hxxps://cdn[.]discordapp[.]com/attachments/1545491902604910615/1547581673623916595/New_WinRAR_archive[.]rar?ex=6aa3f13f&is=6aa29fbf&hm=cc7db246898f79b8b972e9597ee077944eca5edb9c2088c5a37a513571d1d65e&

Analysis

user interaction
yes
max time kernel
125s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1545491902604910615/1547581673623916595/New_WinRAR_archive.rar?ex=6aa3f13f&is=6aa29fbf&hm=cc7db246898f79b8b972e9597ee077944eca5edb9c2088c5a37a513571d1d65e&
Sample260910-pge7fagg66

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335162769411669"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{19F67BE5-C642-4A5B-B166-DB1F93B13E68}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
1756	msedge.exe
1756	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4244	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SetWindowsHookEx 59 IoCs

pid	Process
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
4244	OpenWith.exe
2180	AcroRd32.exe
2180	AcroRd32.exe
2180	AcroRd32.exe
2180	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5776	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5732	AcroRd32.exe
5404	AcroRd32.exe
4424	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1940	3316	msedge.exe	88
PID 3316 wrote to memory of 1804	3316	msedge.exe	89
PID 3316 wrote to memory of 1852	3316	msedge.exe	90
PID 3316 wrote to memory of 1852	3316	msedge.exe	90
PID 3316 wrote to memory of 1852	3316	msedge.exe	90
PID 3316 wrote to memory of 4256	3316	msedge.exe	91
PID 3316 wrote to memory of 4256	3316	msedge.exe	91
PID 3316 wrote to memory of 4284	3316	msedge.exe	92
PID 3316 wrote to memory of 4284	3316	msedge.exe	92
PID 3316 wrote to memory of 4284	3316	msedge.exe	92
PID 3316 wrote to memory of 5000	3316	msedge.exe	93
PID 3316 wrote to memory of 5000	3316	msedge.exe	93
PID 3316 wrote to memory of 5000	3316	msedge.exe	93
PID 3316 wrote to memory of 4976	3316	msedge.exe	94
PID 3316 wrote to memory of 208	3316	msedge.exe	95
PID 3316 wrote to memory of 4976	3316	msedge.exe	94
PID 3316 wrote to memory of 4976	3316	msedge.exe	94
PID 3316 wrote to memory of 208	3316	msedge.exe	95
PID 3316 wrote to memory of 208	3316	msedge.exe	95
PID 3316 wrote to memory of 4216	3316	msedge.exe	98
PID 3316 wrote to memory of 3184	3316	msedge.exe	99
PID 3316 wrote to memory of 4216	3316	msedge.exe	98
PID 3316 wrote to memory of 3184	3316	msedge.exe	99
PID 3316 wrote to memory of 2408	3316	msedge.exe	100
PID 3316 wrote to memory of 2460	3316	msedge.exe	101
PID 3316 wrote to memory of 2408	3316	msedge.exe	100
PID 3316 wrote to memory of 2460	3316	msedge.exe	101
PID 3316 wrote to memory of 2460	3316	msedge.exe	101
PID 3316 wrote to memory of 3416	3316	msedge.exe	102
PID 3316 wrote to memory of 4692	3316	msedge.exe	105
PID 4244 wrote to memory of 2180	4244	OpenWith.exe	114
PID 2180 wrote to memory of 3560	2180	AcroRd32.exe	117
PID 3560 wrote to memory of 4540	3560	RdrCEF.exe	118
PID 3560 wrote to memory of 1816	3560	RdrCEF.exe	119
PID 3560 wrote to memory of 1816	3560	RdrCEF.exe	119
PID 3560 wrote to memory of 5176	3560	RdrCEF.exe	120
PID 3560 wrote to memory of 5248	3560	RdrCEF.exe	121
PID 3560 wrote to memory of 5328	3560	RdrCEF.exe	122
PID 3316 wrote to memory of 5508	3316	msedge.exe	124
PID 3316 wrote to memory of 5516	3316	msedge.exe	125
PID 3316 wrote to memory of 5524	3316	msedge.exe	126
PID 3316 wrote to memory of 5732	3316	msedge.exe	127
PID 3316 wrote to memory of 5776	3316	msedge.exe	128
PID 5732 wrote to memory of 5896	5732	AcroRd32.exe	130
PID 5896 wrote to memory of 6044	5896	RdrCEF.exe	131
PID 5896 wrote to memory of 6044	5896	RdrCEF.exe	131
PID 5896 wrote to memory of 6068	5896	RdrCEF.exe	132
PID 5896 wrote to memory of 5188	5896	RdrCEF.exe	133
PID 5896 wrote to memory of 5268	5896	RdrCEF.exe	134
PID 5896 wrote to memory of 1904	5896	RdrCEF.exe	135
PID 3316 wrote to memory of 5584	3316	msedge.exe	136
PID 3316 wrote to memory of 5584	3316	msedge.exe	136
PID 3316 wrote to memory of 5584	3316	msedge.exe	136
PID 3316 wrote to memory of 2900	3316	msedge.exe	137
PID 3316 wrote to memory of 2900	3316	msedge.exe	137
PID 3316 wrote to memory of 2900	3316	msedge.exe	137
PID 3316 wrote to memory of 5212	3316	msedge.exe	138
PID 3316 wrote to memory of 5212	3316	msedge.exe	138
PID 3316 wrote to memory of 5212	3316	msedge.exe	138
PID 3316 wrote to memory of 5272	3316	msedge.exe	139
PID 3316 wrote to memory of 5272	3316	msedge.exe	139
PID 3316 wrote to memory of 5272	3316	msedge.exe	139
PID 3316 wrote to memory of 5424	3316	msedge.exe	140
PID 3316 wrote to memory of 5424	3316	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1545491902604910615/1547581673623916595/New_WinRAR_archive.rar?ex=6aa3f13f&is=6aa29fbf&hm=cc7db246898f79b8b972e9597ee077944eca5edb9c2088c5a37a513571d1d65e&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffcce2c188,0x7fffcce2c194,0x7fffcce2c1a0
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,13425054515290152147,6753887196401033922,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,11769065939192590916,7623342748156610230,262144 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17346909993194043675,6115690258246825674,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10683649185770209136,11267757671662003068,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12096552321284204753,10973615247794891591,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,17902743984937138518,834462138371356033,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8601669771900555037,5793377878958568943,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,4462616284507619025,16563666742393718994,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17859813761808621924,17944413944426372232,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,9932898233826340407,12132834206268181665,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5652,i,14948429858216058228,838662839556060127,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,2793508170725055206,12528243111971184047,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,616692488177447856,15098651513245101524,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,616692488177447856,15098651513245101524,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,15380403078211885306,6049032083500364005,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,10206488039907553866,435280757885723786,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,9654132877614223082,15696460928726434706,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\New WinRAR archive.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5DCE4FC4864002E7F341A542769D749C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5DCE4FC4864002E7F341A542769D749C --renderer-client-id=2 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:6044
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9682B6337BB601EF877986ABD5365C4C --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:6068
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7381906745395445FD1E1DA2281F8491 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4B67CCE83772C15B8C95BAF5A4E27FB --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5268
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5612CF81959D06FA3F05CC2FAE157E64 --mojo-platform-channel-handle=1908 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\New WinRAR archive.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5800,i,15966549599428903022,3628550933614339244,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2896,i,4449230728592421709,14997527310821847828,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4480,i,12883284540143727402,4550993441969864864,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6700,i,6165293049001772631,11967093362097618232,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7104,i,17423327058611661490,15251654951371085231,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5831965379393245312,17517221723558101254,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,8247571015922298653,10261657531822584994,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4800,i,11392779487758742884,4802987621669526242,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5432,i,473251411276582415,9778790905535229458,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4536,i,8414502728393895614,9984075598278463419,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5396,i,17493084840818240460,109035541220611491,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7412,i,10938011174997571087,16469459824910012582,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,12261857810682579646,11469601479361731609,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,12261857810682579646,11469601479361731609,524288 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5428,i,10296195586661269846,9817448999535728193,2097152 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,14267011729953721792,17249042714839098575,262144 --field-trial-handle=2276,i,11974666758345077934,12120368664912807533,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\New WinRAR archive.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=81C82DAA33EEEC2FBCC59C6F8B74671D --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C28390CCF6EE332C0B1C440668101FA6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C28390CCF6EE332C0B1C440668101FA6 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:1816
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=90E5ED6EA6EC17D1B349E203DABD07C9 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=997E5B9FC48D7AB32F07D93B342DD5B9 --mojo-platform-channel-handle=1988 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5248
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE24AD659BD1BC347587E11F3F923418 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4972

