e95c4185d0c489862d2073f1c35107a78633f335254db94aa8754538c2864b4a

Analysis

user interaction
yes
max time kernel
127s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Versicherungsschein_AS-9311002026_163945284_Ausstellungsdatum_26-08-2026_seekirchen@frigologo.at.pdf
Size 169KB
Sample260826-pmxnnsyfqa
SHA256 e95c4185d0c489862d2073f1c35107a78633f335254db94aa8754538c2864b4a
MD5 7650df967a88a7aa16d247ab32e7e24d
SHA1 b9df0c0f52b3eed97b8eb26d642d71faea057615
SHA512 db62fb8721681d326c8fab84ee78d96a99d91939d3fd3cfa6e1483dc3afbfe1a8f1b6ce01cded2b629b0aa2a3f8fe3a5170059bc52b500322f05d20d3e79e362
SSDEEP 3072:iDCDlhczUP/6hOrBrMk8mogCOnkG0X2d7WwRolUrNUosexgRgIUqZkw+VOW:A+h2Un6sBrMk8akG0X8arlUreoseNqZu
TLSH
T1ED041376F22DBC5AF02FD21BE0F83445A61BF81F2DCDB99B183642556D80A686CDD9C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process
Email address	68	[email protected]	5316	msedge.exe
Email address	178	[email protected]	2120	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_969054575\_locales\it\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5316	msedge.exe
2120	msedge.exe
2336	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322209339186598"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BC06B20C-C874-402A-9D0E-EEB117D9AFB0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{3E4B9791-CB48-4939-9EFF-BC9472FC1085}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F5A5713B-84C7-48FA-840A-623E68D767F5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F9AF9F88-614A-4509-B6FD-B34CBB1D6DBA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4976	AcroRd32.exe
5904	msedge.exe
5904	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe
4976	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3840	4976	AcroRd32.exe	86
PID 3840 wrote to memory of 1060	3840	RdrCEF.exe	87
PID 3840 wrote to memory of 4512	3840	RdrCEF.exe	88
PID 3840 wrote to memory of 4512	3840	RdrCEF.exe	88
PID 3840 wrote to memory of 5228	3840	RdrCEF.exe	90
PID 3840 wrote to memory of 4972	3840	RdrCEF.exe	91
PID 3840 wrote to memory of 4972	3840	RdrCEF.exe	91
PID 3840 wrote to memory of 2960	3840	RdrCEF.exe	92
PID 3840 wrote to memory of 3860	3840	RdrCEF.exe	93
PID 4976 wrote to memory of 5904	4976	AcroRd32.exe	108
PID 5904 wrote to memory of 3340	5904	msedge.exe	109
PID 5904 wrote to memory of 1908	5904	msedge.exe	110
PID 5904 wrote to memory of 5316	5904	msedge.exe	111
PID 5904 wrote to memory of 1908	5904	msedge.exe	110
PID 5904 wrote to memory of 1908	5904	msedge.exe	110
PID 5904 wrote to memory of 5328	5904	msedge.exe	113
PID 5904 wrote to memory of 5328	5904	msedge.exe	113
PID 5904 wrote to memory of 1504	5904	msedge.exe	114
PID 5904 wrote to memory of 3448	5904	msedge.exe	115
PID 5904 wrote to memory of 1504	5904	msedge.exe	114
PID 5904 wrote to memory of 1504	5904	msedge.exe	114
PID 5904 wrote to memory of 3448	5904	msedge.exe	115
PID 5904 wrote to memory of 3448	5904	msedge.exe	115
PID 5904 wrote to memory of 3520	5904	msedge.exe	118
PID 5904 wrote to memory of 3520	5904	msedge.exe	118
PID 5904 wrote to memory of 3520	5904	msedge.exe	118
PID 5904 wrote to memory of 2016	5904	msedge.exe	119
PID 5904 wrote to memory of 2016	5904	msedge.exe	119
PID 5904 wrote to memory of 2016	5904	msedge.exe	119
PID 5904 wrote to memory of 1788	5904	msedge.exe	120
PID 5904 wrote to memory of 1788	5904	msedge.exe	120
PID 5904 wrote to memory of 3600	5904	msedge.exe	121
PID 5904 wrote to memory of 3600	5904	msedge.exe	121
PID 5904 wrote to memory of 3112	5904	msedge.exe	123
PID 5904 wrote to memory of 3324	5904	msedge.exe	126
PID 3324 wrote to memory of 6008	3324	msedge.exe	127
PID 3324 wrote to memory of 2120	3324	msedge.exe	129
PID 3324 wrote to memory of 2880	3324	msedge.exe	130
PID 3324 wrote to memory of 2880	3324	msedge.exe	130
PID 3324 wrote to memory of 2880	3324	msedge.exe	130
PID 3324 wrote to memory of 1784	3324	msedge.exe	131
PID 3324 wrote to memory of 1784	3324	msedge.exe	131
PID 3324 wrote to memory of 4824	3324	msedge.exe	133
PID 4976 wrote to memory of 5020	4976	AcroRd32.exe	135
PID 3324 wrote to memory of 2116	3324	msedge.exe	136
PID 3324 wrote to memory of 2116	3324	msedge.exe	136
PID 3324 wrote to memory of 2116	3324	msedge.exe	136
PID 3324 wrote to memory of 3156	3324	msedge.exe	137
PID 3324 wrote to memory of 3156	3324	msedge.exe	137
PID 3324 wrote to memory of 3156	3324	msedge.exe	137
PID 3324 wrote to memory of 5608	3324	msedge.exe	138
PID 3324 wrote to memory of 5608	3324	msedge.exe	138
