985824da6a4a4ec77ff11b53a25ba85a3edc3e3313724576d769000a2c9f3c40

Analysis

user interaction
yes
max time kernel
350s
max time network
354s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
itgest_protected.pdf
Size 55KB
Sample260922-qsmlbsfd77
SHA256 985824da6a4a4ec77ff11b53a25ba85a3edc3e3313724576d769000a2c9f3c40
MD5 8aadb6b125686c33208525d2435e3e07
SHA1 a393cacd05d4a0ed9b8c4053c70bf81f1a9ae3b2
SHA512 71dfb06d8eab157ce23b6a16a81486fedc57360748917a9fe16f4606b236eaaa6aa11e326825230952014139da679cd9969d519c07ca878145ee6fc93420b7fe
SSDEEP 1536:E8ZGCNsWvEdPdIPa65R5+VSdj3e1QteILlgx:FNsWvrH0SdCKJLlE
TLSH
T16243F270FA0B8A47DC81DDC9ED1C1F2A73C1C83D19AF346528646804669DBB4F5EC6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL 6 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	60	[email protected]	4732	msedge.exe	1
Email address	60	[email protected]	4732	msedge.exe	5
Email address	60	[email protected]	4732	msedge.exe	7
Email address	126	[email protected]	1424	msedge.exe	1
Email address	126	[email protected]	1424	msedge.exe	5
Email address	126	[email protected]	1424	msedge.exe	7

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Dictionaries\en-US-10-1.bdic	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1294975653\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1294975653\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1294975653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1267687251\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_812395621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_812395621\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1168408380\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1168408380\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5028_1294975653\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1424	msedge.exe
4620	msedge.exe
4732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345575397594382"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{7B388F4B-359E-4974-9B28-EB281D62E257}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{F0BD28DA-B461-465B-8AD1-1AE75FD49BC1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{AA8F8DD3-CE29-4EF7-AC47-2AA1F6E6C86D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4196	AcroRd32.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
3768	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe
4196	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2780	4196	AcroRd32.exe	89
PID 2780 wrote to memory of 2448	2780	RdrCEF.exe	90
PID 2780 wrote to memory of 2448	2780	RdrCEF.exe	90
PID 2780 wrote to memory of 3964	2780	RdrCEF.exe	91
PID 2780 wrote to memory of 4308	2780	RdrCEF.exe	93
PID 2780 wrote to memory of 4796	2780	RdrCEF.exe	95
PID 2780 wrote to memory of 2076	2780	RdrCEF.exe	98
PID 2780 wrote to memory of 5664	2780	RdrCEF.exe	100
PID 2780 wrote to memory of 5664	2780	RdrCEF.exe	100
PID 4196 wrote to memory of 5108	4196	AcroRd32.exe	102
PID 5108 wrote to memory of 5668	5108	msedge.exe	103
PID 5108 wrote to memory of 2996	5108	msedge.exe	104
PID 5108 wrote to memory of 4732	5108	msedge.exe	106
PID 5108 wrote to memory of 2996	5108	msedge.exe	104
PID 5108 wrote to memory of 2996	5108	msedge.exe	104
PID 5108 wrote to memory of 4036	5108	msedge.exe	107
PID 5108 wrote to memory of 4036	5108	msedge.exe	107
PID 5108 wrote to memory of 4856	5108	msedge.exe	108
PID 5108 wrote to memory of 4856	5108	msedge.exe	108
PID 5108 wrote to memory of 4856	5108	msedge.exe	108
PID 5108 wrote to memory of 3796	5108	msedge.exe	109
PID 5108 wrote to memory of 3796	5108	msedge.exe	109
PID 5108 wrote to memory of 3796	5108	msedge.exe	109
PID 5108 wrote to memory of 2536	5108	msedge.exe	110
PID 5108 wrote to memory of 2536	5108	msedge.exe	110
PID 5108 wrote to memory of 2536	5108	msedge.exe	110
PID 5108 wrote to memory of 2072	5108	msedge.exe	111
PID 5108 wrote to memory of 2072	5108	msedge.exe	111
PID 5108 wrote to memory of 2072	5108	msedge.exe	111
PID 5108 wrote to memory of 1448	5108	msedge.exe	113
PID 5108 wrote to memory of 1448	5108	msedge.exe	113
PID 5108 wrote to memory of 1464	5108	msedge.exe	115
PID 5108 wrote to memory of 1984	5108	msedge.exe	116
PID 5108 wrote to memory of 1464	5108	msedge.exe	115
PID 5108 wrote to memory of 1984	5108	msedge.exe	116
PID 5108 wrote to memory of 1108	5108	msedge.exe	118
PID 5108 wrote to memory of 3044	5108	msedge.exe	119
PID 5108 wrote to memory of 3044	5108	msedge.exe	119
PID 5108 wrote to memory of 1732	5108	msedge.exe	122
PID 5108 wrote to memory of 5212	5108	msedge.exe	123
PID 5108 wrote to memory of 4692	5108	msedge.exe	124
PID 5108 wrote to memory of 5456	5108	msedge.exe	125
PID 5108 wrote to memory of 5456	5108	msedge.exe	125
PID 5108 wrote to memory of 5456	5108	msedge.exe	125
PID 5108 wrote to memory of 5516	5108	msedge.exe	126
PID 5108 wrote to memory of 5516	5108	msedge.exe	126
PID 5108 wrote to memory of 4052	5108	msedge.exe	127
PID 5108 wrote to memory of 4052	5108	msedge.exe	127
PID 5108 wrote to memory of 5032	5108	msedge.exe	130
PID 5108 wrote to memory of 5032	5108	msedge.exe	130
PID 5108 wrote to memory of 5032	5108	msedge.exe	130
PID 5108 wrote to memory of 5096	5108	msedge.exe	131
PID 5108 wrote to memory of 5096	5108	msedge.exe	131
PID 5108 wrote to memory of 4044	5108	msedge.exe	132
PID 5108 wrote to memory of 5028	5108	msedge.exe	133
PID 5028 wrote to memory of 5428	5028	msedge.exe	134
PID 5028 wrote to memory of 3596	5028	msedge.exe	136
PID 5028 wrote to memory of 1424	5028	msedge.exe	137
PID 5028 wrote to memory of 3596	5028	msedge.exe	136
PID 5028 wrote to memory of 3596	5028	msedge.exe	136
PID 5028 wrote to memory of 5564	5028	msedge.exe	138
PID 5028 wrote to memory of 5564	5028	msedge.exe	138
PID 4196 wrote to memory of 2468	4196	AcroRd32.exe	139
PID 5028 wrote to memory of 2300	5028	msedge.exe	140