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\New WinRAR archive.rar"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5404

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\New WinRAR archive.rar"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_1

Path C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1
Size 264KB
SHA256 a83c24533998565d2063c8aec04e471a0ea8f89e911c1390fc1c8856b9cf44e7
MD5 f498c8f6f39a4927df90a3e40aad1f39
SHA1 b778e99f2116068d6bf4c772fba0442c0b0a159c
SHA512 1885b7ecbbc49069efbf63c59bc8740b7183e5ffca252c55a9bbd0190323c1e256b9eb49f144b666c64780acf8a2090249a3084cc8b8b01f689c91e82fe2b60b
SSDEEP 3:MsEllllkEthXllkl2zEHlVef/:/M/xT02z1f
TLSH
T1E54404447FC30407C70011304013C3700770D4301515574334534513DCF57D01D00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
Size 289B
SHA256 c6865962d058b4aab8afdb1ddb319d37394f3e232f7f948b5424e6a0b999d0e1
MD5 a2c3355e75aa2208c92678a8ce6a395f
SHA1 4987485d70a6b216bb7a0d408bd0327576372408
SHA512 e328ec62cd6337be88bb960fedf80504fbe462be5590febca8a6a9e94610b1fa1fb06d35403704b3a140374f6c2cbd8743028cebc969b2686b8524be26e2df69
TLSH
T111D0C2810B6A864D94C8481B43B17BB5CB72FB27EA9D3E05AB41C4EF7E402546782202
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links
Size 128KB
SHA256 54a960571ba47565a13d666dfc7ddbb6da7cfc0ba91ba06fef1780a9359b8838
MD5 80ad34f803e6187ebb988e26577282ab
SHA1 3d2fd1881881e3e8da71018d4082350886908ffc
SHA512 ad79cb88e1279e43b762c0d526068ebe7cf3e3a9801753268aa57c897ac818c7929872e60f4e7e2e2ffd2bc2ee0580151b5a201434df5f0c931b625faa9aed13
SSDEEP 3:ImtVuID+d1lRjDC/l:IiVuI6je/
TLSH
T188D304070D417451D14F037044000D570D13D0114033530DFF7C04074CC40117533C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef
MD5 c26ed30e7d5ab440480838636efc41db
SHA1 c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591
SHA512 96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df
SSDEEP 192:xedRBsKhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:xe+KhBvkZsLRGlzh+vS9
TLSH
T12C4387DF26348100CA07A8BABD71771BBA55D0BFC1C2F0E87A968A1780B457CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 25c31ee0697a6191d7f2145ffb843db631f13c074e5bd10b524d443b666dce6a
MD5 10e77c693682843a4140189ccd59532e
SHA1 1cb714e18f7cc0f60f9990c3390bb75f885e29c8
SHA512 ef763ea24da2958f8e9e49c33846808388cb73c684cc4fffa492e6b4ddaeabf2e21ec238a80bdb41404015604bf8af95585e36a8d83e4ed247794c6ba4a9c838
SSDEEP 384:ye6ZdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:Oc+eUZsLQCZsL3hUS4
TLSH
T1A653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeSysFnt19.lst