PID 3324 wrote to memory of 5272	3324	msedge.exe	139
PID 3324 wrote to memory of 5272	3324	msedge.exe	139
PID 3324 wrote to memory of 3724	3324	msedge.exe	140
PID 3324 wrote to memory of 3724	3324	msedge.exe	140
PID 3324 wrote to memory of 3724	3324	msedge.exe	140
PID 3324 wrote to memory of 932	3324	msedge.exe	141
PID 3324 wrote to memory of 932	3324	msedge.exe	141
PID 3324 wrote to memory of 932	3324	msedge.exe	141
PID 3324 wrote to memory of 2612	3324	msedge.exe	143
PID 3324 wrote to memory of 1216	3324	msedge.exe	142
PID 3324 wrote to memory of 1216	3324	msedge.exe	142
PID 3324 wrote to memory of 4628	3324	msedge.exe	144

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Versicherungsschein_AS-9311002026_163945284_Ausstellungsdatum_26-08-2026_seekirchen@frigologo.at.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1229147FED10C6248E81EC1B51C64C9A --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A144CB8C9A33DE14CB452DFCCDD12829 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A144CB8C9A33DE14CB452DFCCDD12829 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=97A6462E8A2A7C6917D2C484879D5177 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2159175CB03A822B4E771FE6CED57D9A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2159175CB03A822B4E771FE6CED57D9A --renderer-client-id=5 --mojo-platform-channel-handle=2428 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C44AE5EAF931EA910976267661F81355 --mojo-platform-channel-handle=2808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EEFB963797114824CC732371E218F9EA --mojo-platform-channel-handle=2984 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://air-conso.ch/allianz-center/web_cim_allianz.php?from=AllianzOnlineServiceSchweiz&AllianzWebservice=163945284_zustellung_082026&id=c2Vla2lyY2hlbkBmcmlnb2xvZ28uYXQ
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x33c,0x7ffdf5bfc188,0x7ffdf5bfc194,0x7ffdf5bfc1a0
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,3288744944826327161,15261705516001518275,262144 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,18209802153591891939,5278844615147153938,524288 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - A potential corporate email address has been identified in the URL
    - System Time Discovery
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12433355484116714553,581904997656378565,524288 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,2457171628914158361,11688782619061268243,2097152 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5174498349199021870,3817128395614820323,2097152 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,7856550575010920337,17395105721587268995,2097152 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5136,i,4731661474304452694,13584145833974338001,2097152 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14528751523561532652,8820100448128227058,524288 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,3490468161158073686,3870261138908126262,524288 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4702893385311703618,5912744467708807561,524288 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4702893385311703618,5912744467708807561,524288 --field-trial-handle=2292,i,3052471682895680487,1193472778333217821,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffdf5bfc188,0x7ffdf5bfc194,0x7ffdf5bfc1a0
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,17187746384800297071,12579965091000377180,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      A potential corporate email address has been identified in the URL
      System Time Discovery
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,4305662847207720594,8492499333271943156,262144 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,11446131217488054481,17874678831720929018,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,14252121938276406668,4053838761594214788,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,14252121938276406668,4053838761594214788,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,5840788299073721645,12380158716364825109,2097152 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4968,i,12248874508895242332,9797331181076483916,2097152 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,10151016000820005848,9489425405166717624,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15719552716860913053,11442428016006701729,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5912,i,9472453982075484417,12255228482059045558,2097152 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5396,i,4370163951703191839,8742931335863527801,2097152 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6636832327063302379,2795607581133837952,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,10207207852277552383,9222789458836630181,524288 --field-trial-handle=2344,i,16157659088257436901,5372071053057425744,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      Modifies registry class