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\itgest_protected.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5E5CB50C5052539FC935C1F7E99D567A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5E5CB50C5052539FC935C1F7E99D567A --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=280F0F2210583CD5DC70FC565857C48A --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3964
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4012B37C0493C192ACFC2CA654F4F83F --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=31ACAA1004548069F2DC1D264AB13D74 --mojo-platform-channel-handle=2060 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B1911BD4135E2C7B16C754535F716608 --mojo-platform-channel-handle=2516 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D3D8EAEEA62CB53A79E0C266629B2A00 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D3D8EAEEA62CB53A79E0C266629B2A00 --renderer-client-id=8 --mojo-platform-channel-handle=2504 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bz.bergenoso.com/itgest.es/
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff1ad7c188,0x7fff1ad7c194,0x7fff1ad7c1a0
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,5966115584415411212,16564846359672389653,262144 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10405743830549356188,18319178647871178789,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
    3⤵
    - A potential corporate email address has been identified in the URL
    - System Time Discovery
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,1624687931442280504,2015965360514622146,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,14403903687930889539,15130291447009786894,2097152 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,1003154797378513678,555876403755589494,2097152 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,3834982966809775549,1938838038996779067,2097152 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,315472460417438219,9481765603646607460,2097152 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,1133123561318094597,636984553997488220,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,17111416300321636999,14475249827852402103,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,318393398420686588,8052033206477263187,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10362735157763292488,12471534973998733126,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10362735157763292488,12471534973998733126,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,5710876447562346953,17522151587970704583,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,17505750094434473832,1603700324937352011,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,11320391925313481375,11231081791531170802,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,3004774693292998458,17578330249782070608,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5400,i,4041123465357456607,3138364856034373732,2097152 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,12685171920442996787,12392941719828544826,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:14
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,2799449420182032749,13631912037226803836,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6092,i,5300452262771931141,3385419442790513984,2097152 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,3316409362739260632,12472682343193154997,524288 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,3409574941052744870,10784363472120909621,262144 --field-trial-handle=2592,i,13028674909011743837,4822990809832750146,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:10
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff1ad7c188,0x7fff1ad7c194,0x7fff1ad7c1a0
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12354794900515889249,7751445663424521369,262144 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2737672938268231285,1362404588883245818,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:11
      4⤵
      A potential corporate email address has been identified in the URL
      System Time Discovery
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17625597008602752923,9071020699750760238,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4428,i,17619435805987151920,4075291655878148155,2097152 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=4432,i,1299022726883365849,1372922180547564761,2097152 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,5960316665964444081,17227505085308039608,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,13722668459401250609,1264478440611905464,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7977153023204042193,14058423086113852409,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,11385281657862361658,9257662638650882541,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,11385281657862361658,9257662638650882541,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7154745917847035559,5943071907018790670,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12696540739608405115,4579227027933153801,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6268,i,5245417998981943016,1554615666942377300,2097152 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,2200849949715025150,11390281002891788724,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,7384567771432972190,12319774623393213352,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,17529015101049048226,15487263567146536390,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7409725668253787052,5409319989581741537,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2484,i,8077755941383205598,9130901593644020890,2097152 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,5815044909619628221,5979070987241244202,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7076,i,11520839280541238758,11053987888760053577,2097152 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,7430042871442973443,6576438695058068153,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,3896525808651750307,16933948895563843178,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:14
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6944859185041161457,17602981090266920836,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,2514045413952512494,9396354672368587460,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,4729901864593768101,10724611418638993377,524288 --field-trial-handle=2300,i,1390074042507696198,360666079962961182,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:3768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff1ad7c188,0x7fff1ad7c194,0x7fff1ad7c1a0
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,6518064014912677886,17653632495088093942,262144 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,1269628892647789341,8725706021099408734,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,7270034569059070960,800885015481987395,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
        5⤵
        
        PID:4040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,11797342172591002285,13146597857111131902,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,11797342172591002285,13146597857111131902,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
        5⤵
        
        PID:1800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5076,i,13247312097994628058,2373235002749377411,2097152 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
        5⤵
        
        PID:2992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5084,i,4443249583621155932,16302830704890338822,2097152 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
        5⤵
        
        PID:3568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,3324650285002662525,13440235837011990778,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,18155845672674259849,15796752888223677286,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,394618703351306956,7442948319804460780,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11410110885165199237,11223837635064701082,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
        5⤵
        
        PID:4024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16878754197140474455,10448957504974527941,524288 --field-trial-handle=2328,i,17736326017293639578,4098151402531548316,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bz.bergenoso.com/itgest.es/
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bz.bergenoso.com/itgest.es/
  2⤵
  PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 7b4adbbecb8831d34ef99cf6da6809045aa7b97e24ac580d1f52b12c6b91b9fa
MD5 83deb2070dfe24c118327f9b325d33f3
SHA1 4bf80c52e0a75d17b94f08aa3a0e2d734deb9a77
SHA512 10431e6b5f49bcff7c9ea8f2b14794f6b99d321b812b528cfe0acd62d16ae76b158d6947af4a3cec0b71ce80032a5043683998d2e6ad577dacef5c8b1a43dc6f
SSDEEP 384:yeVdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:E+eUZsLQCZsL3hUS4
TLSH
T11B53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecca47ad3d839ae4abeef18b12616a09cfcec0c9f9d94e0a1bf4037e7f61a0f8
MD5 d589441956017ae76bee817078e4922d
SHA1 f923467be2f57e941f50d65b9ae39e9e76c1a7ee
SHA512 0cd99e745bdc67848170324f301898a5e17a2a05233fd25020e01c3cf61524a7c43e7e5dabf8746b514274416043b7af2c531b671d0cdf9afe376ca1ca3c3317
TLSH
T16ED0C0C8EB84CE78FA16247423208F2A72DDDB10180B0430F8C73E805C420430505874
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1e1a069377177009694971fae8d602de3e6f5509ded2427accd744afcd90db81
MD5 0212550e587d34aafa5928349df4dada
SHA1 08c83679aeb1f0ab07ff02a44b82c021229065f0
SHA512 e85f6ee51f6b79d38cdb21bd819634f7c97872b7394daa9cbd4e7d66bb79a02198feac4f8edd310ece062d84ca67365742b5602db70037b9fa283090aaa810f7
TLSH
T172D022488EA89AE4E529203843204E01718886226A030002D4812D128E620820842CB8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f9a8d3ea0743ee0d604dc32312d9c2c1876b38411f5a829737fd077b3aae1e8e
MD5 a6b7b1b94a80fdff43248a0ac4df1e64
SHA1 02947ff485df710d17daaf6254f12b87f0b6b771
SHA512 2bf5234c7ebe7b60605b786f9cde3627b2feef248a0cd33fb5d3750dbf5fcbff422dbb4395dbbda3c7b5bd3b0e65936bf35aec6f1760cf6b6d3db52c48a65718
TLSH
T1D4D0C0CCEB84CF78FA16247423208F2A71DDCB106C070030E8C33E805C420430506878
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be8c46b5993fc47a61cf414f0bb030d50a6680447054f1e2f9e5c253cf679ebb
MD5 68983dec5142948c5bd73789db4d4dad
SHA1 91533240e9a483659d90b6881dcc2dec30564b14
SHA512 5bfa220cee0b6ee3563fd84da477734958754f019ae0cf4566224d1fe053abf4b23bdb4c083faccc21e7c1e0f5bd3ce1cd83340afe2c0d61ab5ed11473aff48b
TLSH
T106D0C0C8EB84CE7CFA26247423208F3A71CDCB1018070030E8C33E805C4204306058B4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