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst
Size 98KB
SHA256 7e7153ab05d72f08ed739dbea456adb4097979da0f1cb29e7d098f95ff47ebfb
MD5 c064b5223fa502bcd6057ae419bcb848
SHA1 bcf909646135a46544294016ed21f2c99bf0b131
SHA512 811f9fe9fb4b0650ffa7290bac95d85813f28c9b0c206e1b97af45c8c8ad39f63a8cc956380750c615f90d869e2bda56d66b3625baac9085e0e65956543bcd7c
SSDEEP 1536:MeNgjATaRlQShhp2VpMKRhWa11quVJzlzofqG9ZCADWp1ttawvayjLp:V6jSaRlQShhp2VpMKRhWa11quVJj
TLSH
T13AA3121DDA6C4863E7F36541294DBB8B92100669FB30C9CAC5BE3FFCB8851981673A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IconCacheRdr65536.dat

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
Size 147KB
SHA256 6c797322386b60bac24b50336ee24191520a7dae63e7d8f9b42c6aa20613d26d
MD5 1945bcf05b0d58a02cb5666cd02a8043
SHA1 5780fcda384622c972e79b5c737ede3cbb33e199
SHA512 1a8832babb794e65d71542b3565c56916b806bca8372b51387492f6d5ec6b78aacc583f241aa5f7258e58dfa039d0752e67b4e0bf9d34d02a5408b78124008b2
SSDEEP 384:xBWYzyk+spBXiosQUYuoB7OmAn3bLq+A6CtKzZQ9D+v+WVE7yXG1joJ/+OL6oE1q:zPZ4
TLSH
T1CBE3D69D999F5AD3DB190BBD062DA274E0B1ED2CC4A7E8793189B70644B11E300FF639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserCache.bin

