e95c4185d0c489862d2073f1c35107a78633f335254db94aa8754538c2864b4a

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Versicherungsschein_AS-9311002026_163945284_Ausstellungsdatum_26-08-2026_seekirchen@frigologo.at.pdf
Size 169KB
Sample260826-pmxnnsyfqa
SHA256 e95c4185d0c489862d2073f1c35107a78633f335254db94aa8754538c2864b4a
MD5 7650df967a88a7aa16d247ab32e7e24d
SHA1 b9df0c0f52b3eed97b8eb26d642d71faea057615
SHA512 db62fb8721681d326c8fab84ee78d96a99d91939d3fd3cfa6e1483dc3afbfe1a8f1b6ce01cded2b629b0aa2a3f8fe3a5170059bc52b500322f05d20d3e79e362
SSDEEP 3072:iDCDlhczUP/6hOrBrMk8mogCOnkG0X2d7WwRolUrNUosexgRgIUqZkw+VOW:A+h2Un6sBrMk8akG0X8arlUreoseNqZu
TLSH
T1ED041376F22DBC5AF02FD21BE0F83445A61BF81F2DCDB99B183642556D80A686CDD9C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process
Email address	28	[email protected]	3232	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1152_529102973\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1152_763124731\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
52	msedge.exe
3232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322209679183732"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{C417A615-D8F3-4BA8-9FDF-F159560CE04B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{EDC6782B-FA45-453A-AFD5-5FCACFD182C2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6124	AcroRd32.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe
6124	AcroRd32.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 4576	6124	AcroRd32.exe	89
PID 4576 wrote to memory of 2892	4576	RdrCEF.exe	90
PID 4576 wrote to memory of 6004	4576	RdrCEF.exe	91
PID 4576 wrote to memory of 6004	4576	RdrCEF.exe	91
PID 4576 wrote to memory of 6136	4576	RdrCEF.exe	94
PID 4576 wrote to memory of 6136	4576	RdrCEF.exe	94
PID 4576 wrote to memory of 200	4576	RdrCEF.exe	95
PID 4576 wrote to memory of 1920	4576	RdrCEF.exe	97
PID 4576 wrote to memory of 4272	4576	RdrCEF.exe	99
PID 6124 wrote to memory of 1152	6124	AcroRd32.exe	102
PID 1152 wrote to memory of 5488	1152	msedge.exe	103
PID 1152 wrote to memory of 3232	1152	msedge.exe	105
PID 1152 wrote to memory of 2232	1152	msedge.exe	106
PID 1152 wrote to memory of 2232	1152	msedge.exe	106
PID 1152 wrote to memory of 2232	1152	msedge.exe	106
PID 1152 wrote to memory of 5728	1152	msedge.exe	107
PID 1152 wrote to memory of 5728	1152	msedge.exe	107
PID 1152 wrote to memory of 5328	1152	msedge.exe	108
PID 1152 wrote to memory of 5328	1152	msedge.exe	108
PID 1152 wrote to memory of 5332	1152	msedge.exe	109
PID 1152 wrote to memory of 5328	1152	msedge.exe	108
PID 1152 wrote to memory of 5332	1152	msedge.exe	109
PID 1152 wrote to memory of 5332	1152	msedge.exe	109
PID 1152 wrote to memory of 5324	1152	msedge.exe	110
PID 1152 wrote to memory of 3200	1152	msedge.exe	111
PID 1152 wrote to memory of 5324	1152	msedge.exe	110
PID 1152 wrote to memory of 5324	1152	msedge.exe	110
PID 1152 wrote to memory of 3200	1152	msedge.exe	111
PID 1152 wrote to memory of 3200	1152	msedge.exe	111
PID 1152 wrote to memory of 5908	1152	msedge.exe	112
PID 1152 wrote to memory of 5908	1152	msedge.exe	112
PID 1152 wrote to memory of 5812	1152	msedge.exe	114
PID 1152 wrote to memory of 5812	1152	msedge.exe	114
PID 1152 wrote to memory of 5812	1152	msedge.exe	114
PID 1152 wrote to memory of 4112	1152	msedge.exe	115
PID 1152 wrote to memory of 4816	1152	msedge.exe	116
PID 1152 wrote to memory of 4112	1152	msedge.exe	115
PID 1152 wrote to memory of 4816	1152	msedge.exe	116
PID 1152 wrote to memory of 2332	1152	msedge.exe	118
PID 1152 wrote to memory of 2952	1152	msedge.exe	119
PID 1152 wrote to memory of 2952	1152	msedge.exe	119
PID 1152 wrote to memory of 4072	1152	msedge.exe	122