48369cc0-e776-4c1b-8a25-c6e5d69c3d0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48369cc0-e776-4c1b-8a25-c6e5d69c3d0a.tmp
Size 414B
SHA256 923c314a1599996fe557684af9194971cf1134fbe7cdbf639abb01828f43544b
MD5 dd80584b5aa3cee9c4512c77a3439407
SHA1 f64f66778ef48d58cce8f51f20d0a4128ca48c04
SHA512 151f31ac566ba658ec0cc5629afdc8462004545c9ed06b09cddd1ede06652bf1eca50081ec933e63592a4535d68ff8aafece070ffaef77b0db7bff90e4798206
TLSH
T1F7E0E5A9D961B82719FD0B19A0580A0AFB1413972B81498F363C91598FBA66A1186C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0331cd678e16223dc3b9fff612cd6125dcf88eb147aac26c4bcec10851ec8aeb
MD5 837a93e8b09f5c740b9fd6d1024a2416
SHA1 4f7714659805309dd80019eb6645e9dd02ffc4df
SHA512 ef2715966c4c0d7e2b308f276b1c10fdfae9dd9a5b8cab29a229860dab629fb33dcb81c88ea2248879c949b8f460109151bc53c1a63d47591ab6e40983a7e8eb
SSDEEP 384:OOV+y28K71VaB16LyHl239vnsGncOJdYUeWc:OOEkU2B239nsocOI
TLSH
T10613097D37016ECAC6E2817C240B9F346BBCF528E4E4B9935332F16163A139A792E05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 df1d6fae781044651a94843bf286e3eedbbf2474dc8b65eefa0657e7254c52c6
MD5 f0531f5afa792f11f1645e938e4d77c7
SHA1 9b76ee7c48bad0bbeee5bc3ce58bff0e763384db
SHA512 f8d37e6900754280725d3cbf03c3c4f52cc8354303be99d20385db6fd06a9e70fbf22f2668ab52fd9f4564fa59425d0aef4f25fe0c9a3279126cd5c800158534
SSDEEP 1536:FemDLL/xrL/KcDQTqDJiOqvgc8Q0DFNXO:FemDLL/FL/nEEDFNX
TLSH
T173443FF70951A05BCBA852F5E2033E3DD17B411D7CD1F8E9E2788C952825F21B6BDA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 853806aac6019c19b19ea9289369074547f5b8b1b89ff493dddd0391d6bf3842
MD5 82c9216194bdda6410347dd83b75a44a
SHA1 67bd3f8213a615a7433711654d3660ea3649c536
SHA512 275553b5c72acd9352b5c4ce46b2c6cb19cefbbba3fb1cf061f3e838f95ea9849a0d86fc073029220f902a3eb842b52c71362a78c03f5ec9005d16d45aac3b18
SSDEEP 3072:Tv9G+bW0BHUntyMyi2Wz9QVfouomtqYeczhYvaOK4gvW2BOD:TQuBMyvFrtqYJCvBgv3BO
TLSH
T1D32539EECB682C82CE6B877470E0D9077E712082BA9DD0D39944C5D997D6B8175F82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 b1240c161e3f2a6b1e19e74277406650b5156fccd11d66b806061b864b40d93a
MD5 a427435ef7451080b707aa60721dca72
SHA1 fd1c75414f597ddb78b8af435644e645d9dde65e
SHA512 a456c44456d7d74d39f96844a3c1cc6750225c62e7139d0777ef116b5634408d0f9b6cfd2cada04df3efe5e8128987235fa4a62ce7e4f5939f37db04d325b268
SSDEEP 12288:Rhe/uGfQ4R4+t9y5v4FFvL+N5gT9S7QW9GowDbjxu2JOeMA05cyrR/artAyeIDPJ:YqghaZyqw0KnKGy7pG/DtyPjA5S1z
TLSH
T124166BEDC97858C3DD63AA30B4F0E9477C7413C3F965C1D6889CC18402AB7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 21KB
SHA256 0e2af238fb5928ec180d8ec84c25c034c15b0042a956271562f14e97b43aacee
MD5 f9299a485249dc523c03228c14938311
SHA1 b1f8708b04a02188e5eee4e69b5bc44b59bb7b4b
SHA512 29281f79e6e4e4b8b84d0f69b28527948fa443c5952b3679b2947c20e26265084e5ab91859390f98d8a3c13c4747a5217a8c777738cf56ddd09b493efd7f98a5
SSDEEP 192:vDIEOpUcHUNNdKvKno6ccK9mbLN/GB+c6Yh9DN3WFxJ9m/dCS46yz/V4iRW/KiqO:vDIg6SFxaMXn4sBHHsc1fA45ghvkq
TLSH
T12AA28522F2801825713797B5F7A35B96FA664103C20202387AEC536A8FF9D15D677FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0530e3cb1e6bcea8a3d8e5ca3211510befb65ea37da477ea4ee918ac3080704f
MD5 c37da972c564dd86540d975a7b7ca0d7
SHA1 9f709d5b6dc31a27d9e57044f0cdd7ef3f7decc9
SHA512 80874f360a502dfe2af570fd0bb7b2baf9c3fcb01f35267df57f5f64cadd20b848625b289b6d048931d5d351af10d99a5a69d5ee59e5f42ea59b83196062c8fc
TLSH
T19F71E70294E1A2DDDBB94C74A5E5649F7A3CB35482C3EE0205B1DBB6B41F3D2325F050
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 414ba5ee61e0d3dfe3693ac13706d55371c36594405cc77c93b08a75287195e8
MD5 8514d77500448ef24e99a8609cf6eeb2
SHA1 491bc1ca1770205db8449a2d470997fcc1225c05
SHA512 cffd98e89b7003558e21a34fb206fc6e0119b89f53d90f7a7c9445ac3fe5e9c60715ee28d6fc2a830219e2d3f8f5b0dcf82e4e70db3b74247c497458704dcac6
TLSH
T15961E54248E0A2DDEBB94CB1A6F2508F7A3CB3A181C3EE5101B5DB74B40E3E2325F094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f91c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f91c.TMP
Size 3KB
SHA256 aba7380b879b5645e11a4663215027fd7f9b015da1f92ac9699f5146cb21ff99
MD5 ee46030d5082071cd22146ee38ea126f
SHA1 bb1d1621a9aaf02d04ac3cd7868d191492e18e18
SHA512 558607f61269f241eb51d40774eef8ceb51e0edad143506de5d5c8b8ac7ad8982660547878f26bce7cc35be8b008afb943e122b750ecaa4ce6a62f2a0cdce24b
TLSH
T1B561E54249E0A2DDEBB94CB1A6F6508F7A3CB39181C3EE5101B5DB78B40E3E2325F094
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7afb4b5a022c0efe350907c802197fcaef1dafc43a3bbfc604bd7cd9a40db478
MD5 75b4965145872383a7d20509094960db
SHA1 3e9353802ce85edca1c66b725ab9d99787ee3b4e
SHA512 15f10cc35d344a0947663eb8d572614c86462b2080758d41e26714a94fda61f9534fd28ffa05acf61cc99230945e122e060b8c0deab9c046c95901c4409b7ce4
SSDEEP 3:MsEllllkEthXllkl2zEgltDa:/M/xT02zj0
TLSH
T19A440204BFC4A805C9002030883183501370D89816117753245644535C859401C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 40645e2e648b7b9fc3311acc79183d63976a12d8ca3bfac9389e3a9295203afa
MD5 c7ff187fd6bab487be2b26b299fe7e7d
SHA1 4ae1625c61269525456f11dc3e0fd5878d8ce612
SHA512 9911eb7391ab7770239388b2d39d290c3e836b9941f6ee9ab8f10d75d566040e9b6db07b75ed7cbae34af6273a0241eec7c4c387dfbb6ed8b2d363f37dd77b2f
TLSH
T1F5E026B805CAC16D9018AA9B83AC7B0897D03626EBCC3E022B0AEC447142242F2CB295
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 5981e2be40a961ca4ca3eee151749399133667c8238c529da13e17bfdd92cfac
MD5 c22378cb336d0548a3413d2f937fe026