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
Size 39KB
SHA256 2395b3eefbbaecc8729063bd90559bb07c144155e4c1796e804d6aff5b13e326
MD5 06745995018650c0b7c390af0a6504f4
SHA1 dc0b263eb66a0def5b02e15d5815d0d20033f25a
SHA512 94843f7484451d10c11a4fbb7453ebc1dc9f6d0c59ac6099d0c83f096c98557ca46dd7061c05e7d9bc2ac6f4154373c7ad573b2635ea5d7656663dd84a768217
SSDEEP 384:K7X4uyVFd3nB5F1J9pHJh+u8xaEAFkiYNg7y:KT4uyVFd3B5Fn9pH6u00kiYyu
TLSH
T18E03D44CBCBC5713D5565EB6724CDFA0AF3499336AA94F0E81B836255E523E8BF28006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ffaae80f58e89366a58fe6a127fdf442a070ab64b66362588ccf4bbc2de6536f
MD5 581ea5178e046c4110e5039e355d0b50
SHA1 cf2c8882e7e230509b68e801a2d541493f8b76f3
SHA512 22c60d27092873c7b7c225ce698f811dad8e1f308cb52da0e7bfaba6ccc2e363f28d6c7be174b26492ff62cff901cc5e453300dd53d6e922254e8f90739c9058
TLSH
T1E7E0269416CCC3AFE2C0748B9169570CC2903B4FD7CCAE0E1F0084897042A80B7A2690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 72KB
SHA256 fc886667b90ffad1b0229b102c340d9c93c8250aee944f4df3f35d8833811b04
MD5 2a55cd14779a918e614e873501c38d05
SHA1 4a59f4c5582092271e6c87e69d06d092d722fb44
SHA512 8c3523bb283d22d6ac7e65811cb0e17eaf879368210c26a20fd553204df2e06cb9cf58d4c19fe3b1dead430907fd186d87bb9c9a7afb09fd389d69cc9b39fecc
SSDEEP 1536:kNS2AXW7axoDItayH1pEPAfFzELcpceTwoX0eskqoMf0PHKi7+XF:JWktnHwAfJEL4ceTV0c1HKG+1
TLSH
T159730227B008563A93A0C78C371A48359FFAA0FA1B1452BFF1DB50DBBFE450635589DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 408KB
SHA256 7a50cff2ba27964e1dc892708f201b97f5513ecfedfc4e7e82ecf6c1246f6132
MD5 42af94577490c2f5dc901ea2d3e2e4a3
SHA1 8c93675968611faf7d148c12c1b2170c22075770
SHA512 273d37acb003a2626c57183301d729164bc310d682f159493c63f51f56ce1424e8367db630cfffdf452451011996a79e492c8f78c0ebe75765e1b1f3a94e5515
SSDEEP 6144:CCPRy65+Rj00vSwG8VeWXC8WSMLJI4U1HWUDjfK7PROSLw10UXiA7fg1wfN4kZiQ:LxUAa1d7MLHpU/MQCwqUXiA7LekM5ZY
TLSH
T1C39423D0B157AE489DD980FC00E12ED0CD16D2AD6A077FB61490FA9ED5AE7AD0C891CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 85174b1341c3c2c2d16bed16f6afbb30e5c61013dd352a298338b65a38f24808
MD5 5cab11df6809282a3c02d74191fcac14
SHA1 365471daf09942b919656e0e846f6af53c09251b
SHA512 ac84a14f3e335c4f45b15e44c845707c3d7ce6e01fa77b1bc8349639e9ad96d41a2c757ada09bda0a9745e24f16f14cda15674eca9951bfe2781e0731e9c5ba1
TLSH
T17161720CD902D941F36E273DFCD122E836B285D45EF39E1932B069BC7617BA191FA448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 278c6c758e15b28db71a6fc069e66ddb9360374968555f43cb26b12729e9834a
MD5 c9477b6885192caec1911919b6c195c6
SHA1 ac80c9afecf665a069bc4cb6c736d32d4fb43d41
SHA512 0b4b485b5092cb510e49f6bc9dd44d44b884e7e847fcd90d54ef8b2898e23fcbe7e364b6de1cda531e26ccb70a62dd3d7280aafebf157323547f3d2b014b8ba4
SSDEEP 192:sNitgI32J/Sf9hDp1A0T25j6FaKuCBZj87/gJ+awva+5poNL:sQrHVhDfA0QiUa08NcsL
TLSH
T1EA02E8CEC580C291FB2D1B3CE9F549AA36716D8984E39F062170EABD2517F8493E4D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d0ff9b068b72ab795800bfa310ae1c54bb6633f8df51729c45d7949e0982031d
MD5 b6b5f584c0ee1a8afbeb75a961f7f2e1
SHA1 793f2f663e2e33f1e31c4d324acde8acc52533ee
SHA512 35f7ed42f5de4c60ab933302a2040b8ca6fea4210c471024edde13df5ff9455b62795e3a33942d13f66ee344240820b9b66d2063ebd0df001996eaf040569a7b
SSDEEP 96:D9kiNOEfKKnNYYzoi1uwBc5HzRBGTOxjJ4piE173dGk:D9kigOKKnNYYsi1ukc5THGOxjJ4pic7x
TLSH
T1F6B1ACF3C7E6822DC92196F09A187F2BCE1C0956436C3D1A85D4AF5BA3F2471E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c22430be38f3ce81c8601896a607ed8e93a1b73e61763b83ce61bf3443d86f5f
MD5 7707054f6cb709593a61baf23016d85b
SHA1 f699b84740789157a1a9b40f28dcbc52a77baf11
SHA512 316435e7dd1c1958eefa083f3734246291ede5fb7f8158d720f672faa5fa7ac89c32772bced066e747eb7d2d3289404ef06cff095cdbf897c0cb5964abdffa56
TLSH
T1ADD02353310571B5956D7D85416AAC4FD32710140C01DDD518D0589D053549C4A17545
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe596aa7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe596aa7.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3c4c1706f790536184b30f8c103c4409bf0a7a98a87727d70bb85ebd9e3cc8ae
MD5 7ec47caef5ce710a15f4d61003d1ad7d