PID 1152 wrote to memory of 4072	1152	msedge.exe	122
PID 1152 wrote to memory of 3152	1152	msedge.exe	123
PID 1152 wrote to memory of 3152	1152	msedge.exe	123
PID 1152 wrote to memory of 468	1152	msedge.exe	125
PID 1152 wrote to memory of 468	1152	msedge.exe	125
PID 1152 wrote to memory of 5904	1152	msedge.exe	126
PID 5904 wrote to memory of 5692	5904	msedge.exe	127
PID 5904 wrote to memory of 2652	5904	msedge.exe	129
PID 5904 wrote to memory of 52	5904	msedge.exe	130
PID 5904 wrote to memory of 2652	5904	msedge.exe	129
PID 5904 wrote to memory of 2652	5904	msedge.exe	129
PID 5904 wrote to memory of 4540	5904	msedge.exe	131
PID 5904 wrote to memory of 4540	5904	msedge.exe	131
PID 5904 wrote to memory of 5536	5904	msedge.exe	133
PID 5904 wrote to memory of 2760	5904	msedge.exe	134
PID 5904 wrote to memory of 4356	5904	msedge.exe	135
PID 5904 wrote to memory of 4364	5904	msedge.exe	136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Versicherungsschein_AS-9311002026_163945284_Ausstellungsdatum_26-08-2026_seekirchen@frigologo.at.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3A2E30992ABC3002539A4701470B98D8 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F5973F96CD74840851CC2CA5123E755B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F5973F96CD74840851CC2CA5123E755B --renderer-client-id=2 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=08F79A59C782C6535D46DEBFA2901001 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=08F79A59C782C6535D46DEBFA2901001 --renderer-client-id=4 --mojo-platform-channel-handle=2384 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=604B51F0C04801C3B9957A07E18A304B --mojo-platform-channel-handle=2748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:200
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F0958D8F1FB5502F50C645CEC8BF8403 --mojo-platform-channel-handle=2916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4025FB6D857D4D7FBC66100EC917D8B --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://air-conso.ch/allianz-center/web_cim_allianz.php?from=AllianzOnlineServiceSchweiz&AllianzWebservice=163945284_zustellung_082026&id=c2Vla2lyY2hlbkBmcmlnb2xvZ28uYXQ
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa3234c188,0x7ffa3234c194,0x7ffa3234c1a0
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,3322117011534900196,1624945787126295583,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - A potential corporate email address has been identified in the URL
    - System Time Discovery
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,11983708577253740306,16925144899879533326,262144 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,11389846081422932260,14748718887316529695,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,8058184417389653556,5992550289895288178,2097152 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,15217439203185097661,4689480295563350985,2097152 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,2148329778967257655,15954825026997621151,2097152 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,11605707784660080345,9332401292442083780,2097152 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,759520172336263286,13028818284737284256,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5468,i,6289972433593318934,15707271396426370252,2097152 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,12192894368443202816,8057838590619074051,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,6721913148600678433,10165455339501537689,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2460309259369143509,10387816892733195249,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2460309259369143509,10387816892733195249,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,6573823491702123851,11957944916032662045,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,16259433886349595212,778295911900825269,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,8964776156722982481,17901850221855680774,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,2608492342716273842,12829569182224100843,524288 --field-trial-handle=2156,i,11156076349884870707,9854868600735553748,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffa3234c188,0x7ffa3234c194,0x7ffa3234c1a0