SHA1 e9809cf46a32e188b314ab4ef4f8e8032cb423a2
SHA512 1e41c77a814b17e2fa7fe6784ce3b54b58dd23c0344112514179b37dcf49a9f0c50fa0dad07fb00cf50eaab639f960d60a234ed251ff7b03db167a735e620254
SSDEEP 3:MsEllllkEthXllkl2zEga:/M/xT02zq
TLSH
T1B54404447FC47C05CD003030C431C3D00370DC5417117F5334D344535CC5D401C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 696d67740c428da56825930c67e9e745d1c32cf17d229bb7d765c23c3b27eec4
MD5 75511f3891152360a8a9b801a03fcfe7
SHA1 23489e6698161f6145c9529289bf1b0dc0eb1526
SHA512 2ebc16a2276b2ff778947fcb976470f2face0cb8e23473a1f7dc97080d4bf463df3bfd07933cb9698c9ca100b4cc6abc6b0b0a1154ecd615f1e78dbd97388875
SSDEEP 192:1/uLogH+bF+UI3iWGVoWN3qL/Cv+VVV63:1GfIkUI3ijVoWN3qL/rA
TLSH
T17824425F5F703312CEBD41366CD748A36C6DF03F8B5365DA68621461CEE2692A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 32KB
SHA256 8ba2cbbfcf1c5a237814f5e234123404b4768d87ac0f626e4a5c783d52b858ee
MD5 c3b09e2fd35ec298a888af84675fab12
SHA1 5990e6dd7bd4f51fefd248529d8e5ae23a2eeebd
SHA512 d2722a17c91f8683ddd5702c4f8414f0dc5befbb4c66afa938752afd89696840323dc7ba3dc89adfc4d0eb84abd1fcf0bdc86edfe6318dbac753e089f2504fe0
SSDEEP 48:jD/8fGvG8g8VYhRgDzuuvOpL39+aqbhDqR:nVu8g0YhezuuvOpr9PqNDqR
TLSH
T143E2F37278F87202E36709B54D87FCA5BD9210FF8988D8C0B036580311276D95976BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a2c6717364d4ac5a05b2140f894b172137cd18846f3020e0289db9c779953133
MD5 346468cd99d69aaa259ae625e8cadc49
SHA1 99a5f287ccd25a3e4d213226fa6ab138805bab61
SHA512 72ab902a6f93bbaffb621b429193edd0434522f644f95689c96ec7b450928ab87d0ee786bd318de4d3fc2fb376b7e4804f3ec7d3f0518a94874f9f8214bed3ed
TLSH
T123E0D8B445CEC11A65086147433C7B08E3A03507EACD7F023F06E841B042044E6951D7
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 785158ae836d595d9c6acf96817258f8c36025c8264deec0469b11dcabba950d
MD5 f48d394c2fcccff60cc65e1d08c75b29
SHA1 cd06da62dc478a16ef981cb40be2ddc70dc515d5
SHA512 e9451fd4b4a4b82488f762d2c40ed4b0ffbcb1ab6a6792f9ba590aa3fa4cf7c510213fb98a52d7fc5d7fc5a2769077936e28a7c496ee9600a720b033fd28b145
SSDEEP 48:TUf/LopFMaty423w/a9NUuTF+sPom+sam49NkhUDB9NUxvN:aDeMatha9isos94qocr
TLSH
T17BB2640E1F303221C1F4063BD9D549173FBD202E87A36A99AA5894F39EA20DBB12547A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c5be480448df11354ae4aa34cbb7c7b750ad868594d1133e1f2cda51ae8e5e46
MD5 fcd6c619221201824edfb16f694cc755
SHA1 f0ffd488312b61f6f09ebc61e59cdef47b5eaee4
SHA512 16c689b6eaa01fcfba5cb701f19b4869c8797f3d4b6996d0c11b75996893bb16affa4f8c673d7c313fe39b138ee0d0cdfafb37d80cc088ae50f7ba9b01222850
TLSH
T17461CBF3C7E8862DCA0155F4AA046E1BCF1D0915436C3D5AC5E49F1FA3E24B1E282A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6f18746934ff0faaeb5f76c60d65e72ebfd2c3001831c02dc2f37414439370e6
MD5 0054e4950340b41b3b8abbff4f3f3b97
SHA1 902d6d92b5515f34366d31ae578953e47e9b07b3
SHA512 fb939e4bc396631162103a2acf16af8b897ff5dc1456a2101c7cbc1a3f55e23f50e7582281531de4fdb849692e104f00c6194d85abd35df12a8e5f938dede97e
TLSH
T1D761CCF3C7E8862DCA0155F4AA046E1BCF1D0914436C3D5AC5E49F1FA3E24B1E282A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ad21fc0d89445ed615c032e749cd6a1adc5b08afb522e4ec71d033aa2339d20f
MD5 803dd6145c474e08c021e969afff9c20
SHA1 8adb9e8fd333d43fcad1d19780638bd5959d68ae
SHA512 390eeaff5d069321e475f21160554286e0e6c87ee4d0f43004a5b8c4f1aa458efe590a407aa88661c1009afd2d0bad0524d52b1c8ad98f241d74f4be234f17a9
SSDEEP 96:DSzJynQdaRa8jh/2TP01diaBaBj4/QTsKIziqwBSSG5xfl:DAwnQdaRa8jheTSiqqj44gK6iqktGbfl
TLSH
T1EAA1ECF7C7F4826DDA1195F4AA046E2BCF5C0924436C3D5AC5E4AE1BA3F24B0E142A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 61223d44485143cb0a89e071a11522f51ccfc096a5d3f95e505b9c8ebb4790f6
MD5 0e58bd5eefc6020c145b8b0e4f1174b2
SHA1 7c1525732a89f93e97c25a20bf9bf9221d3011fc
SHA512 0bb6e4810120e6acedd516ef98f7898d10c0b8e2adf4e293a6a489caf35e351e20cafa8dfb85b990aafafabec1850060e3de11ab500e025ef8d6382e243a4003
SSDEEP 96:DSzJynQdaRa8jh/2TP01ddGaBaBj4/QTsKwBIziq5BSufl:DAwnQdaRa8jheTSdGqqj44gKk6iq/Rfl
TLSH
T1BAA1EDF7C7F4822DDA1195F4AA046E1BCF5C0914436C3D5AC5D4AE1BA3F24B0E142A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 a1a5070f115c69309153969058b1bf0af8c21632d7d0ba5e7b24e30bc2a20891
MD5 bb25f28552b704b411e7bd3952ad1346
SHA1 47fe56426cf31d25bfe541c48bd0b888f63df331
SHA512 38dc39cadbb4fcbff34f5ad6477c641c2209345e329bf1f40e7da00013c4a07c95aa1e4cc38b53b36542c28348cd8b90d99bb5bcb547b583a84445bcbc0869c5
SSDEEP 96:OIEumQv8m1ccnvS6hskZMOsdd69RsMfVAsgnFis9KP8sz4g:OIEumQv8m1ccnvS61Z9zYs
TLSH
T19EF220FB0B33A102D98440F090049B8FAF16454B47B6B6ECB6D44BE3F7A21E1B5B9756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 d1ec87674351f556e932b2c47bbc7364d3183558eb22cd4ec288cead2b49d833
MD5 af551f5c1bae8c531f8dc1bef5ee6538
SHA1 4d3db34dfa5bd5d399cac1df0f674ff01d46ebe8
SHA512 ed2a2fe78160adb68d03243e8e4641d74ca255c2cc5cef26f098aed49432e3a11f38ac5020ecd92529fed480295f75f16f4814bf8b4ae72f5be165dc64d3efa5
TLSH
T172C0C05380AFF43310BD1D3D7644F90511FDA830408158E7DAA3413C90817BBA507025
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 89328431c73c65479550a89dea2d5b2f89c25c4f32b77e906bb9e7794a64d1d4
MD5 1dd5cc0d9081c13ad30dca8a9f58db91
SHA1 943d2fb6dadfa164886b1a825bfd8fa5944715c9
SHA512 ebe51b1e8b3efd38a522e2636e84fbfeadd1f5d72779a090991b2ac513da620d395fd31cd6927701ef7dcc641497c49e9d051298a4ecf58650b2a2b151315bdd
TLSH
T1FE2145A7C22E6867507949AF0E5CB84699BAAC75424365F8E7A7823CB8905F31A83012
MD5 SHA1 SHA512 TLSH