SHA1 6e7ec6f2062a9dd8c9b9497d8dc7f5222e87063a
SHA512 a4f80b927a39b6b0cbcb0d97984a326c99d3a08e0a32a50c3b3bb23efd35ea26849ab21fced66827b6749abff95c00c2b212fd6291672e5fe6d8dae5cdbce163
SSDEEP 192:sxZaRSnh/f4s2SIdpJHW6+WNGYLl+8OQIgrJ:sxZaGh/f4s2bJHbG7s9
TLSH
T1B422C8116E38A57B8CC7E20DBA25BF53E6F9503295951E58EAFC861C04E7ACE130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cd5bdcc75d0c0d2bdd6c06c39ac16b9b8b30e72d995c692819f62a1e5cec29ce
MD5 22b60ee1d8bf6a94c55da58cb9040a1b
SHA1 737cae45ca32d2e53f4093ac57a3cea069966298
SHA512 3dac834ea5593da819b183c5dde68c454c3d8adcf77c11b7adebf07385165d75250a3c5a586071d760b9665ed27346fa80d16c4daf0fe2489edf47b03489fd57
SSDEEP 192:sxZ3RSucBWh/f4sKEnPbczddp4CtwfHW6+WNtJek7T4Z0a/YLG5HuOQIg5WBDgSb:sxZ3/mWh/f4sKQQ10HbdMWa//rsDpS
TLSH
T12D72D952A53499778CC7D61DBE35BF12E6F950238C911E9CAAFCC91C04EA6EE2307417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 217b58763c68f0f6fa97969beb64499babe18ac264b5777ddffe5fc80fb32a3a
MD5 d74871db040971b9cabc43de4d1e48b6
SHA1 1a6af8ca4d631aa311a5aeaf41a03742670fdc28
SHA512 7ea148035f4101a99e52e3462dc72afeddf3d31c8e54ca0097695becd0fdcbcc9786881d7a58ea2a9867221b1844577412b077a764af263d3e8b37652185c2b7
SSDEEP 192:sxZaRSnh/f4sYSIdpJHW6+WNGYLlc8OQIg50J:sxZaGh/f4sYbJHbGdsy
TLSH
T18522C911AE38A53B8CC7E20DBA25BF53E6F95032A5941E98E6FC861C05E76CD530740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 090fff26e8cd378035203cd54b8bc2ea683844e9e5e67f99aa1ccb7423bd4e56
MD5 d36d9b8bc7d6cb68f90b39ba3ef35d8e
SHA1 acef7c563db97b8035d77f76477bbd0ae6f1d7e9
SHA512 bf0f8ddac318122207cede8fbf9a63dd0f7e4b6539dd150a319b3c071bc72f57744c90d37ff7972c02095f14295221cfc364f6e0ed6be9c401998b3d6b21f5c2
SSDEEP 192:sxZ3RSMPh/f4sKAnPbczddpmwHW6+WNBk7/YL6E8OQIg5WJ:sxZ3xPh/f4sKMQ1LHbC/Osw
TLSH
T1FF42E811AD34693B8CD7D21DBA15BF52E6F9503299941E88E6FD8A1C08F6BCE131780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c05e7ebb8572f0723802555dbffe4cfc7330f6efdc34e517285188801d6194b3
MD5 3ae8336451e18451451d63d2fcf0faf6
SHA1 f4581f71577a6c06da28c64e88091db3c8928b5a
SHA512 578126a3a8feeadd2b36a1264f0a19ce895e634103e3b8d4d795d13d3ef63777baa5164e33437c6c5a999eda1a919f908ade3a6cdd5a2180ce14a0fad30fe7c6
SSDEEP 192:sxZ3RSucBWh/f4sKKnPbczddp4CtdHW6+WNt5k7/YLdH8OQIg5WBDgSipvE:sxZ3/mWh/f4sKmQ1vHbE/MsDpS
TLSH
T1E062F852692499778CC7D21DBE35BF12E6F940238C950E9CAAFCC91C04EA6EE131741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 728ed8d12148c8f0d3b42880515934e52976917bc8b4e5c7ada4e50f6baef4c4
MD5 b2bf4cd9e2d25cdab7b816dd18ff44e8
SHA1 fce4923fada4833a54d90b52d018e25c22cf7044
SHA512 2328c0f185f5aa7da80d30168d127b1a31f8a91d37e1e5ef27f69e3ad89bd15321fb1aba369bc04ab2b7376a069abce8c586a76e1c49d6133bf0716276007196
SSDEEP 192:sxZaRSnh/f4sKSIdpJHW6+WNGYLgE8OQIg5WJ:sxZaGh/f4sKbJHbGysw
TLSH
T1DD22C811AE38697B8CC7E20DBA25BF53E6F95032A5911E58A6FCC61C05E7ACE530740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f24f45d1a8bda4a5d3d30e6ec354793eb49d060f950277956d8350c04afbd3e3
MD5 d36ca80f85f57cd3af0d6c8707ae37ae
SHA1 f15412c184bbb0b440118feb6be18faff40d9a59
SHA512 850d704ed15eff4eb37e4501bd956c1f74cd8ced3765ae7fd4ff7b43f73c32d71b2694736d60703a0d521728e2c9c72afca5c85600a6beaea7955bd378d25e14
SSDEEP 768:jGO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJv0rolXR:jGO6fP1Wvxz3ju1jaZILIsvflXR
TLSH
T172C2E73B640DCB7E4F801A9DAC5A6F973E9802C7AB58898447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 8458a127c67ba62c76d153377cd72305b9b591460288cce9a65dc32c515b0ae8
MD5 209a6b2df4d1bd57af5295d3736d4c5c
SHA1 1c2e2685b7207263145c31106fa342ced3cce504
SHA512 3f9104ba20a99731fc7dd1f4ee032f9badda82b41122352b903ad3aec920474a4e3850f55bb212c3ca70aaef245e1d47bd9d3469a2d71d90bc72e7565920b936
TLSH
T1A251E74E4E074F6EDDA8127518B50494337426CC1378190BA6FEC138FCC7B186C99BA5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 816B
SHA256 c741aaa17b56acf5fdcbfad552ea35871f8c3a9e9be9f96073af76d2dbb45849
MD5 52afbe9c81cd7375db7ca09e80d7ac8c
SHA1 a2314f157e0b94805a2340c36e6a51c4eab64eeb
SHA512 186f2839e6f1069d28371f39308a97e09ab6d903c964c8a102d3fa746a5f44019e363d0a163ca660500889c661950029693614b2358651b4c96de36d49937c9a