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x228,0x7ffdf5bfc188,0x7ffdf5bfc194,0x7ffdf5bfc1a0
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,2511012359123318561,6455746397322408266,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10873691489383900527,8989371571525260619,262144 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,4102830456246228511,16509905251209420785,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,14602682018943305646,3887080584320151419,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        5⤵
        
        PID:1116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,14602682018943305646,3887080584320151419,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,17081314551212267452,11094607975684061027,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
        5⤵
        
        PID:2028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,8929905757035280368,5724370628873838404,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
        5⤵
        
        PID:3348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,5188056343636464794,14588813173320985784,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,11938460936704452489,6942928692829504927,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,3549453115977944885,8636167548825232087,524288 --field-trial-handle=2256,i,873161635119417573,675761319464097267,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
        5⤵
        
        PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://air-conso.ch/allianz-center/web_cim_allianz.php?from=AllianzOnlineServiceSchweiz&AllianzWebservice=163945284_zustellung_082026&id=c2Vla2lyY2hlbkBmcmlnb2xvZ28uYXQ
  2⤵
  PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 f1f2ca688fd501c9cbcd78a3cb41b184d82d326f00799e8855f629934186c2d9
MD5 41441af549b7e934a309fe0ce01759da
SHA1 98b4ff87c0d8cfb69f2e9aba3aa1d95d683398ec
SHA512 e5de5fc7475035ad4ab71b2f26e6bfa9f44edada88f9890616657f8e4fe22abb64e237b0a375a28745d25061ec5c08eda56aedcebe5213d2412933a91ca5f8d8
SSDEEP 384:ye6dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:5+eUZsLQCZsL3hUS4
TLSH
T14253CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 de1fc7a0177b08519f85d74ce25f518bfe5a9aba75a387f8dd9cc1a401d5a2d7
MD5 85a1b58f6d6e5f6ba6a1541e1666568a
SHA1 40dbcbc8b9f5ad88dd1915fdf2916ea3c8f27df8
SHA512 30ea5a53d4774a447701cd17f84c0c4d59e4b7ca39ea9e3e6747172ca28d3c0873b02d8c9d01de9c85d64e018ac8f15342365deb09efbe51a29c5aa83361a5a3
TLSH
T1B2D0A7DC95A9FBF0F4371D3A6238821076CC2B929913631DD19815524D9B05210D5DD4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cfd80657892631a5680a7d985fdd997d12f6056d9da35c3a15a4ee2fe33cfe4c
MD5 1a6eae437aa9c64b1627b18923698c98
SHA1 db5528ab32e9e79b7b98dc70f69440bb6174e68d
SHA512 40c660743877cb54ba040aaf657c2d52a9eb48b3f624cf1b8b32788e8bc1913c1162aa354d7b1371a48799ea5cbf1f178f15b7f3bb6dff4dfa81208c27ee8429
TLSH
T164D0A7DC9684FAA0F8373D3561398610B6CD6A909C53A32DD298129248CB17320D58D4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ee6837e2b1b77cd46cee53ecc8c1246560527e6ce04f7a0212e0de0210fa14e
MD5 ba8a65086b313d6a4d61cd17fd6a373b
SHA1 b08b2f8a8170c4bb5bf9e1f8c68b19d8faea6be2
SHA512 b1f7305d4b2597e939ca866dc1e3030ab2d1a3b9279692514c8761d2398ed580ba9a90703722afa567fde4da3aea6667b389d8de10e9d9096b8bded08543299e
TLSH
T1CAD0A7DC9684FBA0F8333D3561798610B6CD66919C53A32DD298129258CA17320D58D4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d1aaaa9854dda9023de20f9d62ad4eac02fb5638dc3abb2ecf6930381b143f48
MD5 19bbd9eb3b85b1718ece832bdab2801a
SHA1 09ff895293d69e38519a2efd5ed7b73db014c67f
SHA512 b48ca023ec9268e6d1ffe348fec205f984d74b713bfadc57f753629c759b424e5e683b686663eac3dd9e126393688c9c47b8c83649e26fb382e2e09d6e041b39
TLSH
T1D5E022B6CC22EC3B08FD0768A01D864BE70013573A80895F3B3CC2088FB463A46C9C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e915ac93390c01b3b145fd12aa450c9000f75d99ec48724d5bd469229530a028
MD5 f08976d5cb44c5d570bff768008e7194
SHA1 2e31f5c82958228043fc8760c9ebeaee9e7bfaab