Submit Download

a90902d5-6513-4633-a07b-902eeabd731e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a90902d5-6513-4633-a07b-902eeabd731e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 abbdd94f7ebd494d609c97a516fac9549ed183141b6527952ab47643f9974f37
MD5 c24effe7027811e1cbec7ef735025b4d
SHA1 6f37865a3076aacedaff228997d49b2094206db9
SHA512 2cfff7c032b328a9724426583267a1267efbdc0236f653c4ef39718f8b4e583a13673f71c2665f39de31e88683515477a5d7e932b823f4005508bc436bf045f0
SSDEEP 192:sxR2agRk/feGksJWpVEDZjHgzoA8pRiDHW/g6+WN9Rl0c94iZmaR/YElXtiTKGNj:sxR2agk/feGksJWvEtl//5X/x/l9iTdB
TLSH
T14262B556E834597B9CDAD21DBA59BF13E2FC503251D15E48ABFC9A1C10EB3DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0904cbd48ae9a7cd178d3e59c1bdb95ab10e7786006740824db1b09842e9a25a
MD5 9ff3ef7549cf9a38aca595d38daad17d
SHA1 1cfca8e71d4a30af514c4d0643cd5b253afb3511
SHA512 1e11cf0604e2b46304876aad36f7f25422cc37e95e6ca8bd39e4f7bce6542ff9927cacfc1df0c05fdcc634a61a72e3ed6eb75f2e45cfcd577630c84dda5b09e7
SSDEEP 384:sxR2auk/feGksZWvNklU8/5wTXPZ9iTrB:sKauk/feGhYNkv/5aPZ9iTV
TLSH
T12152B75AE938697B9CD7D21DBB55BF13E2FC503260D15E48A6FC9A1C10EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1ab4eb28afb35dbd0ce896278e0b1b0b29ad83c9aaea22b28d65eda696546f2f
MD5 161493c82f3c229d27163dee6bf17621
SHA1 f64a7a9cfa7dddb1d3274d7d961c84ab235c81ae
SHA512 ff24db7eb9a04c3993cff1f868ed744e380f69480e8fcc88dbac12b4c88ebe0ac04d7a9328c058608737b5cd0f2c5bf2367fc2ce9d73bd77674ff88bac400c6b
SSDEEP 192:sxR2ambDk/feGksGD5yzZzoA8pXs9/g6+WNaAc94j4XYcLjXtiTtGNaIgD1hJ:sxR2a2k/feGksGkw8/5GTXrj9iTfB
TLSH
T15042B759ED28697B9CC7D219BA55BF13E2F8503260D15E48A7FC9A1C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 44c1b141190b58c99e5d10b4cd687536626eea84e0f782e757f664d8deb46306
MD5 40c5d890c697d9a9c6872ccde9308aa1
SHA1 fa0e8c90d5de4ca05ce6b2cac818fe504f977915
SHA512 c2686796a7f7e57c5e91bd93901655c3f58f8b72919bd7bde3760a2139fed9118a19445fa9812ede5676945d2aae8c7cdfa30f07bb4864035beaa001144d2970
SSDEEP 192:sxR2aVck/feGkstWpVNDZj2gzoA8pX79/g6+WNV+Ac94thdYE4XtiT1GNaIgD1hJ:sxR2auk/feGkstWvNtqZp/5wkd49iTXB
TLSH
T1F952C759E938A97B9CDBD21CBB557F13D2F8503260D15E48A7FC8A1C10EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d22836dc9c42e2073b92d6c14f52aaf0486d93a4a1488b97b43132c065fdfb95
MD5 6046072481f76106bd5fce0f2baa59e6
SHA1 b7bb7aa9ea09ad1f2206a64d029757fb32fd7c55
SHA512 38b80b002254e9b97cf83b3f660924e45efd8e172fdc1d3278bb185300c4d7d42d6643c3a78f489a76665c70061e72028ca35ba07632bb6b42c7da758461226c
SSDEEP 192:sxR2amCk/feGksGD5yz8zoA8ptsV/g6+WNaJj4XYcoXtiTtGNaIgD1hJ:sxR2aBk/feGksGkxS/5rXI9iTfB
TLSH
T1FE42B659ED28A97B9CC7D21DBB55BF13D2F9503260D52E48A7FC9A1C10EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3b721d470454c81ca424f3c095c93d0c79dc7d273cd019fa3d029ee188fd92a9
MD5 81223523238275df32ffa4141f775cb2
SHA1 e67fa3d72d6dc53735d6133992b3ea16e1eaaded
SHA512 87781f1a109edf012a5b9326dfe130301af7e3c6db7b9df9cf4c13c553f115055051e555b0d9780a5530748df55cad24ec41b86fb6428e109cd92f4ebf94f9c4
SSDEEP 192:sxR2aVnGk/feGkstWpVMDZjSzoA8pRibHW/g6+WNVGbc94g31YESXtiT1GNxIgDV:sxR2ack/feGkstWvMtTD/5Jj1S9iTqB
TLSH
T15462B556E934697B9CCAD21DBA59BF13E2FC503261D15E48A7FC9A1C04EB7DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2d3f6e451c365227757b6c579c72d35ee8847736ba3c6cacaf7806e1a7eafdfa
MD5 4f32111e10a2687f939361acaf3abca3
SHA1 fad778dbd7586db067d1c0af4d903fce35d6e7f9
SHA512 7005c2b60c3a2cf8a184030b097ad1faeda6b71fbf7ae2b0acebfe60f2cc2c9dbe4d34f3a4e743d6943c4578ce842df7be43b9fd25f29c6b67e24a96a289daf3