TLSH
T1F901021A5EB14C4FE45502B71876E0A4B33054DD8712E2239C2C26322D6734934575CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590248.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe590248.TMP
Size 816B
SHA256 0daa7fc7145e198d1b4ffa4b08360104a15d45d925712bd32376cfe37f1d4807
MD5 bafcabdad5536d183a29b67719e30b01
SHA1 48b0b6e6769d8cc603070f63bc58c0b3351742e6
SHA512 179dd2f085ea5b07f5fc515a8f69bc2d700b3fe6539ab14780f3ce10c7320664d04653a70874c75fca58f8eb9409761e491624768163da914867a195456a6532
TLSH
T16D01E15B8BD64D1FD848117B1DAAA0F8F2314D008322F3A3A42D153E5C367CD09070CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 f3e0295d694a7dc5e918a9d08dc64d7a6f88224858f3677f0692c85d938690b8
MD5 68b1b1a6a9ec8948a3ddd2451b817e4d
SHA1 9654f4b33cb2a1088e72f1a84aafac12d53029b3
SHA512 31a28ee9265c572e0de19cc24c8b69a7cdc497c37f73f3864bf854dc5493a9b983c1c1f39c0265ccc8bce2a36140d2bae53a4bfe4fb36b321061f00a7efb25d8
TLSH
T1A9A0022417804015C99A12B115A616421300CA601151B31751B10158DC5A4C44D6140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 bbaffb405f97d3b6b511fd6c901b88a7d060d4c047acebd31d2453b5486f6edb
MD5 9a6a2268427aafe32f81a1efaba750b5
SHA1 3c7b0667494e6ed6a15f704057c01aa484cfcd55
SHA512 d93b4e265129e08e2562bff810be99fd8128c4a176f28caad554e7868e84b35f38f15ce42cdbdad1ecff0e2b36e584450d3b10e276da8dae2b2f4db7a1fd02b8
TLSH
T179A0023B07810619D012B3B065AA01612756ED224316E70B42F48044CC559475FA551C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8a1d12db6e38548fdc68ae93c22e79503aeb3f47111aa5a1bb17ca37dd93440e
MD5 15b8c338fd20b718f654b7cbd1cf72eb
SHA1 0cd6912079f86a37f58f9ede0e1beee49dfa0094
SHA512 a550d6df96c2b6aadb3c5c0de3f13101f4e35a0d2b03d29ff9a201d1e21e6011357ad8658633716d32cd04c0d0f3cb962aa9aa5e1c1127a8f29bf25c0b0614d6
TLSH
T150E0D8BB6EA76820EDABE3E7247054750541381C8805BC4F586A96C351B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6365b97ecbda5719068314e215ae88710b99944f28ef58dc184df7197b4d206d
MD5 9469757c15754d94a90064542f5d06ea
SHA1 ac71d45803d01cedefb581c2eecb1cc324509e60
SHA512 e42ee474d843960f0070edef0e3b9990c5f912125d79181a4c75354acfc68df433fe442821fca39dc7c7c37a410b260cca42e2aee7428178e7be4ae880dd75a7
TLSH
T1ECA002B5CD4BA049C420077920E5996037D168D902463742D5E8D4D8CC92640E2D1131
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595ad8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595ad8.TMP
Size 72B
SHA256 dfc8d68c3241d26eb3e19a8280891a4f2f191b1abc85158ae552daed641c7df6
MD5 2790c28d77cb103c43c4ebba54cac66d
SHA1 6a83defe7a44bd4d2e9e85581c60a5d5be7b9755
SHA512 c9e62a2a8b8f3af7a231648ce55dd393ec7a49a6f5017fdddfa765004d976116b1592cc4b26704d00be37e1333e3784a15c21c7faab8867609bde9ce821b6a57
TLSH
T189A00296C242680CD04163F0B6571A646201CE188700530280A41589FC505844535588
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a8af64f496fad15a9de8b244f3cbc1bab93ff784fe24418ce2ecf8c74aed99b2
MD5 07edb60ff5a30098d840986fa7e6700e
SHA1 82cce48b4c1918802f11d5391e063aab631b8365
SHA512 51415650e780d357f77e9823ebff03c4fa9131abaf8eb706947d4ee74f20c7f49c245e88594fdfc66657ae152650fc9ac904a1b26c8c8cc48d80fc5410e181a3
SSDEEP 96:KUAAKtePGbGKYcaG5CKSMt5iKqgS+VWKGkkmfaWcH:iiJt5DpBvmfaWcH
TLSH
T18FE1F11271BF06173DBE2A08A39487274B427163702EA52B3BE950B14D6BE350DBDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7256218a-a94d-404d-a1f2-df907972bed6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7256218a-a94d-404d-a1f2-df907972bed6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ab0604a39ec3f69fa9228397f25efebfaba340834caa4cd1cc06f1f44233b88d
MD5 21cd16d2a6ead8b76f839252654a7164
SHA1 fc2fd9b78505ddd850debd4b7a558ce991e6cacf
SHA512 b176902e3b3a57029265d114cf5a6e931077a3753a99252cfa1be1e88ad7dad6fba92c8beba3c9d1dd944104ffc2c31fff5a0fb909b3a4fbd703151031a4e3d0
SSDEEP 192:uZLsNn1QeaS1Jj7+3v68lQmiU1mxI4atb0CO2bClwEkLMCrqT2rU8:esNn1LaS12dD43a9LOdlzZCrU8
TLSH
T15F3219327C789C775DE2A184F54B36139FB9512BDE8A2F90C6ED5E0C01DB6AC235A807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6140ef9afd26fcc070f36f51b33d640aa0faa0e1f5348549a9124d76d3110330
MD5 c667a52616c22f70652097be16ebf65c