SHA512 f3feedbeff979af045d2975598cb0fd98be7edf587d793877799e3b59df06d73298c052863b885840a24e00fc21d450c6422daf26d7cbdd6162a9622fa79e97e
SSDEEP 768:9SBesl2xVxrJPPpA7ItHB/MvPxwDxAjweY4Zke:UBYxVxtPPp3LEOew/4Zk
TLSH
T13F13B1BEBA0A9CA2EADA5C7C480B4A352339D470FED14303777132965F7230E697E941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2bdcd9bf260ac067b031308dceed67356082e7bc7d10e7a886b6427aef41e9b5
MD5 2efc9e8fd144e8f9d9a521d3cf03c9d0
SHA1 b267a36e62ff190c4e6030daf06d71abe7ae391f
SHA512 0b6767f086fc663821302ac79138c335343c245297993605bfc5d5167dd348a8df471d4e2abcb870875bf85ce218d490261c67e5ae0443acab1ea6ebd196a31d
SSDEEP 3072:yL/uL/hiPFR/L/PL/CL/5mWQlF3GyTnD1e:yL/uL/Q9lL/PL/CL/wWQxD
TLSH
T1F4446FF30941A45BCBA842F5D2023A3DDD7B055F7CE1E8E9E5784CD12825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 3edc27d6d2ff6752f500535cff54b0fdb27d742eb9c3154e62ceef29b1c45cf0
MD5 f07339dff1fc539da8db97d709030a64
SHA1 a7b6f8af2a97e01419e8b8ad00362db0c8e7e09a
SHA512 1d651293da92abb2906cb8a59ca61ce9c48ec54633ed69b3cd52b1567926474d742b3882227276c9925e0c339beeeffe0482be15960e0568b9adcae4db0bd753
SSDEEP 3072:1Xf9y+HI5/uCBLG2b6aJN3QnlcZc5z5mAhi3TyrZ2E168/pWGV+Pssu:hf0v52g/hN3IcG5z5+3CZj1F+Us
TLSH
T1E42518FECB682C82CA6B867470E0D9077E712183B69DC0D39944C5D997D2B8176F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 37b52022a3eb77f04f286fbef3c0ccf79f670ff171d16c7e5d1a59b9e7fb76fa
MD5 b47993a53c0527e3998c905ccd9ddefc
SHA1 d0a71bd64a713c96da7d8763f772b83c6d8299f2
SHA512 c9e3e42fab4b480f523e5b4a2c31cc3d12348c5637c819d05bafe6f2df84f780122661203985c794c357ed7433bcd21ba2de76ca875c66f9cf037b80586cea20
SSDEEP 24576:gYIollXdYmkVoA59FLLlPygYWAM9PJhe49JVs6uYYoPgvVwlBVY+NeL+T:gY1CmkVLlPTY+Py493sIYoI6VBU+
TLSH
T15D868EEDCA6898C3CD639A70B1F0ED477C7413C3F995C1D28858C684026B7C5BBAA66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d544ed590f0dde563df8ca6a51e9ea07ef30ffff97ba46d175b0397d4a0dc87e
MD5 4e7abea57882cee6240aead1bdc31502
SHA1 429b264bfba7303b71c58cc1792b99317ce715fc
SHA512 0a91253fdb93305436c15a7f1ac39a2d0397c414900d9bbee7eb172ec70b86af759ca972f9472983897acea23968bd5e475e2efdb6cfc7f20196b92f61ede239
SSDEEP 96:EZPxxPojou7WJL9ve6Fy4HHYCfLywAbJ51RB+:ENxxood1e6U4YCjywAbdH+
TLSH
T18DB1E7701882AA63DB938A3511E81A307C3345E9FDF3AA9E11505CF6ECF6F72463B515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 48560e2e7d8adb7432a5f1264c5406c9a52934503a303cefeeef1c1baee63e8a
MD5 6c4c7db111049df756a5ef59a908fff3
SHA1 6d5b216b7c18e42dd4cc049452a8a18afbf95924
SHA512 9b8d94cfbb1ffa01ba0167f8c8cceb9b81f808a421e25bd74d83d54114ac5cf35b82cdc5a1199befca790dd880c8ea222aedb3790a5fe2052a89bb1d6ab70970
SSDEEP 48:NExvshmt7n8MrlaMEg/cGrPmrJ5wBdKzyMlucAwDfwwWQlU9ZDiI:NO0hA5rEMHTPmrJ5wB0zNUFwD1S9D
TLSH
T131910930084291A7C3938A3141E8563438734AEAFDD3AE8E11501CF6FCF6F764A7B959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59113c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59113c.TMP
Size 3KB
SHA256 83aaefc2820690fa9e4ddf030f541f8701227ea2448684e668ea9a1bacc6da32
MD5 95e26efb9694bc2b2c538016da677fd3
SHA1 c523f736732d4c5b3a2ee02eed702a231e9a0688
SHA512 9eb707b0136787e7a879fce60359649168f878671bc81d1d22b19ee4e9b4d895b4ecd995cd5ab9e9edc71394c4a0a9fcea161c37eb3034cfc2d4a250e9ee5e41
TLSH
T13881EA30185291A3D393893181E8562434728AE9FDD3EE9E21901CF6FCFAF73857B956
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 762c1a8a4b3e0c12652b189faf43fa3b850f7f6b4d3fd480303f4fded2c1011e
MD5 014107740a10b0ca6c7b3afb440cd385
SHA1 de2c493356f3c6b38b5d186b7861e3c0e5c4160f
SHA512 649255d36d46577da3f022d3c5443bf5bd25c1b7ed5160014067bf41dbf9a21f10eaa1fab8275dc560dd04ac1dac0baa77dc73ef5c4b0cf2933603e5501fd1ee
TLSH
T141E0D8E658CAC15D5D1034C351286708C3803552D78AFD4B5B00C8CB7692141B243646
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 30f1a821cee1ad66da49022b1a85c96b9f9ac7eae684ce7a0c527f34353596a9
MD5 3cde87325367e2d34a0adda13ed81283
SHA1 be8498f6761e5bb6d4876a8f9896cb5be0a8c1e6
SHA512 4037ecd116274dccbb84f21f4383d6d5a3bfbf66cd15f16f85072befdc55b82755df9a7ada470b0dd23b62b857eb7cffb9dbbb785646751c6195937562dc1e65
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jotW5Lt7K5fKFtI6PqYp6w:Tyi+7f+UZD4jJ/BMtWxlCKFOWTpf
TLSH
T1CDE2CE8D3B11F911C9ED733DB0C2C9E05EBC697C864D7171913899768D62A62F49E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 217e1e8059db0a5741eff8afe38932ef451edfc57dfea4b8745378235655a7a7
MD5 08f904e8d316ff6448c57dc312b6f22c
SHA1 71c3dea3d2cefef9b32d89778d8f0175e80bdc40
