
SHA1 c6cface4abed31cc4cc7470ed781131e18283815
SHA512 a15d435b99251bc7ed652264319a1c4072189677c72653b4f72d82e6b02934fbf1c8a651e0bda40ad1180e613cb9ce3f65042079e6bc4c0666047dc8a30c561b
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB/lc:OIEumQv8m1ccnvS6oepa/f5nFXMDYN4g
TLSH
T15DF2DEFA0727A105D98445B0E4006FCEAF16010B47B6B7EC76D447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 a745e5f2b7f9ad8c00c999b68c315f05c71563c2c04b25a9d943b6c56e21dd26
MD5 7c8aaae50977aba094a5e3ffc4f49389
SHA1 d0c372d954a5feb334a5fea979f1ce0c3dcf41ba
SHA512 7000bcbbd95109e913c1c1b140c8a8b6b393d802394ab2f4eb4dda5250a496c7c65f11a57824012cd355bcdacde8885a8238e04daefbccb72480fcf7047d8496
TLSH
T198C02252C0B8F032002484B91D80EC81A636D035005148A6C8F8933DE0A01F76E0502A
MD5 SHA1 SHA512 TLSH

Submit Download

fef42835-ebc4-463c-b704-e61253354b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fef42835-ebc4-463c-b704-e61253354b00.tmp
Size 1KB
SHA256 c6f1d836ce8105be7f43135a62e7fceac30c29ed82a0a1d5c657400a425388c4
MD5 645088530012ebc150511b7934c9e03e
SHA1 8e7f2378e7ff51e347093a4dad3b465d0a975a8b
SHA512 828cc7a2f1b9209b54380883848606c19df96f7f82087d6f392c4683fd27d70c16b83abf66d3dcc11305df4b5aad333a348bb6e3a805246bddf9840bc8007177
TLSH
T16331BEF783F4856ECA1196F0AA18AE2FDE1D0511432C7CA989E4AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 84d2205fb807a6eeecd3a17d93f1a64a871747009c657cc3ebadf350e9919bb5
MD5 b76e4618abf138b5e3b556df5f424d22
SHA1 52a5cdc8bf15e1303b05ed61940a4aa745c28eed
SHA512 f28d8d4c80c29255127f6ec72c1332c90865db86dfb67f79e3476f1ff4d4a765efb2d42853ba915dac3ed916847571b17bf4b9f196e686154896b4db78de481b
SSDEEP 384:sxZ4U3O/fps+NWvhyV7ori0vx/VG5ebgJm:sg4O/f3NYhymp/VG5eT
TLSH
T130721915AA38597BCCDBD219FA557F93D6F9152391800E44AAFC8A1C04E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6ff53ae2c7b6cc44a2eee24237ab1d9a5c19a12c85038aecbf669d89a716817f
MD5 9198cd02ff17d4e0a2beda409f6d1564
SHA1 600c66546c6fa48bee94f13b6311daff4dc053cc
SHA512 6415269fb82759e9d92d617ad99ec2f6754e90a5473aba36c0be44597f54bcb6a246b9e3e2815454ccf519a382a130f8137f3edfecdccb5c506e6f2068b03d43
SSDEEP 384:sxZ4JuO/fpsbWvayV7ori0vC/lG53gYgJm:sgEO/fiYaymq/lG53gW
TLSH
T1AD720915AA38997B8CDBD209FA457F53D6F9152391800E44AAFC8E1C04E7BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eb16ff86055a52799c325b3e3fa3eb52ca7b6d50cb318d84716ecaf837b74afd
MD5 170ee256249a601b8ee9bdc1a6644054
SHA1 fb0ace2320494c8c8f26361d1c5847633a12b845
SHA512 01bd95aebdac80f3b8957dab15629b3621c24c90d98fc74c100e9a736ec931a8ceaf3abaa1c2cb1bb3d33461fdd94fa739814ff516d035d098d4fd8d1caee0d3