SHA1 731f329bf819cf23f3941d459ce9b846f4519f63
SHA512 8b0236d043216b7605a1387940505fe9fa9b7a5222d393ba3bbbc79949e4202e0d261506c0bcf484c5875e621d8235287d015288d53ec2fb3208908bc14d9f29
SSDEEP 384:riFpZcIQsNS8TUNTUlIlST1aS12jUDa9LOdlzeCrsa+VYbGAoU:GFhQBwgm1lm9O3zeKhg2bv
TLSH
T1DCC23BF258E78876D8AE9743EB7E2D034EBCC057B9855950B3D9490CCC961BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e017092bcd109a5fc989d738101c356a8d59bf8e1bf3ddd88016b29177155f2c
MD5 7bee29f21e4ff9824b22918cf0cc6d49
SHA1 af5ab6707cb0cf48cea9f9917e2ed27e1f58e316
SHA512 4f803ef810651e3bdcb269fdb404b25962e1e275b5823a7c5bcf190b1c7407ee76a18bd5c6df991a8b61e8a84727dc5de1765d08a8e11d9be2609b0b34ed0ab8
SSDEEP 192:qONC6O7+3hQmiUyTvGttb0CO2bCygG2uU6:qONC61cGt9LOdkNU6
TLSH
T1170207356C7C6CB78EB2AE45F68727135FA5103BE9922F80D6E81E0C00D769C2343823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fd5926bbf64cb149ebcc24fe731de256071829b8b16590cf20b39a1ae5d9354e
MD5 4057a386c34b9616dc6f1623d76c4a56
SHA1 04c68a73a3882ad7da3a0e97ca21a565feb4fc62
SHA512 fc42c4a1a9b0ba7a92bad6452cc351a087b1e5c99955aa338cc7eecc18cce4b4af05aab464ab1880975a77b0e5361bfda4a83f02008478fbd32559ec6df9f908
SSDEEP 384:WZcIIsNnST1aS122E42a9LOdlzICrsa+VYbGAoU:EIH12439O3zIKhg2bv
TLSH
T172827D726D789C7658F3E285FA4766074FB89167DAC92F40C1ED9F0D00DB6A8134681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c1a3fab9b52118cca1c4bb881042418480ac3417ac2b243e1f21ff58778672fb
MD5 14cbd0ddf23d221333247b2a393ddc32
SHA1 3bba88fc31e3d7837377b76945b8df8ebfe4e4ff
SHA512 809198d8aad16909892558e5110c428b6d162e0d073f9fb905579e6454e3caaef0cec80e9a7eb1d5c52156c3c3ad6fbc7483253b37f619e7533244359fdec1e8
SSDEEP 384:WZcI7sNnSLaS12R43a9LOdlzICrsa+VYbGAoU:E7h1hK9O3zIKhg2bv
TLSH
T169827D726D789C7658F3A281FA4766174FB89167DAC92F80C1ED9F0D00DA6AC134781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6673d7bc30d203e5502743fd4233fa3fce8ef9c1c1a61a4d46685b79c20a50bb
MD5 9d52b8b2264e30eb3fc16abe321233a3
SHA1 9cda05fe4ed2097de549e08419d4fee9f7af0bb4
SHA512 231552d9da56666535b63c9b8391099981d516b1158c62fc31e846f25502ff117595deada27cc4ddec4cbba5902e8a35fb497bd1dd3f50a18a5cb507a081571e
SSDEEP 384:riFPZcI6sN58TUNTUlIlST1aS122WDa9LOdlzSCrsa+VYbGAoU:GFH6cwgm1km9O3zSKhg2bv
TLSH
T112A27D735C68CD7BACF7A785FA4A22038FB481A7C9C5AA90D2D99E0D00DB2DC1347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 825dec0ccae2472e21e89b643d681c85aca6e684c006a3e90246f2495eb974a6
MD5 ca94767ceb2ef14b3b96a2ef4e5e8a55
SHA1 a5efef34c1db527ea0d867456d77121b0da54c55
SHA512 97a97758b8477ed51016078c974b35e19ad70115b3d27b714f7cc3a3e1d1cb388e18be0d8e82b0f98105ce7decf519beff94ab0a6b5a7ecd1b6ea4b9ecf8aadd
SSDEEP 192:uZxsNnYGQeaS1Jj7+3v65QmiU1mxI4atb0CO2bClwEkLMCrqT2rU8:esNnZLaS12s43a9LOdlzZCrU8
TLSH
T1FD4218327C78AC765DE3A184F54736139FB9512BDE8A2F80D2ED5E0C01DB6AC235A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 96c373b13c6ae6c54c90053875d7f790bfc61734a56e5c521b677b585f7a4895
MD5 a7b991d0ebede593ecb3ebd4d70913fe
SHA1 ad0eb76c38f937bc3111e914e57f4180628f2555
SHA512 e26ded25f640dfa2b52588b59c34a4f15e80300737f3737d511addb7a649782176452dc1e578b5085d42fbda9598becc2e0609863c953fd30f884504d4cc573e
SSDEEP 192:6ONq6O7+3OQmiUy7vFttb0CO2bClwEMcNCrqT2rU6:6ONq6oCFt9LOdlzlCrU6
TLSH
T1D4121932B87CAC775EE2A584F98726175FA5512BDE8A2F80D5DC1D0C01EF6AC234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e93956ba994e6909d8d592f7a3655254b43642dc7075690011f2d1034e50e5f8
MD5 c90681d125e409fb8f8cdffdc302943d
SHA1 fea319315142d2725c0a80bbe5fb89150b466ec8
SHA512 8e1276ad078542f0f450f96359b8c359041670ff666ddbf1323314494c28cdf04b91b151164ce37d06f908f0955d01b930b2376abf2dce4487dde01b62d48a85
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59a639.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59a639.TMP
Size 392B
SHA256 b6977e9742b02ce4e5351e90fb4ce5919a74d41264f03467848f8fdcdc1648fd
MD5 e406b6952ab87cb837914f82fef0bd4c
SHA1 7cfca39553fd4c4adbbb834c5516383d19f8a50a
SHA512 ad4a5e6f30ef4162b1e955c3d3cbf7e1598ae5441e655375929fa94ecd4981e1919b1123bc1cd179bc606bc2300e5d07e2038987437cc9a76c15dadc3a52ca84
MD5 SHA1 SHA512