SHA512 9e287389769692d6748b96ed2f7d4fba0f1d0fdc8b8f4e596fe011b5ef6e6304d37d5ce760376080a76b2c4467ac332cab3abe316e47463e8ec3839a9438c018
TLSH
T19AE026E804DFC12D9A2468D7D27CA308CBD03612E288B98A1B0888407182A41A387BC0
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 9fd4ac7ec9eebd5e829cb88d7282e35af589923e4713003f5db9afdd5c43e30c
MD5 0e5861701c748db37f8f3e9f0720b36a
SHA1 5d12e6af99e1e571a872dc8b98b7bbd2df3d33d3
SHA512 c7be7c486bd359e5a5f3705f357b38bf96bd804067d36c2dafcfca5b9f6d1b10772c7f653968e9cb5f1039e28af536d1b66098bfff7a41e16ecd9fb1025b0f5f
SSDEEP 96:UBCxXFjooV/MXixoMDepQRIadHetxUAEYOPA1Q:GaX6oV0XqoRQRAtxUAlOPA1Q
TLSH
T18BB208CF3B783C63DF590CFE302A69789E7BD20D1F69AC56782054219CF8A4954395AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 02ee4345dca46bf8760be393a3bf5f50754839e955651687dc8ffe63d5086be7
MD5 52fa500e053df6ba52deff032c0d6d32
SHA1 04781dc6e39b781360782a95c3ec10bc62f98f72
SHA512 4a46352011301574fed3a0891a81a7745b60151ac4d1d5db73a0abee9808b328d5d89716eed97fe01241808db6742e415a2b3d622145c2ee597ce1fc3e0b9d5d
SSDEEP 192:CoiVKf+G83uy3Ct7XBBK7gQvos3H7DXspU3it:CoF/83uICtTBBYvoY7DXspU3it
TLSH
T10214425F5F342722CD7D91762CE754E75D6DF03FCB1266CA686114B0CEE2A42A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 9e0d417f98bb8a08d79f065029485e08a899d6633438c83ff7aec122a025db1f
MD5 4de49c6fee4822a7a794d7964e1f9b1d
SHA1 c94ced02cadfd5fe341fce09a0bc80ae69215010
SHA512 647144b8fc76be8dee267f0539cb9becd0883cd6e517444333dd5ae7f27c69955d3691b0164dfb17300b29515b2d542b517253dfea7df0fd0e3e2a9e509562f7
TLSH
T12E21797AE9A8C051EA5E84F622B7713953C9B0B872DC6785DCC64C0EEFC14B81A18720
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 34168e99be42c3b6a1d227a3d580228d679a6ec26d798aa07c842bb3eb3ac530
MD5 64473ff197e97b3249e3ea589d4c33b1
SHA1 93ff50e7f0407c7b0e0eca87e51028117b5b1abe
SHA512 b6e89052b54bc8a3cc968070cbb7b606f2131423b07bdd97a430d968dad3823aedb529439065f7355be399b86d9545f7acfdc75be44fb1bd5982db45cd5856b0
TLSH
T1ADE020B655EFC12D5A0820C7622CB70CC7B03607D688BFCA5B089841B042844B3937C2
MD5 SHA1 SHA512 TLSH

Submit Download

83fc7b07-6a17-42da-96ea-e6b7382f9627.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\83fc7b07-6a17-42da-96ea-e6b7382f9627.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 8f7631d42bc5213bcfe134aeaaaaf42d1e168f604285083c3a7f1f845a12a9a2
MD5 bbc1356635f1ede0226d24ee3efcc2db
SHA1 991575fa8e5171cfb86be80ba402e34ec6931c84
SHA512 2dba41f51f77427ad2d2ccbdc9af7086dc3a56be4c751f16a5781ca117b93e4b148cbcfaedea86f439a186776f1568169d5b342e8227932dd928267d3504b44f
SSDEEP 48:T2SLopFMatSaw/auUOt8B/5LqNHNLKjzMUwJIfNTfIm2HNDXLg2Ib+oQwx4fkUXo:iSeMatUaAKhGLKjzq5mKgcXfLECG
TLSH
T13A92A68F2F247052C5A1DB35D9E5C81A2FBC011CD327B5CA6946B4B38EA298FF2010F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1aaa2eaa52d0cd487b11d8149c7e81dddaf6756d42053a6308e0bdfa84661351
MD5 42ffbda61cf95eec844ab3b12f44be40
SHA1 ed7337adad098c70b449e9a3d12450a094cfe221
SHA512 0c1b6a8ee18e6ff2c2cc7a6c277d2db3c225de977d152512e2b40f7606d192a08644920383edca49e462d91ba33377b34f18663e39c812dd6a3a0d37a80baf57
SSDEEP 96:D1JEO1IenlXegqQsResJp9Raaij6VzcJTaE9qaP6rbUfPXGwB0mNPU/qR:D1hiIdPBqFJzRaaij6VIJTaE9qaP6vUB
TLSH
T118C1BBFBC3D8C12D891156F4AB16AF1FCE2E0614432C3C6A89D9BF1B93E2871E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1a49ef85b3f993e2b5c4dd55b4b50308d94a1cdb0ec5a88649ecffff64f58e2c
MD5 20d8e7b4ac9a4d73070a7a922cc3f866
SHA1 dc92dc809ae9ee56404692396ce1f924dbff6823
SHA512 a876e4ea58327027729b5aae2b89cb38ed5c13b21ab13541f594fcc54121c8a703bd70e5c6771adb111229cdbb8dc041fffa463015eb30ca1773f6d17e2f82e0
SSDEEP 192:D1hiIdPBqFJzRaaij6VnUGIRHSoqaP6vqkfPyNPsHE:D1hiIdPBqFJdaaiGVnUGIRHSoqaySkfy
TLSH
T1BDD1ABFBC3E8812DC91156F8AB25AF1FCE2D0614432C3C6A89D8BF1B93E2471E15565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 bd75f3cfb52b7deeb0a9ae0c558f908b131911a6fbbec97e384507c2308aea7c
MD5 f472177662c3efd61034fcf35936aa97
SHA1 7c2ced4e2cb564465b010a0b260fcb0aca6ef6e8
SHA512 bcbd5e5e52702cf0615a43b90137050053fa538ef499a7c30bfcfa34618a72756149865d2e08c2779f5f7f15f8e8a316fbe93d0f467654d16de6bf34c960ffaa
TLSH
T153F0C963E1BAF027007848BA0F41BC092D72B8380350B8E5DE5FD12CF0810F72F12096
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 d1788918f9f27e82bfe59905ebbad5d371882e9f93957ddfe1235abf9246a79f
MD5 bdc2cbea232536480652a3d40facd7fc
SHA1 fd0bd591b466b0f45f883f5d4b9ef419e83acaf2
SHA512 af7cec47f15432bc797fd084993d933310b0967367c230131fb10bcaebe2cbe5277736fda0cef2b74efef71789fdfcc8778875f9bd98bbf0533ea3fe3565a33c
TLSH