SSDEEP 192:sxZ4R/yMqZjK1Ml8McO/fZXsXMyKQ7PgYsi0szodp3B/4Z6+WNGY0ZY8c+aIgjJm:sxZ4U0O/fpsXMyV7ori0vx/VG5+TjJm
TLSH
T1E162F8166A385977CCDBD319FA457B93D6F9153391800E44AAFC8A1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a8501ce67e158fc6a755844377f450c572fa2aa0772283578a22a48cb765854b
MD5 5b3cbe1708d284cfd3c82e7ee44aeba5
SHA1 858371be4dd1a2b0c9321ee77b05c1b9254caefd
SHA512 b3a0bc195f22f12657590240470fd332479fff352d563834148c25423fa479eca2f1751d0303af7ca44e71c8ed3d02a3f7838ad25730e3957ee6d3e427d03ce0
SSDEEP 384:sxZ4J3O/fpsbWvayV7ori0vC/ZG5jgTgJm:sgdO/fiYaymq/ZG5jgr
TLSH
T176720915AA38597B8CDBD209FA457B93D6F9153391900E44AAFC8A1C04E7BED2217C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1fec3d325326953be547a691840d102421f60d83bbe92c74008c1bec89816ca6
MD5 bfb2781da198ea6a55469ef810a219cd
SHA1 a163f6740d807e0bf76b83dba5c4586c48bd0989
SHA512 22fe083df8d64ab24aabebeb40f020d7a53a6b9db316e8fd41efa0b6d99fab027492f667bfa30158bebe133dd658d658fff4ea6d4a7ca9a0c7f00923fddf79d1
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EGq9Lla:XwZh38Dv2SkEnZFWRm6GQFmu1jaKEGq6
TLSH
T13B030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 0903a613c7fb38732f4ab3f2842ffb872714fb0e1a66e25a79c004afd68cd3a6
MD5 6f4c340f8bdab2f638d4647df3e139a0
SHA1 9197d29be82bba0607f78a43122e140f95bc2e7e
SHA512 4f50380fdea710cc0ead016ba6e00dcc93b473e20ad4aaf5c7c966393c0daf4e7fd7263fe1844cb2e82403bfe5a8f8d16af78b11172410c7372b597bf65627a8
TLSH
T185E026210EC8C17EA17A608737ACC749C3F4B507EBC8FD06BF80D8446246904F1E2180
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13432105828569499

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13432105828569499
Size 2KB
SHA256 6f853997cc969b783a57cda652da4a61ce67f093ee2835139cb2dd0aa115231b
MD5 30c95804c1f6b10591de0ea647919aa6
SHA1 2fb10411d431dfe4cb32848a4cc82ab92ea8c445
SHA512 840fd4fa2050e332f209344a16a77c87687202d63224faa2e4a5a23b76df4f75fdce0a513679067747605a6ec878668a86365e18b856a084101369e095d4030e
TLSH
T18251BF7C79E8252AF27B4A79A0A534F3B7B86D6078812ACEC25112680463A06DFB0D4D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 78691fe69384e5566a14d86c89cb49cf1724efe7d8d6654ad27ed9518991f8c7
MD5 2aa7f30ff7c177da7e274646c0b51e17
SHA1 a0ff48b25aafa6f0d391feb4e3f940a08ef2bae7
SHA512 3132417f94f6a9dd751d278880767f5c40e0a4e7ff65894afc20762e4ef5fead9674c02a75407e71abe639ced3059f86b1d4d8dc97d075917b073ee22576b23c
TLSH
T152B0124C3F015283D89A143B06BC8B53BB10F1564904850B7B5CEEA00D05AFA7D440F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 5916441e83f57b366c96954cb9dc044992c291afb342f0007b238c9047b4cb0a
MD5 d8a185d1e28f224e7030f692b3b99c7b
SHA1 e9f43def44245d77feb1338ca1554517eb9d9c89