Submit Download

6d170fce-48c5-415b-96b8-8f23dec5f6d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6d170fce-48c5-415b-96b8-8f23dec5f6d1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b29f041d153977142638e14cc92891dda0104d37a4c8fde2da63325b4c71244e
MD5 9274c132243df7e65c5ff47b0f091967
SHA1 1546efd224c4c1580d9efaac569b668e65a86954
SHA512 1bb7b6451808596adefa4486b5ec1c817888603f785a1ed121d840e9a8cd4f451f0b5a978ebcc39126f4a325c1aa5dd65e4c06b0b83a166ed495a32813dfa400
TLSH
T10C410B5CAAFA1108B3776E1A9BF6A86E487F79772E06D49E10010E4F4663B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

ES_session_store

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store
Size 10KB
SHA256 cdf6a6c71708b37aa9f43b50ab988c1ea60b3fc015bf3cbfad9be7bfa2e73877
MD5 a248cbd22ffca6edd294326c2659bbd9
SHA1 cf8fc4bee3c1e3a3473cd6d17a6d926c937519b2
SHA512 5f7afb44faf18b1d6580b7e0406ea6c0c371aa5ef110a62f807f8b304d06cbda0922138cde50e6f722a85340007d85cffb00240e29b5c9741a64e1befbaa749b
SSDEEP 12:ZYPQipVmkrkGSiwK6M/OJoxlu7jpRpi9rKCbFjZ4DfQYDOg:ZYPTVmksLK6MHxlERpi9z4bQYSg
TLSH
T10822EC006598C76FF45CDD3C49F1D0717309010467350C5F85C8EBF840D26C012F4130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ES_session_storei

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei
Size 23KB
SHA256 90381a2f7b882a8798dc7c40db0badda155c2e462a59a1b4f3d9065d0d4440cc
MD5 e78bd725ab8b19d4decbf2132b28d195
SHA1 b0858c81672c91c3ca2fd17717ee98fd1f1b1e8b
SHA512 06899ed0ab71dbd0a41061e61c62c534c6bdbea4878726148722904db3ebccf21044e882439c606baff20a551e39dc92088b81c580f6b95a2d170b521a397ff4
SSDEEP 24:AAWgCEQe0LURrwc7S3edR34wLxko9A73sIfKIiLXYI48FNEfli:Jaele3eP3TCgCKIiLo78vEdi
TLSH
T148B2082C77569F45E5DC39B6942DBF4008B3535A1B25C2B96724BC2D409573488B9A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 d04fbbde8dfc6e5a517df5a092e74ade7378db6a612088aca547b87c25bd1bd5
MD5 388647fd630d29b2be920967d41c2fa1
SHA1 c0aef75ecf64384cd8c4e965e6a1930ede8a2206
SHA512 840d65b4ce70829bbc5595ae8533547b5bab0fbbe2afa123b20010c4dc57fa3c87acb9d5804cceb3b15b18214391243aa587a44203ab3e89d83fc6d1b39bc699
SSDEEP 96:PTrRJNxu9ABkRJOuE9tzDwY7tzVbEQdCRJru9I8VRJnIu9P:fRFwXRXczfzVbYR5w/RBIwP
TLSH
T1BC02DF51ABEA2657F2F7DD71A9B33710BF76B8054A448E0D418081091C73B049ABEFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

New WinRAR archive.rar

Path C:\Users\Admin\Downloads\New WinRAR archive.rar
Size 20KB
SHA256 fc1912136ef2c19c9cf1f33c9eb79619afbdb7816d303b4f40908676210c41da
MD5 c33d04333ed0ddb663d16e7e7d9221f0
SHA1 fb0d6427ea9418224eec7770df3e707d2bf87f1f
SHA512 f6e4933d0daed1a2bf9f309d582a2566fffc62a3a87742a3bb952ede7f80e734358d8228feb0319455b3367573a14b8baf6d0562b5b2e070a0f710ac282523fc
SSDEEP 384:a4nIvpTPmZovU5ftsFHKmWOe/cOc59qJgL1Wg6Zfa7j2G9QgpM6EyXbBYgcidY:HIvZuZovrH11e/cd9qqkg6ZgNSMoyXbA
TLSH
T12992D0D262B4FE6DFE21C11296FB55642C281E5E67FE4E342784213F65E193B1064FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download