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,15127395249301873086,15005744290265616872,262144 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:2
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,4907448145085244111,1258655328054922339,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:11
      4⤵
      System Time Discovery
      PID:52
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,10934002557854618756,4203232943456804668,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:13
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10897370303363670300,9325632323429138997,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10897370303363670300,9325632323429138997,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,16834991906452902591,13594652356970069305,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,16493836925675930072,13012294833148639145,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,3901853879749098814,17857562347942667155,524288 --field-trial-handle=3024,i,2397890070873787724,6173057683771741529,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
      4⤵
      PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 982681b479ba018e4b99a16c1868a869ff9db6e389ec27ec69329dd3f60464d3
MD5 51168ee14df1193583b84ecbb3364429
SHA1 1d1d47665e015ea2d8394a878193e57895f94e5e
SHA512 f63ad484ee054b9a530402c0eb7152308e0191c060ef8fda4870a9cad85e4f2f6b0666cd86a942c5f1aa937fba5a9cf696bebcc7009999e7ad88253e1d9ef866
SSDEEP 384:ije6dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:i0+eUZsLQCZsL3hUS4
TLSH
T1B153CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0042505102f2908cd06f59acf35b07c0665c36b7158587c39ba9befe3ce0813
MD5 764bd42c758a1551db2cf67ba6543c84
SHA1 f53f312044eba89254f1cf1c9f0e796440920968
SHA512 be80a2f32290982c6019923e549ac1602bef40a1638b645d39100cfb37e967a7cbb95dbb1fdf22fac58db4c8d9dd701aadda926d540da82c96c82fa584587be2
TLSH
T12FD0A7C9B864BBF0E433243D5365821225DC6A12B513025F9050595A0C5569241F6EB4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a09093ad17d14a76bbe2bcf2f072dab7f7cc40d695c3a4506e6104df0390d850
MD5 0e315d6afaa5f4a831d87a34423c9844
SHA1 ecad269bdbadc535cc13f08dafaf24548116fb0e
SHA512 204cc075b02fa4eef2d9f88e404895766e8ccd0cf5512e43743cc4aba51c8e49c9c5881a4a4b880c18208e3fe66ed7a2393ccb896815aed251711db370caba3b
TLSH
T143D0A7C8B554BFA0D8333C3D5266831275DA9914F457425BC190159608857A391F69F5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

2325b6c9-bde0-4306-9cb5-e6d5003f5e3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2325b6c9-bde0-4306-9cb5-e6d5003f5e3a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 671d7cc415200969f670341000a8d5e1df935a37d8e4667b77e02d959afa0506
MD5 421439932acef891e01618730dafe8d7
SHA1 12e9d3ab715fbaa1a79d3d66559a2507792ae00c
SHA512 2052afc3303682b43eb7df4e4e07aae78d29b385d17a8842101492eb826a06df385356f9e2071b23df67fd2cd1b8115440f3fa3e9a6ef9777463133fe6ee3ab9
TLSH
T1E0E02B69DD31FC3749FD0F5854541647FA48135A2B80894F363C51098FF067745C981C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7b84c1872b8cfed4401c880309f1c1102254384e6c3b8e1b189c37d127897ca2
MD5 512ab914852122b287dd4ec6f800f66a