SHA512 4b7717bd68e5a7ab24f33347d5423c9452030740b06bd0504c996c9f3dbd39a02b8497ab9522b057dbfe3c1dadb68314989e8d7fc1380d49f3419ae4bf9fe906
TLSH
T1E5E0D8341ECDC22BB2B961C7736CD389C1B2B502DBC8ED117B18E444A30A540B2D3140
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fe6f94e06294986f861ff00c330c1ebef0a7de5ce75f3b8b1230048a5b330b84
MD5 dfe0df833ea802fb5379c1cc0d28341b
SHA1 24e667ffc3ae37e11147c408a8983609fe927716
SHA512 a5005c95d8815d722ab8832ea33feb3cd0a8c7e13e0715e7cf817c1dda1037f4c6671f0429d516dfa1b4671d6d8b178e97913869769ad22eaaea84edaec65068
TLSH
T1F3E0DF705FC8C23EA56864C3637C9B4AC2B0BD469388BE02B70C5444A309510B2F6190
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 33fd487f5fab465b952210e16781e027280bc43ee20ea3745afb96b47c70f56b
MD5 3683009a5af10b33e1ba360e3e3d329e
SHA1 136a00d173ccb85987b19d0174d406ffb51f2c1b
SHA512 0fc49a73eff5ae8755f527da6245e4781f985adf33ea716e40722779952bb5d1d7ef7986ed7b58858fb21155962e07c3a23452ba1a922bb2f00b9c81b6341e9a
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl1IhG:ctGj+BCNC5qFVpKx1UG
TLSH
T169B2691632BA02033C3E791D87959B371A42B1A33418E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 cbdd54ed6722fa1604cffb8d1b95d20cad7ea4bed1c1fc6bea87031a0323402a
MD5 ab8b30bae65c6ae0e62393f920405a44
SHA1 cd8651a52da6f38edc5f9b6557f76247695b7e05
SHA512 9790d7bdde8ed004202c48af4f4428b01556ab618d1cd1ec45edfe1b71c6ba671ee9733cf660b01fa90c7d3ea9722acfc2de8aac7d632b4f2be79d76fdbe52c3
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl1IhJ9Ik:ctGj+BCNC5qFVpKx1UJCk
TLSH
T1CFC2971632FA02023C7E791D87959B371A42B1A33018E93B7BE854B64E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 0bf7254ae80d114993f59c2bd057bb276a909560679db978b0614942ea0e5f4a
MD5 fea1a027809b21bab9868b509428d748
SHA1 c9cf330e4f95f097f52c54c6baa0a65ef8e0e417
SHA512 7a6d217161d4c654fc9389ee5fbd7b5de20f6215691610c7f8674a5a566ddfeaecf8c98dcbb02927f6a33a84b07d7777e5646e1e833223a142804f575f6cd105
SSDEEP 192:FvoWThEfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a2EfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T19F24630A7B747001EDE7D9725CB080771A3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 04ce3e5af32eb361c72586c7888f2071101618b697a8729b3f83fd5798dc51b2
MD5 0471795363b903807c9bbf6719cbc25b
SHA1 bfcc0b52e277d3bb0014e87ed081870645f8e9bf
SHA512 736a5909017ca748810c782511ea6fe1ba8c2c8a190e80763d3b891510ad638ff389b166743aa9b3db97ec65778dbe2d7e2d5b9a4ed05102e8e649e7d135c461
TLSH
T13D5190C0A3F95495BFCAB985C3195913A4E17F6B220E9C72732E54F44F88C250E6FE25
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 112KB