SSDEEP 192:sxR2aVck/feGkstWpVMDZjKzoA8pX7W/g6+WNVGbc94g31YESXtiT1GNxIgD1hJ:sxR2auk/feGkstWvMt7i/5Jj1S9iTqB
TLSH
T16962B716E928697F9CCAD21DBA59BF13E2FC503261D15E48A7FC9A1C14EB7DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ddbf6b342d25a3e12c4d236d65a87480bb66a301ba2459f005beb62d45b4d98
MD5 5de778fc5d5c9a6802ebeb4bfc42b703
SHA1 37c8eb692f3313f69e7702190548d111cb84e9c7
SHA512 fa57722fb8e55f703d825e8c205e56be895dd494a58628d3fc9ca16f708fa3848a5cbfdcd1f8239f46598ffe68253c74dcc37e1e097ed6fd68bf85848efc90bb
SSDEEP 192:sxR2agRk/feGkstWpVMDZjHZzoA8pRibHW/g6+WN9Rl0c94g3OaR/YECXtiTUgNj:sxR2agk/feGkstWvMtAD/5XjZ/C9iTpB
TLSH
T17762B556E934597B9CDAD21DBA59BF13E2FD503291D05E48ABFC9A1C10EB3DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a9f987ee91b51d57343564e91f0e1d43eebfe1c473f2ed779838dadeee48b894
MD5 f4f19cbc436c62109747a102da0fafec
SHA1 a2ab59217b85f048383cdde83b8c85cf38a2a7b7
SHA512 f070e7e9fb09b35653e01497fc3c0f589de9f5ff828b0c13241062fdf7c3d5fb6fa3cb34bdd4590c3e018448a731f8abe9a36d825bb7ca9484e4aecc462cbb62
SSDEEP 192:sxR2amCk/feGkstD5yzbzoA8ptQ/g6+WN/uc/YcsXtiTtGNaIgD3hJ:sxR2aBk/feGkstkmi/5x/M9iTfn
TLSH
T1CD42B619ED28A97B9CCBD21DBB55BF53D2FD503260D12E48E6FC9A1C14EA6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 44a13132dacc2409e586cedd50ab2669536fa3f93671d098c5f32eb532163a83
MD5 aa118163a752d8649e0a7c25619ebc10
SHA1 b0500c8be39f5ad3d612e1a3182f997ed4e8b514
SHA512 2e7483c170502e2a6ff06eecd58fa57e66755fe48f6793361109d03643fc1e8fd2e9600bd18636de3079393b0f8855aff59464779f4a346cda825fa1b8122cb8
SSDEEP 192:sxR7amYk/feGksRD5yzbzoA8ptQ/g6+WN/uc/YcsXtiTtGNaIgVhJ:sxR7a3k/feGksRkmi/5x/M9iTf1
TLSH
T14342B615ED28A97B9CC7D21DBB557F13D2FD503260D12E48E6FC9A1C14EA6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ffbe891a8bbedb267cf567076af945de2bc74d10ff997e52f5cb5c7807758dba
MD5 c0cf29b3d362166773b4b802d79b51e5
SHA1 ac0e7210d27ba8028d214f6861dec92ce24020a4
SHA512 f5b80fb2e26de0fe3888b3217c932199d31ba5aec1e6305b537c3091634c359f551fb9d530e34d50586822e371bf61f47593ec807910aee7591361464f529643
SSDEEP 768:DFakk4yG7pLIL1s5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVV97g/roMKv:DFakk4ym21s5Wg1Bf9tu1jaaxgsMKv
TLSH
T120C2DA7B744CCB7F4F804A9D9C197E9B6DA802CB9A98CD8047FE941C03C67EA52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 976c96b5f5333b3ce3934227932c556259f8a3a28d7e6d40c70dc7502f332cf0
MD5 79212adaf2f733bb9f0897ffffa38cad
SHA1 1bc04f5d2476cad9c8e47c08f6bd5eb10ea617fc
SHA512 cc30a9623c864b027e8039e6f9119ce9c72545606747814d9b9d14794ed8cf58d1ad173864bb16aac34e76282969f8efdff9107b2bd18a9cfead8b215d025c72
TLSH
T1A9E026E816CAC17D601962834338B70AA3E47507EACC3F023F02EC4462C3A05F59A28A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 0f998c1c7b18d3f4759597d9e13b18d9d49dd3d81efed99d81e004b8b81528ed
MD5 25f1cd98f2f8973b6c0c41d648eee48d
SHA1 b8c3d689ffc490b79d36679715d4eb026e68aacb
SHA512 aaeb0ff9a9e7b925bf6ed1f9ac4e3953619830ede1112c5ab2f9de9033049ab0fb5625e14a7b566b777249879f19350ca659d518606a7c8aa0ecfad2fda4e560
TLSH
T17731BEEF181C9429EEAED9B00C4475786EA6C2A90AC5CDC292CF4A8B1425377B80F41B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 dba4ee246edc39829e0a9a201154307e84e32c24bc6983b1688ed8b860bd5513
MD5 c8758959c3e512b8383712fe23b927c0
SHA1 7f4d75967f5c6560e5d8b392f9942b92cd5d394e
SHA512 4f40cf635f0057c7a493592059cf21575201493b77b73c52b51acaf56209e74087f23013a461c2709f9482dbd1dcbc68b7facc2660ba1f17d2d58847b296b902
TLSH
T1A1E086F845CAC1395219B65B037C770D93E17A06EBCC7F022F06D4506382586F79A296
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13434557538990442