SHA1 6741bb2a348e053f1195882458cc38e14abb8e2f
SHA512 cc632a02ae51c33577be695bcbc2926e51418d7526b73fc49ff159cb2f18a0759caa21191af85b5600af049624b99c48b6562635708732281f8b8f54fcbbc9a2
SSDEEP 96:Vx+QRugopMMSYZTDSOU2UctWZOcvPTyGQza4W8fXCJ6fzivqMcN2XxC9MGNb3u/D:V04olzv9fEqRExGK3BN0c0BVVIew
TLSH
T1D3132B3DEAC89D67D2E319FD19971B3B6379C438C7E0165F5EB6F21021493448A9E283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1fad77cd398b20d9cf94ed8422863c9d5612d05789f4039708c7e9d018650bad
MD5 49d1b266fd874081858ac81ebbaae2f2
SHA1 1f49d4bede3454fc9ce17ef60bf5863d834a1b12
SHA512 262aa075670ae8a05f20dd7e77e797841d3be5d07c466c4252a00a33db0166f7759e68e27c332e9da15a8cbea5c5cd7d5f2a47d82f5f0501a63ad706c5444db9
SSDEEP 768:PqINX/23L/toxcL/L0nHa6dfHCxbUSA/OrlLU004X4Yhh65YYoTRas99vnp6elG:h/23L/toOL/Ln2upLAYRast6eo
TLSH
T1BC4471F75941A40BCBA442F592033E3ECD7B465F3CD5E8ACD6788CC12865F21A6B8E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0b885d024cc4b5c496e1cf1d70e34f2e73da62d8564ada5d241b9edc53210680
MD5 2ca65d6c96c50b87c0c52e18d14e2590
SHA1 856687b12f2d318123c29faed1693bea6b8e58c8
SHA512 9a7e6fbc315772f37a903cc09d97437bfa75148f96f896351eaf454669f3a1e75caff572d0f0d8ac57143aa5fa4d8ea1e300cefe7201fafa65e486f59c6fa817
SSDEEP 3072:ov9G+HNV8fiHvsZAoxpKuQDkpEcvCld4m+P:oQ838fMstpSHcvwd9+
TLSH
T1C9253AFEC7281C42CF678AB0B0E0EA077E752183B658D0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7384a76cc140ad3c265f2547d437d0821669b5d4f91cfe4936fbb7f7435372ca
MD5 50e85a909823d2c982a527b24d7e8b8c
SHA1 77e3deffe66565829dbd8deb89285b821f230bce
SHA512 afa2efdb66ecc9815cb2c50af7ede0be311f53a09fde6469324df7f936e3ee6c0c4daa4c71681220a59a8583c303b0c86b9d99fc5e67d231709ce28468abdd22
SSDEEP 24576:uHP5qSaDXyE+nsWlE3lLXlvjnaZ5Hvy5db4G:uvRAXP+23lLX9nikdr
TLSH
T1C2168EEDCA689883CD63DA30B5E0E9473C7413C3F995C1D6C858C59801A7BC4BFAA66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b4b88660d157350e856e23dede2427d3cfcc72c0fbb137987a3b9d8be1da2135
MD5 462965886d59464fde24a3c1ef1c180a
SHA1 f15fa01c9e2c111cfb1b7ac7c1432b7189dec8e6
SHA512 a6d5c689ae683986dce9c1249d2349883459d907b13cb89596d49b901f11a8f211e8c36eee8dcd065021a7cc7d5e750b7146f585989da44dee4d124fc65dd0ba
TLSH
T177516441C3A545E1C7765BFC51E16E4F3A7888FE0B079E0D6CB8D4F499EA75B2285023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 c20ac82c6050e32607542e08fd68add6f81a0eef0b4279b4a7975d95f2e4703e
MD5 9970ee56bf7ed0a2f2d50ba32d6a0202
SHA1 c02348b588fa9773ebb040bf3a1c26016254f181
SHA512 9097f5d5d78c5118d70c258d960bbc87ed3a089a631dd09e62c9ce90eb4eb0c571a545b42ed3da1b24a11026ca3d623b8643581f97afdd73783f36cbb84ce73f
TLSH
T1D9E0D8E595DEC15EAE9034C36338670CD2903542D6E6BE4B270488C97643001F345A86
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 418a0cdebc97c230560905e4eb97d3efc4479eb830047450b7c18db0f150abb1
MD5 f5ab952ce9b87253710d9a5a8d13b343
SHA1 2c8236e7437fc2e3fee208ee702a516818f5bd6d
SHA512 d247d41abdc1e03efe1985e3fa556610555b5290adfafae8f6810c77d3faf6a9efb3bd18663c7aaf73b82e6cf5ebf271b8c0b138bb5d4bd9009b8c7dea682f11
SSDEEP 48:T9D4jJ/0UC+lf5dJ63CdayP4y9Q8WxnWx/3F+2T90N+opY:xD4jJ/J43CdP684CF+2T9s+opY
TLSH
T1ECE2C244E232F6AFCFED1D3EA7D8B2B5C5D8242C91DC1A50137D7AE604A96F8684E01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 86d8ea5c835afa306ef29dfe58f6330017b628d61c8f856587136f6b9590c2a7
MD5 1a13175bebfa552ec13b5a07c033ec41
SHA1 2ec26a4b6a8e96eaf05abe5b5135d29bbec3a8a3
SHA512 d28a8e9441e28e6451916fe0f3cdc84b675ead511b30953218b06986e889c65306ed04ccdeb349ffc96ee4bbe32ec5f8bb0aaf369782adaea37127ba5e705a01
TLSH
T1EBE026B848CEC13EF91478D7936D670C86D0350FE28839EA1B08C8646281A41E3CAB80
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 ea15401ff7b3621b1f53e5882216bd4b20d1344648d2bf97f0fdc20ff0dfe6e9