T194F0C963E6AAF5730079947A0F04BC092DBAB0380550ACE8DE9E822CF0C10F31B020D7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 aea250f30396d021a3c4af1a5d9a595175577445fd77cf9029a86b2cd24a238a
MD5 2e88550a9a8995dd7408ca13133bf6a7
SHA1 aa1b2786a6fc05c9856a7dbbd1feb0b0d2a62d50
SHA512 7e81f3258f6429fdcc6d1cbb426511fabfa612d466ac31b802e190ef49d391ddb5eb3f45006dc31d42ae11a3f4a3d60e9c973550b44fac17aa5be4fb411c4bc4
SSDEEP 384:sxZrgCj/fjs9WvnSzazIKY36zHbefTu4Z5:sT5j/fqYSzazjHbYCA
TLSH
T12572E806AA745D7BCDD7D209FA45BB63D6F8062291905E8499FC8E1C00E7BED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9cbe8f6862c6f5a7c9a792485b788a1492fc35c2adc73383a10c145471557784
MD5 ec6781d9aa93a8fd7081ac1d2c70e86e
SHA1 1b277af1b411f614d8bca73abe414364bba33205
SHA512 0f32ea028b53466390de864ff809368618c1f494a3fafd4cf4c434dca0777d86fe8602e9fc630766d0a9a9b6566cb16a29ed57b43878f2a799840408d3489014
SSDEEP 384:sxZr/4j/fjsIWvnDzazIKYBmTHbi/tnZ5:sTAj/fjYDzaz/HbYtf
TLSH
T12472F806AA345D7BCDD7D209FA45BF53D2F91663A1905E8499FC8A1C01E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 263dc27a4ec16736ac9032f80c053e3850ea06e37474500a1b993184ecf59122
MD5 ab1ee4c3db295b0a1e18c5e4f2839637
SHA1 fca8ccb4b4c3bcf3594d6c34d79f171124785061
SHA512 2796ee1ef972819afd12b098eec233a5105879fdb07680a796a83c7d463c2d1f1a022a2f6ad98abd9db98499a5233f4f1415045cefb79fa776a61de703a0c347
SSDEEP 192:sxZrRqyMqZjK1Ml8Mjj/fjss2D8QaZdIaRuvHzodpoiUCHW6+WNrgu/Yv4uV+f7V:sxZr/7j/fjss2DzazIKYMTHbZ/f7j5
TLSH
T11E62F906AA34597BCDD7D209FA45BB53D2F90163A1945E4499FC8B0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b82cb093b569b72b72ecbfaa8ab5dc09407264e172689ba436b4754856be58cf
MD5 cb07d4ad9c2432ef7aa33701fb7d7160
SHA1 f39c8c7851bb30237f9f9c52999ea8a979632315
SHA512 fb79e182b35aff060836c6ca8669c1a02d03352c05bc67fb8d519952e9db415828ab8d0ddbe0d7a0ab2f37575b5dd17b558bebfdd0dd7576486434ed3356a1bb
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9ysy10LlC:eY8Od/HEnFhWvFvmXu1jaRt10Lm2NuOC
TLSH
T1E9F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE801CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d673b1e3d3780ea5a43d9e2bc66910af023d0a6207f0ec9d83c8dfdd70d2cf82
MD5 8c3b7c3bd60f9866399503970beb0e21
SHA1 9e6c142e664b6cfdf42481662f78dd7f9bfc9ab9
SHA512 825aa22ca0ccaca060b62c33493fa5ef034cf1532faab2203e53b03fe099ba84e5a9eeac6ace196fd6254f9268d116429afdbf01221e02b5fcb5e01ec77ef93d
TLSH
T141E0DFB009CAC17DA95920832228D74CC2E87707D2CCBD8B2F018C816183904B397380
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c0c59746b2f6c822caf6ed68f4eeba2c0e36e645da91d6aec3395636c67f397f
MD5 c3e79e33a0b6532bc5586748a296b402
SHA1 a0247e0b17067e97eaa4158ee0836c7321f26405
SHA512 01783f6e0cc22bba60066d8ef5e05818b05ef92c5bbf461ed487017cc20e7f74e3c47ce9e386da0faa27678d60214d8e19c838f635f4478fa5a451caae198c64
TLSH
T103B02220B080BC3ECE0C02F8AAE0C0C020033C00BFC2800338E00200800B0EC82B2880
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 88c5ca9e99ba4d3927484063b2b27b0ae4a1f5ccbcbf996fdbadb781273f8691
MD5 5ee4fbafa543347e02ec97c170ec731c
SHA1 096ba5b64fde0e84f964c99d06f5168781452ff8
SHA512 26fd9cc54facdd627d58f742178cd5238cc17946f035781efa71dd6c4e55c005899206cf9f98f414ff727b48253d1ecf88133432fa03e892e008ef1879ad9f97
SSDEEP 48:TlOIy4m1b3fbUtnq0BksX0PcSOIKJ/WibTXSqFvx:ELcPBTEibOivx
TLSH
T1A21321DF2D14B582D2E5C130E0AB9EAE6D3F324C9EC358D548A056B30CC186D082F1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f671a6d4b215e5ee6096c0a97b3bb5883f266ae589bbd08f3f945877b704710e
MD5 14cb724898c40a921e15fe1fb9102494
SHA1 b8e381063f3bfddfe5d5db38521e4779c425cd25
SHA512 4e3f1d819ac9d97a04f99361692b391042a0a8ea45625159ff7accfe2692f2f73283ad763c405999fa60f860a551fac86bd2837dceef79b4dc5108d18380e980
TLSH
T16CB012443B20A315E4D9153405818B489700F00120415873ECD85F284D0AAA46FD5CC0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 0c4e4d04675b3f85b661653f15d4eac9d2291e16292625178c0db03c78789a51
MD5 c1356787d41d7c2d9de7dbfd4e15b980
SHA1 37665dd9c8810ffbc5d71bbf6d2fa4bacb71e836
SHA512 7eca76f6caf8f8e511625d4ca9f5128371cab4263425eb52aa47faefeb06d2a6bcbaa6a1dddc83e1dc4bd6b6743251c2695f3ce8f94ec402119c20b04a0bffb5
TLSH
T178E0DFB416CFC23E694624EB7229E308C2B37543E6C8B99A7B0DA485A246640B383290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b667bd5dcb47eb1d21fbbe0809d92801167b6ca127f0e3e8e98caf37be245b48
MD5 713d09ca48853f422cce21fe41fe8390
SHA1 ff13a59a054fbc141d0e30e3fd1a0975c7818239
SHA512 14009aa63227f7fe81d623cafcd09ef5e3672fe0c0991d56c1c2af9f2722b7c4c924207a8abc0414ad887de04d0b7d59a8f3b615c2d8f1aa0bc279bd6bd2c370
TLSH