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13434557538990442
Size 6KB
SHA256 17af04bf8af0370a4aabacd5ae5b40c9dde6c65ae08e017c64edad15b674db9f
MD5 2577f280d4ed5dfd53fb7e757f8de6e3
SHA1 843369b2ab69cbf259b2003bbe13615ab9c5e483
SHA512 5b890c7c7679bd132f544565eae62e8221f7a73b3a8806b798cf7c9cf21207ffb3b01e0d2d6c85130c19d7fd769af30cfa742abb44fe4601afb30d75b7be564e
SSDEEP 96:3DASwFPm4m7V03/5fifd9ig/NNANMYi3Ha51N:3DASPpVk8d9LNAN9i3Ha51N
TLSH
T16FD1FE359EF0063EE2BE093584E618B2FF3179506AE1CE4E4051924A1873B929FB5FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 df6852231f6dd4504eebaaa4417466a8546f243ee8bc13058d5c9272aae99caa
MD5 4dc4d0b235ac5add7e9513674fddc0fa
SHA1 538fd814670a108a52e3be1f1e9cc66525f2412f
SHA512 f0a921c23aa89e05651d74dcaabe37ffe15a622fdf123ce5f282e3aa64daece83400c229d96e016ac0ddfccb3076c70c66279d3aa2d3597775066aaebea52eb2
TLSH
T148C080443B50B135DC876D31165447817330F06532004853C9CCE79049C73DC3D019D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 76b4b9c54d7e20f1c214b7c664603534322585a1cbc1c933df2f79a9d742fb91
MD5 66b0d04b8b9714671c65b9e571d3ca77
SHA1 033640f57209c573829766e3b8e76dc3d1034ccd
SHA512 c636776599f153a97b8402661c2bfc40a697a774f6575d3b8e0387f0b98a5c4dd9a4f3810a624458dbbd24635eb3e40a2f1b5d2c47ba699914f8775c9679e767
TLSH
T157E0DFB416CAC22B624D718B433CF70C92E27512EACD6A123F09E880A307640B28B282
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 cdcf74a3e500ad0a6387dd4518acf943fe71bc4edb8d37735f290529d9b2b77c
MD5 624a17c5fabc0dbc01a9e04417285b96
SHA1 5b25b8106bdf536fc450275984937f43a94ef8a9
SHA512 36d39088526bc4992eb036175f9eafdb5f8d25b02ee67f29338f961efe99a489d35a0d04dc2835e8ccb00279e6fe7c8bfec14d6cae1d5d20a2177c4a2a9feb22
TLSH
T177E026B94ACEC67D540AA28B4368BF0E92F07917EBCC3B026B09B844A102101F3EB191
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b514fddbb250bd6cd969eed604ddc4c114e47d27251533b408b749fa6a540134
MD5 0ddb1b7fa2c0f7ab3a50eaf12cf76ce4
SHA1 d6b66bd9d3ed882a3d8bda6d9c220803cd83c353
SHA512 560bd7a5b106a87880c4b5da1ecf227349d543480fe1f8f969129bb427ca5e66c2982b7c87d9a41fab00d0d598b4555ce557c9e255cf989b008493ad8ebf00a6
SSDEEP 48:KodIJKOEcDyZOIvKXKE7RIVKSIAPyHcny2Umw:Kod+KOE6aO4KXK0R2KSIK6
TLSH
T16F91272931B606202C7FA54CC1E5865F2281317276A8E52F7FAA11E64D67E29CCFC6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 37dd166a0b0ab10b00874ae6da866764c9118cb40bd78a89be4f853ba7efd4e5
MD5 e36da27fc1f208a55caf7825d748d922
SHA1 e337578083f75b04e9322a8cbbdc18138c0b0b97
SHA512 034e1a168f6e3e68c21bbcbcaa4d25a2c622b935c020018830764011fd7a1313a06a260600a187d25d317f5d029dec34889c6ea8cddd4fc9c5f9f412b65fe419
SSDEEP 384:DNrRZyCSDnxTICMqJcMEhIKyll7svbFKfk7:xFZJSDniOyI1l7svbF9
TLSH
T1EB44830A7B747001EDE6D9725CB080771E3C716ECF22E69169A254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Size 6KB
SHA256 255a6b50cfda78a5b61128366d63c1954383c2b3e8155eb0d57d69657ed0f4d1
MD5 948cc77df4940378d1e20aa937381b97
SHA1 ac479fa43a4232eba0ec92e7efb3a01d59d5605a
SHA512 7e80b0387beb1bef86ae5a74049af1c7a8e99eab2863a9735ca87bea99ca1a00974a932493dd2b8de613b3dc2570e932bc9d6410e0ddc0009bedc8102b87e66b
SSDEEP 12:O/En8aCLZyBSjelDo1ya15AVyBtMqZ/YAuQztjXem/5j:+EnetawelDIya5cyLvAAuQztjOA
TLSH
T1E7D1840983544DF3D875877A90D1936BBBB7B30B61638C2E91F682DC07919AE2A0C46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddaa7cae-f9c4-4273-bd18-c0ba3a8c1b5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ddaa7cae-f9c4-4273-bd18-c0ba3a8c1b5e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 100KB
SHA256 654ad28fa561e59b9827f3ea3268d903960cc66e9ada7389315bc7824ec4f26e
MD5 affe1d7948a7231eb034eb78482eeedf
SHA1 bf228c9f3971ce38813b8c3cb3222a7d86e8f1eb
SHA512 db0785d9f9cc46c18742b0fb64256fca93bc1bfcc294326bd46378fa88981866045f4f0e62251003954ecd59907dd1e9f05e92561464e037ad318481fa7af3eb
SSDEEP 768:BL2H4OQW3LTyeACs47gcPtDBrDmJHUDZI9ftrSFZxys6WcRAALE97yIqQi/2FNdO:xcBrDmQOstvCFC3ms+4syA
TLSH
T182A321F76C0AF1A6C9CD99B4D82BFF09507306628620D8E5A93F48C37B796023D759C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 9783b5dd7ec4cce8c01083b87eb107354f4aaf996fb3a07bf2ed114a492d33b8
MD5 1edcf74804e6c702632c55aa04d7f623
SHA1 de680114fc0f33197faa5f075620a647bb4b48d3
SHA512 a0fbf3f43a7b7723bfa12d992e144a12dbeba7882b752a9c90855a7e199152527afa116a7442974d46daf78cf1ef076679486bf73bd9a1896b611f49b1628d2f
SSDEEP 192:NQBIIIIb4MIMSTYcYt/OF5AsCl9HHssXJa:NQBIIIIb4MIMqBXFas4Ks
TLSH
T14B42726A57061B73C08F9FB613A686D05BD888824072252D71D76C1F9EF3B9382C66F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 39c5f1cfd34859938bc3acef4063f1c57d2d68d36abe05abf6767beb7da1c5ad
MD5 c8247b7c3fb72707200da16377f86779
SHA1 0f1d47379b82751fe5d8f59a7e9dde2fe033c2e5
SHA512 cc0e4101d8f6a41fcacc8e7d59910ba0d8f82806d2e01ec781b7e2d92a85972ad425a9634f72fccb03f1a256c7fec5c0d573ba15045e5c1909b3ea8aa5ebd5f4
TLSH
T1F4E026B4AACAC17EA01D71870228678DE3803A03EECC3F062F09C484E043102FA8E182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 5bcc4a63d5385be6915b4428dff8dd0c43b47ed671e26326789d354ead09055d
MD5 137b71be5a05fca188d60ddb1287a7b8
SHA1 ad0ba25e492cac8c12d77aa6fc2f76f0158991d2
SHA512 151c6db30f5aceeeb9fe28b1a710894b1e6beec47852843437e694b8075f7b6c10ac3cc78bb1235b1e3dfca7e25d60511b8c0191b1db5a8c7e482b5fb2913fb0
TLSH
T101210441F330C618F14A867A607EAB260778D9468FBCED0F487920796D72F091E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 56e2ec6e355c0cda88a55f99fcf814fc2a2693dae91eb8aba40559307b3118fb
MD5 a6f2c27a2e6e9b82ad7a255ad292a763
SHA1 0a10dc1db4042080e773ddcc32a8462d3f4f97b0
SHA512 4662c5898f3acc2a65698fcfef75300d0459a7d2b9377a6f10527267fd643f0689b0ebbd7779714a348d59bea8b86401a577d8d61a238c9aac7e05e4eaedc9a8
TLSH
T177E026A4EDCAC2BF909971830269F748E3913903EECCBF022F01DC84E142187F68E182
MD5 SHA1 SHA512 TLSH