MD5 51a11c1332c945216cb3aa8ae8e46eef
SHA1 4ad5ed688cc53f49157cf141185873e8278650e5
SHA512 e1cefffed141a4ac336160693674a0b3dcc7337cf29b2623bdd9950a2a7cb572b543ea01793f977c5a134044966b306f9c6d9c6dcee8478a7bbc404a8771425a
SSDEEP 96:UBCxVjoowwSxovEepQRIadHetuUAEYOPA1Q:GaKoX6o7QRAtuUAlOPA1Q
TLSH
T12EB2178F7B783C63DF5D0CF9302A69789E7FC20D5F69AC5A782044219CF8A8950395AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 8dd8441e75f1df38835ea3fcbd94d71cff45d2e8dc9973ccc2b2e672ca253483
MD5 01929317f1d8e3d8c95872c3dbf7f81c
SHA1 139eb1a6e0857f70fad50a7a9ff414c319f626e9
SHA512 c9d26eb26faf3deaf20225445bf28a7abe25b20ba4ed8f745ca15da052e271f057486cf1d329ffd42a22f3fb3764ba82d55a8c9980b8b9416491760ce797489c
SSDEEP 192:loYm6WRH+bF+UI3iWGVoWN3qL/GS3oJVVV63:loYKRIkUI3ijVoWN3qL/GeoJA
TLSH
T18924535F6F302612CDBD81766CE754A75D7DF02FCB5226CA78611474CEE2A42A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 18KB
SHA256 b9cf4c89561e3d2d99f7296eece2ce7fcb7a8c91bc8b245c0de4739048d2fa59
MD5 a2fb533e2a9bb8a715ac9cb4ff528351
SHA1 9e03ab94136e3389f882d8a79051928a1cb9e41a
SHA512 9c4a124f5da7bff665cb2128f4aac8ddf830a71dca448fb1a79f29a391d04a62c341b70a06f0968884e562608e3d5110d14c2f673c195726593f0c05b129faf3
SSDEEP 384:mSN3QoHJVAF8TaPD4/9htoh6WLGuP9CYpjA+5vpuDbXGBYRt:mSKoHP6pD4/TeSuP9Tp6DbXFt
TLSH
T17F82D07BD9C0C066F77690D6804273242ED8F4FD62D493969CCD98C08BA0969EF1D9F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 251af1c7facad974aa89e9f04760ee78b23e8c8e96015d8e8ccfcb4ddb5cc1b8
MD5 fba631489d717b50171519b83e6590e3
SHA1 19cbe0a3776c3dae4a14ab2cbf679176114cc3e8
SHA512 076afb59aaf09901d73672b62a7159a2ff7425c48b27970d3984ad8b4094f5d18b9d3e5fd69a0c4ee51607eab64244548c028dd4eddf14a1c59b852427fb625c
TLSH
T1F0E020B184DDC15F7A04208F635D770CCBB0360AD68C7F4D1B089845F541808E381BC1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 6e861b72636ed8e990ded5f2fd24e529875875d89557fde09d4456c47ab495f3
MD5 bc3da5ed442bdcea59f5524e5674bfce
SHA1 e2da75a222551a13c4a496a4d5c379b4aae60122
SHA512 95a4f9359bb8c6d7b25c9efa38242598f58cad309a7c3fd7d5df1a043e1d6d8f6c422120d0058471e7939ef36587298a671785fa066af9dc31420848db5b79ef
SSDEEP 48:Txk/LopFMaty423w/a9NUuTOwdeN/Ywo7Jw4F2x6MHNp1XBYqNkbaA/Sq6pqsHNX:qDeMatha9EFiJ3sh6/FuqDX6
TLSH
T1B8B2884F3F352112D4F4CE369CD044661DFC021D93676AA9955CD0B2CEE3A5AB6025BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 552716a76a9d6d13e73d2e71dc9f5650845bc1b0e23cd269224a24090936883e
MD5 2d7b6514f495c54b759db94b6f9d7520
SHA1 eb9782a9ebf003734a0706904760d9c492807bed
SHA512 c5555a39b7708b01fcc7c7d87494531aa21066d00576a85894910b27247cae5b54766aea174182e03febc77c6d4158059f90f171195dcc39c60815e8a80a3931
SSDEEP 96:DSfcO1fmeGSfueXeGDwzTzT2aGwc1rdmsu0Uw2NP25R:DC4xVmpUfzT2aGd1rdmsuNw2NP25R
TLSH
T1B9B1ABFBC3D9C22D881156F8AB15AF1ECE2D0A14432C3D2AC8D5AF2B93E2471E11565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 683B
SHA256 e85733d23d78c8661319a9f014c75869d54d5190f45b769631b285b6471450e7
MD5 e1f4697a747996feb7e326fb8d6f15e9
SHA1 f2ec7ca8c14f9075673b77d1e7731c719d65746c
SHA512 571960ddff83a52a0e32e633e3802c1c9d3281c996fc34c64eb85f39592fa934204d491250c0acec78e0e4c9053fcc5bb59729fcaa78f0dd6296b841a38b8ca3
TLSH
T149019E97D6BAB92710B5447A0E00FC492EF6B8300352B8F9DE5B816CF0818F35B67082
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 88658061933689ea62f25d1ecd2d85c1cc55215516c9323bfe49b2c8148c92fd
MD5 792f812eef9360d256b7b45c60de136a
SHA1 e2c849a8cb57bcf8dbf1c240f04387449bada267
SHA512 ba80f7fae1445c78a17cd935ed6f516930a93d5e420b5a2e79a58158996ccb18ec048ed088c7a5ded2ce3b082f56363c7db0ebef579e4d2abd7dc589a83ddb8e
SSDEEP 192:sxR5RtyM/jK1Ml85C5/fmsRWpVkgOZytFxYzoA8pj3Y/g6+WNTIG1/Y1nlwsNrgS:sxR5vd5/fmsRWvkgoyjc/5f/oNZX
TLSH