SHA256 a33607ee1ebc8264c5f82efac9a3d96d54ade01d9ed4f3ccc820d8c682b6be3a
MD5 c0ca8ddc401aaa80c8e0bec232cc7620
SHA1 bd283953d9d9b93d0213cd41f5fe77c48a468bc8
SHA512 aa5e11805d36641dff0ba229b1f1f4ba6dec5b468132e621f840dee4f0c94a50ca8066f17e2ec3fcae4150e23d0a4f2bbfdb2ca61c4fd235289837898c70eddc
SSDEEP 768:Z340/tEUFRThP+IjWAqNerec98JQAqCk2zCmfTnFw0H0OvCrwbnXbWAvF1UBFqMp:Z1yoww0XceDC7n9ZjLj
TLSH
T149B30FF76D0AD1A6DDCD92B4D41BEE8444730621C620E8E5AE3D08C37B79A02BF765C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 f96167f26fcba81b4ed95b886709e7c731153659efff97449bc5a7ecbcd8aa77
MD5 5f69d6e34dc836a337d196e6f3539774
SHA1 6aea55b52d5d3436ca46e65a3e6188f5ff6f7e60
SHA512 095b8804b9fb09d5cf4257463bb715282db3b403e998a1a163e02f6fae0f512df7ab1058869aef12c0fca1f7b50f90d2ec556df406c0f935def9995c987c2d17
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1B8XQMcIIIcbsMIMm3YcYvj:FQ8sNis/uQ1IIIcbsMIM6BA
TLSH
T10852831926021F3BE04E6FB743A94B941FC599C2017332AD31622C8F8CF3A5786C91FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f959f11e5501324f6dbfa76f83920d64b5581d3457929f7d45ecb499d1618502
MD5 d274b89384f6538b94250c3608d0d45e
SHA1 bfcf86f5842d6a41f54b0fbe4a6f55f5e3cff358
SHA512 c14573c5200b6b448639c7f37218b896f6f9fcc77c45e90d158158f071322840ea1049d108269efcbf53079375a1600a023ceba1d870aa87ff7617510df005bd
TLSH
T1BFE020245FCCC15FE6B8358B123C5749C2D03507EB84AD052F10C448E151500F2CD141
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f0133e103c624453a6732ca95b9e4ca2f7f15b16699444b7a52ac89a1f8d39a6
MD5 e5d24f0158b3a0d449a3fa8ebf05718c
SHA1 21d8bc6c2ed1347dbd571b7c844a38efc30448d8
SHA512 cbc932deef35ae9882f8f437098ac3547b115db9f046a19c7f5c0310bee4ae384b8123d1b4ded81cb4d73483133c0c7ea549f39f1a467681b860fc53a0e38625
TLSH
T1C1216056F321C149E14E8A7EA12AAB361328E8029FFCED0F447920256D76F015E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 aca8d4aceaca2f899670769cae469f8efa66c2acf8228f381007dd12c6f2129d
MD5 7fc8a6d7e4142240e3a4436b5a87aff1
SHA1 0584f8dca9e1c49fe8f0126405df9e816b13a4ad
SHA512 80fe09cd8428b87d072f408e4d8b38052301967458455e980578ed2ce1de0efdce62545a76a327c914f4204bcddb5aafae45ebc649ebee142f81e4b5760d11ea
TLSH
T1E8E020246ECCC15FD2B8318B12BC8789C2E13D43EB84EE012F14CC48E601541F2CE181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9511df4a5126abdd1e0c45502838518be750e1aa9f0fd8e2be87c5c1dac99edd
MD5 57211637577cf2bd534f03b4e4a99235
SHA1 d8ab106643552a3befda7352ad6aef10ecf48bbe
SHA512 0c49818a0a0ccc28010010320f88fe2e6164410e9d90ca930a8d72bfecc14d8f6bcb8d68365a24f37cacee9f0d3bf3e85c988756a3109c4efefcf3b74c75c782