T12DE086B045EFD33D680474C366B8E70DC6F0795697D8FACEE70C4455A645644B3E7680
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a3a6e51fa352220053b2ec11beb3835e53528c5dfa2e1229a08213e6da7a7d5f
MD5 609cc3dc27b91fa06c6c94535d5ef6ae
SHA1 1a1f43fc43e3940e58db74f6a47f8e7a84be00ed
SHA512 e71bce7b9631f5cb17a946edb575ba355050e6c52add0a9fe97039ce28bc32897b3ab89ba570ff308a5948d8354f66b8b45c6724b8cfb081b07fea552e055dee
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGx:05ppxnY753RNBvRJJdt7p5J9x9db
TLSH
T15CB2695A703E0211397E6988B39696364F4235A37058E4BF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 5612c96c7e8445e02966d7d4d12a1c05e6c8b2d704f4da98fb376e7099c977dc
MD5 574cfe865288b58629b8ff8b5d48ce6c
SHA1 6ca0a2e4f94df8dc7e17c8efdd9f3ffb98d73b75
SHA512 9c4ba55c085602cd7c048501140c96ec4ba0be2d48e14b62066100ebbe55c453b7d72e32a05c300ef1b6cf98f3fc7d81931769725a37ec414d65373cd52dbea6
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGv:05ppxnY753RNBvRJJdt7p5J9x9dNTnv
TLSH
T15FC2545A703B0211397E298CB39696365F4275A33058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 dedfa05a4328c2298c6dd68abf87716b3e1af9a2a170e8f3706e303691b20e3d
MD5 9217336eb95551b25fba4bdecc58eab4
SHA1 8438ab512f46c542e919fee611d99b4923d1a57f
SHA512 5aa7e70c21158b11f9dd90674fb0aac83a0dc49bacd5ba580916957d7fb4c61f8a0673df0dd849e573e3aa691a74726cc1d9d7767dd101ec6b2edd716bf3de3f
SSDEEP 192:P+xWbY31fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxhFfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T18924740A7B747001EDE6E9725CB080771E3CB16DCF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 4d8d874fbf3d9a53592ee5b5413210497db8268bc4923bfae14b81ae5a065b27
MD5 689a74703e2d9c2c47bb92086485a195
SHA1 19afb671212363da0dd06a834fddd8c8ca8121dd
SHA512 b5a0ecf7489e931e188407c4679b3f22e576dc99a23b5c7c251aaa9749b3008704f262659a6b72adbfdc7efd10818a56cd8d455536958d7dc7a23fda4eacb040
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgXp7jyQjX3QjA3QjHp7jmtjW:DEtSyGhp22iSA8A3l3eMty
TLSH
T15952DEDFFA342513DAEA83726DC141D46F26C12E4F81BA0354D420207EA4B81962E18C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2dc7d36-173c-4d42-8147-a50adc515452.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2dc7d36-173c-4d42-8147-a50adc515452.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 5751fe7b6d81060d4742f1e53f1a9950e7054087ba183cf4ecb70f7ecb9fa1ee
MD5 69568d26e850e01431bba335216bcfe4
SHA1 9a6ea3c23671b2a6cf970ba0576a3c010da4a868
SHA512 f29d309302d8fc1a716a96d286ae36ba91c14647d67918e0c60c7858dfd1eb47a1ee6e86173244131d8115df2d35d012b76c42c70b9d47b23a89192642159d5d
TLSH
T1525185C193FA14496F89A985D30D5813BDE53E56220EA8F5332E44F46F84C290F6FE35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 6b0feedeaa6932f44fa678b350b04c33e03fff945ac05792eff90c90a87714df
MD5 40811ba6af142a3deaf4e8446250eac4
SHA1 df367605727ad96fb1868c0d32995d65aa661d22
SHA512 b8e7550ec4c81902ad8c9c335a3318728bd4451f945885f89d76dbdbf10e36eab11e058cf1761c6345fb59fc7c5acfc69b84c77fa47844552d85871691262b9a
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flR1DQ0IIIrb7MIM9cYcYW:GAhsBJGsca1DQ0IIIrb7MIMWBR
TLSH
T11152622D67057B3BC05E2F76135646689BD5A883427B322D30621C4F9EF3B5386C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 e5b5e958821bcf9ae9f3b6506118376ececb09b6d36dc11b3f754acc763808cb
MD5 bc3888498beaffe385103f99faa78b17
SHA1 8e62a89cbfddf951a28b5fb80c0c2a1adfa82ec3
SHA512 6f3ec014ad2f3ef7e4b4af027d413f98de5a25cf03d74fb3f695896634fb235a632988bf8e3737b84e4b2415853dea40d74f1eef4c9dca94076b0fa005740013
TLSH
T15FE0206454CFC16EBD1830CB2238D30DC2813503EAD4F9CD1F00C4846843500B747281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 540973a847961e4ee6f1bf75a4d2490074c009a123db0bbeee783c265dda219c
MD5 bd45eec49a59369ef5a00a924da70952
SHA1 a1db0e13422135c1fd88944791e84f8591e32524
SHA512 6129617c0b057cce8f5763e8b2ca0827348cd71f5934c42d3a9e1f489f26fabc88c25cd14e3889f5bff92a08a6b9953ddfaf39c386e627175fd080652216e689
TLSH
T13EE0DFA4B8CAC1AFA95820C72168E38CD2953A02FA99BE8B1F008C85A142541B39B681
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 bab259095a6ea869187ef4b8bf6eb3fc8fb8467a7dd90f391f012b9ecb01f218
MD5 784000238fbe8cfca0db263f92d50d50
SHA1 2eddfd42ff80b4c731eafa5eebdfe915b75f6872
SHA512 62f01d45a6679fb14fe27b84e0ba047976e616dd52799765ce11b90ebcc14a91ae6133178e38c042a886db05a7deb10a12a07975dd174657bf9957ab734f1011
SSDEEP 3:MsEllllkEthXllkl2zEflhdltl:/M/xT02zs1
TLSH
T12E4404147FC04C05C500103144F1D3503370D47055115F433CD104735CC75440C10440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d6d14cc6b325dd4dad278e42265180930909437b08d12abebfb57c70f8b1babc