T1E472E816AA349D7BCCDBD21DFA557F53D2F81523A1901E84AAFC9E1C00E66ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 46e677bd61206992d1741812df64371c69c75974ae468517cd0582445773f43a
MD5 e7af91ba07b65853b886c05df2c5e707
SHA1 475ea505b0cb1edc08503812bfc5e317ebc268dd
SHA512 381cece84e25ec8f1564ef3ad89e0b9d3b367ba9cb66a5386f66f5a882c98675623350cc689ba7ede9d81b340ac4c0f3d36c852721c348560a9e0a81910cafb7
SSDEEP 192:sxR6RtyM/jK1Ml85C5/fmsylWpV7wOZytFxHmSK/NzoA8pj3Y/g6+WNTIG1/Y1n+:sxR6vd5/fmsylWv7woyVmSRc/5f/oNeX
TLSH
T1C172F805AA349D7BCCD7D21CFA517F53D2F81627A1901E84AAFC9E1C00E66ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 299e47832881070850088087545015dd2b392617f86a0a88635d949402614d89
MD5 d698a1268a73d92755063d90ca60524c
SHA1 6da86ff975d76ebc6a5d66302b95a01976a6236c
SHA512 2f92348a1c7656fd7096387af34e4d06d072ae04f2eabb7851c8452ddb752298bd07db5ec8777ce19fab4add20377769af1db08e65a4523843dc5d71196940ff
SSDEEP 768:0xCyQ47pLuLzUjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV0KHrVAcroJQ58r:0xCyQkEzUjWgbrfM1u1jafKHpAHJ28UM
TLSH
T1C7E2EC7B680CCB7E4F804A9DEC297E9BADE802CF96D88D5447EA440C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 867661f6f2ae8ec203f1a618916693112a94236ade07c9014464573226ed3fe7
MD5 87d3b591036f30a638c9a1b486b1fc12
SHA1 028372177c15bd0cdd0d400ff6d7dfe2e5c2c26a
SHA512 aa2492a2e23e5ac88b033ab55bd4324c09571b85f976417740ecb6f78659e86c67ea5af6b36ce8dcb4c2320b80db272526757ccaccfdd64b27509b86846b485d
TLSH
T18FE026B09ACCC27E79952483036D930893E4750FD3CC3E8B2F20D8766182984B292A80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e1788a2f62f57b65544a709a23ff549ad9b24d6795857989a50a0a9afe009e08
MD5 9c7f2144fa595725014c8d6136ed035d
SHA1 ccc7b29c35831f68aa4ea255560db67b35b49e16
SHA512 540dd59133bf2030aa61cebdcc2c092d77bea5ae1aa5c86fe17b693971b9349cfd1a8403ef9a9d21cdfde49069bd04ac05353f016155e41714f2c22322ffd7cd
TLSH
T181B022F020C0AC00FB80C2F020C2C8A03020BC200283A30A30EE00AC888200033A3C00
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 7b7b5bdff242cc277cffb64609a6548831d771f35f6040bbb5c5414a244e18b2
MD5 b2f60337547adcb7c3a009dff00d4cfc
SHA1 bf2d34dc065c340075ed3c8c22523fe3ed5b8e4b
SHA512 bfedd4be10983e7f6fe059944412705c03dfbb9a9023c2eb3867fc2634cf34a6e3a647a7807b3a5005bee921ae5f1f0680bfc62ce251fc11bb6381321d43cf12
SSDEEP 48:TMZa31b3fEvTFUPH/qczksX0P3ZOIKJbTXSqDB:Q43NBu0NOwB
TLSH
T17C130DDF2914B586D2E9C5B0A06A5EAE6D7F324C9EC3A8C558B046B30CD1829481B1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 0ac8dd972bc764d43997530eca9be023d99c6401cd26da0265408ec56cf0050a
MD5 fc8e77f591ac6159d20c5546e6a52e82
SHA1 de445dce52ffd3fde6208e3c0e2aab2e6458598a
SHA512 e666d0f5599154290c2a3a3dfdaff1dbf1909821ffd45c312afe547601f8dfca9ccaf92d825e921f368bcc15bebbcb001f2d32853f6ec3eefcb40461a0a8bec4
TLSH
T1C9B012B43B309305E4C9093A0D9187849700F44A30414C73EC545F148D0B6746FD2CC0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 5a49da60ecf45d2612bd1bc60e7911fc08e27d5280ef23796eee48c83f758b4e
MD5 b02d679b94f231daf53eff287dfa9908
SHA1 2db734c84425a1395a9e9c0e2540f0e381e7c3ab
SHA512 4394cc95f78d54c41cdf7ecaef056220cef3e39fea2320a25bb7a123abdc84a967ad966abeef27f61149017ce9461dfc21ee737d8bca770c462db64981bb6ec5
TLSH
T111E0D87055CDC32F758520C75339F30C87E2761AD6C879692F0894507246A447383740
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 c8ffdb213eee73cabfae627d1a0af0c52cc29918990d31c735fbec0a15f2082f
MD5 6ec9fc5732c50863fed01f90e7152003
SHA1 435362eaefec00f339f715b5182f0dfa6c25aeb7
SHA512 0af101fdf72f46601db8794c157fec40fcee2f22fa2bb62bdf0e32a8390cfad34680360d7b903c95f2bcf058db4793715cd33f8068ead3c67fc3455632fc7fca
TLSH
T1C2E086B085DDC23E7854B0C35769AB0CCBF8798BD7CC7E9E57094491A145548BBA6A80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 9531a6bcad30fca6fce9ce8fa4487696da622cf3851f9defcd63440782798b19