SSDEEP 3:MsEllllkEthXllkl2zEfl0k/:/M/xT02zQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1655b934d4ebfc43d93ecae927e3f89a4f85e63cfaca41fb6e34f9615bae4645
MD5 ef4478369aeb928569e352d0c009dd9c
SHA1 9ae2123b6bbecab1af1b2f00b8214205d712ee52
SHA512 40aea882f16c4a448162febdb5fd67c7372b2a9b0bb3e323028c936ff1c4e03b510927e97de10c68972d7ad218af5543304cea2947aee85ac50390e285d71133
SSDEEP 768:2F0F4wgaUGNioLAIP4NVt2NmTb4tG0i8x:pFlUiAzNVwWM40i8x
TLSH
T188E2287ADC94D97F98EE6B88974D79179DE00133C5AC89C8E3D80F0C80B659DF30A829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d51d7ee3e5ed5648e08a50ff42b3356f12b9eb127c58095c8c39e81942388f01
MD5 e2c45f0db99571b6fcd6582317c2e19c
SHA1 31b42c28682fc8775d4212536c8016e6472bae38
SHA512 e2d8d51e587f571a0af31250018bb6c9b16cdc26f729fab2ca05f1ff4a346069c12c37c36584927a489a4bb51cc79501c8d80037ba9242dc9b1eadd45da5c5e4
SSDEEP 384:nCiF9CcmyWCs38NA8TUNTUlIxBrk6oxWF1ifbAoC+qrVSdSfe4KV8p0Uxty/7IgS:JFccps3Hwg4dW7oLAIdSfI8p0W
TLSH
T16AB25C32EC99DABBECE70F99E74A7607DDE05267858C89D8DAD81D4C008719D130B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e89a8835a74c069b8ecd1875620ea3b462152c0178d73422d159084939f663b1
MD5 e71c78ec1e5bea623713c3bc270535f9
SHA1 3678ad5642c0bfd0445af74669a35ae848d4073c
SHA512 d41ea8f138b7d71e3ab798e781c9075ced9deefd3e5fe2c717bccebc5390aac74e205621896fbdbe45bc5f00aaa6c8623b7eda6c0b7c2ba55f820fbed05620cf
SSDEEP 384:ngiF9CcmyWCs38Nv8TUNTUlIRyrk6BG81ifbAoC+qrVSPd2NVvXe4KV8p0Uxty/N:7Fccps3AwgvRsoLAIP4NVvXI8p07
TLSH
T17EC26B31ECA9DAB7ECE70F99EB4A7607DDE0116785888DD8DAD81D4D008729D170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ddebb7547b7bac3e23176e988579f561447b3a6f159f685bb554e2074f88b5cb
MD5 43600000035060e721806f8d7cd3e28c
SHA1 f0898c38c0152a694e1691ea0a7b9ff7fc6f8a1d
SHA512 c209c61c99d08cfee30a458bb713bc98e1b5024b63482b5abdd55c6cafced20d07f4658ef9babacf3e43bae4dd8bbc93f6f7c385e88cccc311440b673d700175
SSDEEP 384:ngiFBZcIX8Nv8TUNTUlIRIAKrk6F9N21ifbAoC+qrVSPd2NVv0A8v/olAKRpHpIz:7FJXAwgT0NioLAIP4NVvz8IuKRpJIil4
TLSH
T12DE239B1D895CEE7A8E6CAC59B45F512ADE40133C58C898CD2F97D3D209F4FE130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 83551e6d47006cea06caeade4aefbd2dcdbb3b573db32d7bb338dff9e1e5f36c
MD5 398af931b7f1e3ada1e21d3b399e33d2
SHA1 bfaff358ed8d4e60b8998e5b49ecfae493f154d3
SHA512 4e850ae96f15bedc2b013204e60076041492e299844db9bcdf5caab9ea5898d9e2d41418fd9997fecdf38fb5bd1938a65b814ee6ac191f5b42ce82ea3dd715c6
SSDEEP 384:nbiFPZcIX8NP8TUNTUlIRAzAKrk6eyN21ifbAoC+qrVSPd2NVtVuiv9BJ8/7IzOx:2FHX4wgaUMNioLAIP4NVtEi8x
TLSH
T18FC24A72DC99DDB7ACEA4B85EB4A7607DEE01163C9CC8EC4E5D84D1D008759E170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 20799b79c65c8c87cd00f5ce2ba6c1d93128d48b0583869e7a195ed48350fc18