MD5 5f1742225940f1c24194298d2dfc6663
SHA1 a1fc6de4d354952b933d343b48dc066e7c8f7369
SHA512 8d9be7bea0564029ea74df451b88a774b1dc172a153eda450438f359af7277d783a2f8dfb9b81bc66ae561644c3d0be863387e888f2637d99f705439de545ed0
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9lnKphiftGm3pfXpCe4KV8p03LBty/7M:psFccps3bwgbkUpkoGm3pfgI8p03Lj
TLSH
T1E1B25C36E868CABBFDE74F89A75E7A03DEE4116786D899D4DAD81D0C00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 12457634c7eb30d0cf23989918a8c37ef04e59651d0bee7333799e71fb8e225d
MD5 9cf1ed89962141d6664579883bf23268
SHA1 343ba90cbcec77d836bdbe98765047a8bc4de370
SHA512 eb6b995779899a2280d1755ce4ee766c78789bc163cd72b403767016d32c96cca726974c2b8937dc9d79d268a66010faf0a8ed39fb19f0a6ffa23ac4d03eb3f1
SSDEEP 768:pLF1+iwgJkfvoGm3p9eDjSOlCK4GHMl+WN5ja:5+gu43S/Mjg/WNBa
TLSH
T18AE22972D894CDEBA8E6DAC9564AF503AEF44133869C998CD6F87E3C305F4F90306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ced8946896161eb58594e51118fce38a71953c5e825a9d08a47210c653dd95ce
MD5 751ea96ffd9d642c422197904fb93474
SHA1 2cc6276822dfe0c31306bbc22131bcddb6a5bb3b
SHA512 76c70198318e1e0da27a6fc367d5b9ceb5fe971f94902f36cbafe2a99d1e33167f20adc9f9d1985f635d9be3769a7aa8419080d8ca5ce9effe611becf795e215
SSDEEP 384:npFiF9CcmyWCs3sNr8TUNTUlIm2QckCr90HSphiftGm3p9JLIlpre4KV8p03LBtj:pMFccps3mwgbkUicoGm3p9CzI8p03Lj
TLSH
T119C26C36E868CABBFDE74F89A74A7A03DEE4116785DC9DD4DAD81E0C009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 389576e2e528a90ab98d03c5fc8bb83efa52f859c11e4f474c10bc4a3038655f
MD5 4c6a0eb9e8caa9b4e364670286ddd8a1
SHA1 2a5ac4a5ff75dff4cf2278be8b81f8d94ab3b86e
SHA512 9d845671e87f10a4fdaa589dd58a21ba242aec2dacddfeed484c5ea10c7c9f74a96b0d852f26458a1a1d9b34487202ab8f8c292ade32b89c2a8d7955214f9886
SSDEEP 768:peFZIWwgJk7voGm3p9An1aHKRshQdWN5yr:KI0a43oUKyhSWN4r
TLSH
T163E24AF2CA65C967BFEA0AE897273502CFF44123C5889984FEDB0DDD0C5A09A53C6816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 299c1cb56103fc251fc5c0a0d09617e888e0bfb9e5f7c517916e47e640e56f9b
MD5 5ade1beb44864bd5ad1a7f8c2d9b4a91
SHA1 e8504ee7b501ffc4341878d24f973ad3b6b7d48d
SHA512 0d90fda82562e3291a2e9e09891df55697eb1641e31563317be8fda4e68c0c026878676dc3aeec8fd3b4d6e40fb1b3c6614161f705364afd41c852d550f348c9
SSDEEP 384:npziF9CcmyWCe3sNX8TUNTUlI4OQckCruCRphiftGm3p9JLplpr3fhmty/7IgF:peFccpe3WwgJk8voGm3p9vzZ
TLSH
T13EB24B36E868CEBBEDE74F89E75A7603DEE4026385D849D4DAD81E0C00971DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5aeb7dbfb7f2734a32ca0097c097249f4a48d666cf728de3feb736d3486cc739
MD5 c15c2ed6c11770c5681edc06128a69c7
SHA1 7adfa39ea0cfe27f1406c678785926e7d0a15596
SHA512 acbcd7037a7790a0794006a45663127e9414186eb88f2ae16743a60fef545ef43d553330021623fc573d6fbb31e28dadf399623cf38806242f64dc6406b95f57
SSDEEP 768:peFZIWwgJkovoGm3p9An1aHKRshQdWN5yr:KI0j43oUKyhSWN4r
TLSH
T188E23AF2CA65C967BFEA0AE897273502CFF44123C5889984FEDB0DDD0C5A09A5386816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a2789b19fcb639f1573d71873f221921c466ddc880d8592ec98a1417f3f5a1cb
MD5 e2198612c76660d3ae228b9de1d459d0
SHA1 d173b1fe964e14309c3a26221fd9e5de3fe496bc
SHA512 f2a53601518e8f72bca1f799f0376d02cf7e1a0cfe1dc62cddbe7db4c9018bca651d67206abef70958fd0870a04c18bba7f83bd3b763b82808dad2ef6d662f6b
SSDEEP 3:MsEllllkEthXllkl2zEfl4f+tl:/M/xT02zBGX
TLSH
T162440414FFC0470DC50570304075C3703370F455551157433CDD04335CC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e73749da7256fe4bbf3e31cc886c5ec36a5e8eeb065a9c1905120d2cccd7e55
MD5 6966752c67d15152c405c68fe0dc6cbc
SHA1 33af647aa0832673b209168f4caeabc66398cc90
SHA512 c4a12e90aadf75220e941cb5fa0d55b97a038cc00041015e2c62428737d4e48b4638dfcd1381d7f58dfd18b6c8f96871855d06538892d6094a692c2686c17445
TLSH
T1FB41285CB6ED0148B3B7AF5AABF6A86D447ABC372E06D55E10110E4F0A67B40C861733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 33d7f8ed2cebb2a408921aebf13fabf5ec003c0e526cd395fd477fe1e47cdaa3
MD5 937d6ea2a61a7bc671660265ab312fe1
SHA1 30424cac332e831ee2ffff5e8e53450f6d741a42
SHA512 b09d6743774ecb73bcd3d7e58c399ab4589919066daaa3f44209fe0e3899e8199e5c4ff5d55d1d94d29aa1b9568b89031e5daf45a4a0d89ef66f56a9cc0a486d
TLSH
T1D7514C6866F91108B3B76F5A9FF6B4AE487BBD732E06945D10110E4F4A36A40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3112-445-0x000002822A3D0000-0x000002822B3D0000-memory.dmp

Download

memory/3940-900-0x0000017A989D0000-0x0000017A999D0000-memory.dmp

Download

memory/4824-623-0x00000263E3A10000-0x00000263E4A10000-memory.dmp

Download