MD5 e59eb863aecef88ac2ac4e3bc09d37e4
SHA1 8290f6c2d299f926f34bd835f988b50723d57298
SHA512 d66cc952d16dece6496f45fb09896ef80b6933f38ab304a71b8be414488adbdd7dcf9e00b26de00103d3d631c6653f3e5a803a21631fc961bafc0412f250a73c
SSDEEP 96:KgLKKwYCyWYK7iZY7sYSyCCE69xmoCKOnmeCqIA1mYr7wTkwqKqKEi15mAKKO/my:UpHGpVT
TLSH
T12CC1C596B07A164128BE260C92E4EA17DAD170F33464A52B3FE814F55F26F425FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 8KB
SHA256 5f7d51bdc4bf0cc8a48ca93f23d95e592ba1eb7bbf9b63e6aa642f49ebdc79bf
MD5 380b579d3c2d89e92e5ea9e4d312f2e4
SHA1 ce7d09c004da318c76c90e083ad3809e41bcec48
SHA512 2f5228def79e967d7cf7b62678ebb4f7ba3365ef2c14657b820db51b67f1e7641c737b4ff84a2f871e5de8fd84f137596ee0bd40d28cc9405a027d220e60ef07
SSDEEP 96:KgLKKwYCyWYK7iZY7sYSyCCE69xmoCKOnmeCqIA1mYr7wTkwqKqKEi15mAKKO/mY:UpHGpVbhH8Q
TLSH
T1C7020396B0BA020138BE250C82E5D916D68271F370A9A46B3FE804F61F66F455EFCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 bc9700085ec825898388b7e9c87a36a657c838510ee8a10ce46b82e4ab9fc7fa
MD5 a0ef760914c468f57da0e902400ce6c3
SHA1 9242700b0ff53e084722e39ef21212f391ed2d3d
SHA512 9fd6751359323425d0f5f9390ec2dbb53376f0fe591a9951e10aa47c41e3767e740cd0d3fa13ea773729388309e6380250ff69f88883135eab2b8729046fd7c4
SSDEEP 384:DNrRZyCSDnxTIChf8MEhIKyll7svbFKfk7:xFZJSDni29yI1l7svbF9
TLSH
T13944730A7B746001EDE6DD721CB080771E3CB16D8F22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 9bb6b784cac91768bee7a96cd36f686a115fd1587f420ae44bae65b9703d7b37
MD5 9c1d648781eb8e5dda8b30c4b8594522
SHA1 5302153dadc4729640004f399e47aa9a9c7d5e72
SHA512 9a1d72426c08ee91c19b3bbe117e41283b5611a64f18343561f377d3b6df3081cefcb4ff3b5429f2fa686e2483a3001bbe58ea9373c1af63d206a024936470ea
SSDEEP 192:nQrIII6b6MIME1YcYPX1OXtAsbl9h7usGt:nQrIII6b6MIMiBI0X+sBGs
TLSH
T19042956A26072B77D25F5F7613A696509BD988810032252E32623C2F8DF3F97C6C53F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 d732a8a15860969a82ae9fea0b828d55d2089ea7f484c4d54a2457de7343b34a
MD5 d6d3bc80f275115317e652ebf37c778b
SHA1 84c0822995434aea8dc07fb76fad1fb29bc901bb
SHA512 b7f9f667f8636f441c0b816303c2eaa6c4ed6252f94ac02a1256338cc8c7539e5f041c8a9ade7eb6ec46b03d9fa02ac004b404cf02dab1ef1bcd398f17e2f399
TLSH
T17BE07DB2ECCEC36FB83420C753295308C3C43A4BFAC839AE1F01CD85A04550CB7AA681
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 1a65a9e10ba4cac38375e1cfb806aa80df653358135a690cc0eabb3dbeb6ecab
MD5 94ebd7093578c41392a3b8e4761e66b6
SHA1 9f1950aedde3dbabe691bfffd5a017bd03869e1b
SHA512 9a8e32ba4c55d3264571c533701f64070e87de841f9a7b3e72d38bf51a9f56864f9ccddf1089e0e030afc3205ccf45a8ed1500b72220cf3e33e924149b5d62aa
TLSH
T1A1210455F330C148D15A867E907F9B360734E8168FBCEC0F547A20646E75B540D8B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 47fb870f37d653b8399098d42620bb981200ffc96b89ef6f29ce62e5865ca1d5
MD5 6a0bf7aa9d0dbc7fd2ed3f0cd752880c
SHA1 133f4a44646fc7fc5205397418d8f52764fc3d0c
SHA512 5aad96f0a996ec41cef1068d675dd363efd722e4317537eac78a47e76f5c2aeadc1754e4c2f9b18972327c037ccd621cdea0a91a81b2c46d39fb04d29c2ef0fe
TLSH
T183E026A0F9CDC1BFF81120C71369A748C2993D0BEA883E8E5F00CC54A642541F7CE681
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 26f70159b30647af2895f89f50b4417f0e040feb86af8bf4b011d43b2d8445e7
MD5 b2bc2e706cdab62821f1d09d7b2f9d40
SHA1 3865b33f1fe11f456c581a6d66a76d955cbe4c00
SHA512 ee50bfda66ea2b3f75556b84207ed19b7f4ed203e062fdaa99d6cfcd483879743685665249a274d3a2b5764c7e0434f3cc738e7d6abfc9308b32acf595fb8a25
SSDEEP 3:MsEllllkEthXllkl2zEflt4l:/M/xT02zo4
TLSH
T1D54404057FC00C15CD041174C051C3515371D4300511574334D104335CCF5400C00540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 07b6ba2bc831036027660f8af3ff01057158c2a429afae3dc592695d32815db3