MD5 f6cce2f0358ec437c7c934a77828d386
SHA1 467385742c9ba03cda7a25d1789c7dbbabb73047
SHA512 ea4284edbd40fad41ce1d6e05c7dc83e0919b91cf863c734d4cd83be9edaab00f41d453b12494826d27b8602b1b08bb2c8aa09e99fc33d789a161acdb79c5ea8
SSDEEP 384:noiF9CcmyWCs38N78TUNTUlIxBrk6ieM51ifbAoC+qrVSPd2NVRXe4KV8p0UxtyE:zFccps3Qwg4UMfoLAIP4NVRXI8p0W
TLSH
T1E8C25B31EC99DABBECE70F99EB4A7607DDE01267858C89D8DAD81D4D008719D170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d5598d5cfe18acdaa31c5aa4e24b90ee409fb05f65bf2be62ee5fa15643a2a68
MD5 97f45324057760892b8db767f320282f
SHA1 2beb6a43e7e978d06f4a4b6c66b274988ff4ca1d
SHA512 66b88d3c23b0a85cec17e5bd866f0760d3064a314897a2b227bc87287b8c325441f210dc78225f6fb985663e99fca443c515c22b9a3ef773bd0f07305bf38442
SSDEEP 384:ngiFBZcIX8Nv8TUNTUlIRIAKrk6FeN21ifbAoC+qrVSPd2NVv0A8v/olAKRpHpIz:7FJXAwgTHNioLAIP4NVvz8IuKRpJIil4
TLSH
T191E239B1D895CEE7A8E6CAC59B45F512ADE40133C58C898CD2F97D7D209F4FE130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 bd0aee062ac4fd37e833c3dfda3ee3c72a7cf9c1bce9892e7d04fff92569e1b5
MD5 d78478a5384286387d8275a9b17a61a0
SHA1 e0df4373e01c5baef8ca95548acbcbc4ab415d75
SHA512 499289794f16c7d1754ba513c3711b76b9ccfd1caad4c66d963c8d5a042d01aa66882bbd8b01e9127c4b13cdbfce8ecf1e7ffcff3f109974c829c5c16c272ae5
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtydc7Xzbdc7a0:TLyT5UOl0afDdWec9sJVK7pejB5fc
TLSH
T1E092AF236D352033ECDA877AF98349910EBC135EC9A7B8488DD049621DB1BC1A2955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 89d09e300d8a6444040832d888ad40e1c2332e7bcabd08776658c861f31f96b5
MD5 5a517ab6c7972cd5e6031dbfab6d171b
SHA1 b951e01606d7638086731ac31b70274090169db7
SHA512 4e7806e836f07bb24429f19c45115ddb575fe5c9bdd9d1c76faddf4879de3fda3b0f41c52dde871132a3938164a810bd039102de493c3c166fcc9517eca28d3f
SSDEEP 3:MsEllllkEthXllkl2zEflpVK/l/:/M/xT02zBt/
TLSH
T1D1440404FFC00C0FC50510314055C3D03371FC100515575374D104335CDF7700C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 480bc5e9bf6966caa1b97128f250f0eb070eb1121c1d81e46c3164c675306af3
MD5 d58d75baa120cc2012eeab64765a4366
SHA1 49d1a914bf866a2ca9681ff59bd3d24238375d04
SHA512 a5db23b82d01f2cd419547b1b74ad65a471b5e5a42dc77643ca16e946ffbad08ef06a5575df2a36746e7a708ebc6d749e7f0a911d2c7ebd1f4db76bb150297ca
SSDEEP 48:E4pvWqp/IHRH34kWqB1kQnjhHmr6ITmUi:E4IKIHRHIbKkQndHmLk
TLSH
T1EC42786EDA2CB9A2FEE00B3ED7D1D4127B36A60EC2E8D5F1099B505746C444405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1588-361-0x00000220E29B0000-0x00000220E39B0000-memory.dmp

Download

memory/2404-530-0x0000028C2F340000-0x0000028C30340000-memory.dmp

Download