MD5 77b8ce1d45b8b021591ca8b42e6696ef
SHA1 aad55c5bf85e99e5c5bd2ed9b03c3bd41bb6313a
SHA512 973267ac007e61c1fcb4913c28482820c83651d21adebadfa40cd8742934c0a0c3eb4cf5f7b0e2e4d705b140403291e395319a2a1415540c5d33e93e5d9d82f4
SSDEEP 3:MsEllllkEthXllkl2zEfliVk:/M/xT02zP
TLSH
T1D74404057FC00445C5001470C051C3715370D4300F1157C734D304377DCF5400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 41723cf6cec8b14c7078dd8b958caffb9432a20deca5a10201c99c764daaed06
MD5 4485836e9d8f4896e14621486071f6b5
SHA1 0e54691293537fd7b70c199c2729ea828deec1c6
SHA512 ebd465d0683037235c461e75818c75daafb9abae6373fe186541be233cde01576ac954d6d9faa00e1fc5d2414ce9e48d0d60feff6b6ba0e79f99a8e0b88ec4d3
SSDEEP 768:arv+4UNbdl3QPkKL22ejF669yrqUjWiIwwxMRRSUiler:absbX3n1jF66INWZTMuUsQ
TLSH
T13303CE30AC589AB7CCF2C68672533783BFB4109396C50B88CADC670D469B0D92347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 018a13ddc493a16841c760f25e1e68d7b1677d54ac9a39cfdf40ea64616d0100
MD5 2b0eb25f7081682e333eb7b093a900d8
SHA1 7d4412bad78bd50ea1b7af1b50859e7537d6fc18
SHA512 7b016de83073ae608e52fe58f4deed8d0757cae49143d32943fa168174abb83978837beda17f12586583a2c1a089a9bea7c5e39f8713adb9a6c9e2cf4abc31a5
SSDEEP 768:la3pHkKL22wwF669yrqUjWiIwwxMOwFN5A+:la3aVwF66INWZTM3FN2+
TLSH
T1B6F2AFB0ACA59DB7C8FAD785B31337C2AFB041A795C44E88C9DCA70D05475DA2B4783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 cd0b392cc59f48d94a2f91777504efd4f12c7f070c43e8748fe136ed60676b0c
MD5 9f2891a67ee9b2894a498bf6dfa95e88
SHA1 3466e092f85fa2d18c4f12beb58549a42587b0dc
SHA512 3b33f64bf227308a8c3c2bc1b65588aedb51dbab3587e921c3874f02b22f3f89d2ab5ce4949f61034ebeed7d7bce3f4f2e5d05951ea8ac3d8b3e6e74df0b3c6c
SSDEEP 768:ra3tHkKL22wjF669yrqUjWiIwwxMtUvKs8s1FN5t3:ra3OVjF66INWZTMyvK/s1FNv3
TLSH
T125039CBC9CA4497F84EEF788670A2612AD744237C1F44E48CBDD670EC27649AF74342A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cc93a8fe901f9f53611c64acc4205376eefcc6a9760f7ed3f86abb39858cb86b
MD5 c218bfb0d92e007b58ad1af7dd593381
SHA1 d02084fc6b9b5631fd4764a1ab0485b2d48bff04
SHA512 2742fbfa1f1627c8084e5e496f7cf579f05052bdbe1e9397338c0d090113cc16965c1f79ee57c7389797bca6a18f1e3f9739b4721bd0df89d7686335cdbaaddd
SSDEEP 768:3rv+4UNbdl3glkKL227jF669yrqUjWiIwwxMABUiler:3bsbX3B4jF66INWZTMUUsQ
TLSH
T1AB03CF70A85899B3CDF6D685B25377C3BF7420A395C10F88CADD670D464B0D92B4B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 55588e62cfddfbda9f686f7530100203e1d332b1a4cab6bd1df70e882635e565
MD5 376e0a8e9b86c59b848347f1fd73f28c
SHA1 c441fe58d076b298ab177bc6c7d40bc3358029dc
SHA512 4dee486a6beb0091b852aafcd22ffb35efa740b6b0f894af93dc43ec16a35049095031ab29c81596aae232283eb4f5818bf10a74e6914e7dcfe0ac552160d23f
SSDEEP 768:Brv+4UNbdl3RHkKL22wjF669yrqUjWiIwwxMtBb:BbsbX3CVjF66INWZTMPb
TLSH
T14E03BE70B8A89EB3C8F6D785B2133383BF7411A795C40F88DAD9A70D064B5D9274B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3e7d70c6555ae2deb2360cc558d97f6fbf0cb5223c28e7eed1796b5bcea77d85
MD5 4e03c997444a17be73da183df35cb399
SHA1 c8aad72963c9e0519de3a9faa973710ac593ecd8
SHA512 8e46d7ad94e806e7453bc6469a37a14c6072c5246310ae02891e4f9d111368a945497340583c4d5d04b1c1ff1079ab065362988037f6b59c8cb37752e6b0cb17
SSDEEP 3:MsEllllkEthXllkl2zEfl0:/M/xT02z1
TLSH
T1DC4404047FC30505C50010704051C3715370FC344511574734D104335CCF75C1C0040C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5aad77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5aad77.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

9eb0a56a-931c-4657-ab92-23c6b90f12ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\9eb0a56a-931c-4657-ab92-23c6b90f12ae.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1152_1234389529\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download