Submit Download

f2744e01-2140-4916-9b85-e41ef4fd2c3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f2744e01-2140-4916-9b85-e41ef4fd2c3e.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 4c33aee0f8e7dca5b9fddeee0aad380d04c3c00015d14990bcc1556afd5e036b
MD5 bcf4b441496aa434f7e001875a0f1656
SHA1 c4e1c7fd0262859df7415874f546873d9098ab70
SHA512 0a28d27164e49335e9b48fb3ab5878d9e96c50ff5e29556e4c56bb2cf3fe9af0d38e3c69d89d386e7c7a275932a080fdba23195ecfee56a34643a588f7ff135a
SSDEEP 3:MsEllllkEthXllkl2zEY:/M/xT02z
TLSH
T1C04404447FC41445C5013070C413C3D00370D45C07515F4334F104535CC5F401CD4000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 77d5cb755abc347043f05d9d6e895decb0edfdc66814560ab26c3450a7a6a85c
MD5 c512cdf6e066c9d8449cc9327473e36f
SHA1 819d8839700c5552538ff72dd2717a7dcb67dda8
SHA512 c8465674ddb2a4931f22b0c5b8f064abfdc1b0d7438a58f0ab6eccca1fcfa3ba362926479ae2aa2422541073f3d8fbfd1635a9a08d0e29528663a7d28abe554b
SSDEEP 3:MsEllllkEthXllkl2zEHSY:/M/xT02zoT
TLSH
T1154404447FC00405C5103470C413D3D00371D41C07137F4334D304735CC5D405C44410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3f5b4d085a12f0bfd6bcea9ba4d636107bb1f6d3670c80f2d3e612ffb77b2a84
MD5 9e8bc69f51b8bd6e3948c238dd1f2f35
SHA1 12117d9650e8da552d4a84fee6d1a7f4fb74ff79
SHA512 d5dc061e0b917bd7c1225b924b7ac24d53850a328e3f14c0454066cdb090325a8510c28df0d4cb51d5d93bc768d12d54da5fee980d104d58c1117f932944e782
SSDEEP 768:3Fw3UlJJieOZSZnUPO4Qp7cPAiSm2eo4w4cciGrTFl5MgMT:3Fw3SrcSZwQpYoimeoR4ccFFHMgMT
TLSH
T180F2BFB0A9E4AE735CF793817A5A7B42BFF451A358C51E48C6E99F0D00876AD0307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 fc97fffd55652895dcc2d1acd9a6d3291008527ad0dc4371e5d2b2302e4395fc
MD5 1065cb22dd6323569732f88fc2f986ad
SHA1 88df53c1816b7c5d6e5ba7f7acc46c193a2ce7cd
SHA512 3e18b40342548ddb5c2a0f65b7eca8836ac64fce3ea20d9410650da9a08eef19e599a3b177c26a67f904ed919ea14de24191e2b08d9a86ea4b0aa8cbdee96a59
SSDEEP 768:YFHG3hwg7xdhuOZAnUPO4Qp7cPAiSm2eo4w4cciGrTF2jMgwt:4G3FHAwQpYoimeoR4ccFFMMgwt
TLSH
T17A1316F198D79A76E8AE4783673D6E42AEBCC15374885984F7D45E0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ed018cad8c0136f5a0f1a4829cb2315c32b0931cf43ba49e31d0570a11f7a2de
MD5 ef9a58b0b0b3c182ee9205a5e69f86dc
SHA1 668fd7c7cc92dbbb7ccdbef01a861e4c72694106
SHA512 6c955d451d5aa84c3ef209eae515c47477075fa843f15058871e814757b2eb218f2167d0286b3bbe314ed1907d4b8a3c147d8936e92488446730fd481c2e7fb8
SSDEEP 768:vw/UxvxjgC+5j3uV4C8KieOZ0jFnUPO4Qp7cPAiSm2eo4w4cciGrTF5qAgZbCM3s:vdZj3+5j3u2CVc0jFwQpYoimeoR4ccFl
TLSH
T14E03BF75A8A46A77DCF397853A1D6346FFF041A395C12A98CAED2F0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4c1e2b584f213d886d879518c116d294b275a09e8bd5ce62495e10da14161091
MD5 403b53d2f98a8d4a3bcde071849c7f47
SHA1 0aaebd04a160922ac82adc23514674bdec6feb50
SHA512 03e81e64081999a9c640e61b777228d801e8f1f3ca3fb3852b33c456e79b70e58cd5a3e7c7a0ee0262e1efc4a41260b8cc00fee9ec41849a1da37cd5f9757065
SSDEEP 768:3C/UxvxjgC+5j3UlJJieOZSTnUPO4Qp7cPAiSm2eo4w4cciGrTFl5MgRM2:3HZj3+5j3SrcSTwQpYoimeoR4ccFFHMM
TLSH
T15613CF74A898AD639CF3A7417A1A6793EFF055A358C52E9CCAE99F0D01873AD0307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0f9ddff642a05e8cffcc6af70b5ba24549b26c54ef2d08dc25675ea16ed01f2f
MD5 0a0bf34f90ff4b32b881eded4d3617f3
SHA1 45fec95ec603a975d2e998a998379d623d525079
SHA512 08851514910a59187674ed02fc109c3f4accf6860f28641f442c989a042d3fee2ee21d932e46685f8206f3f724685632d6b5308ad1b7bee14ef2c2ba8361e5e7
SSDEEP 768:iFHA3hwgonMkuOZXnUPO4Qp7cPAiSm2eo4w4cciGrTF2jMgwt:+A3wzXwQpYoimeoR4ccFFMMgwt
TLSH
T1731316F198D79A76E8AE4783673D6E42AEBCC15374885984F7D55E0CCC822BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 85b8f275c764ae11b20a77a55404e147b0318e76a87033bfbdb36df5155d9e06
MD5 6372b80b59fbddbfc41fb2f1804cb42f
SHA1 568fd05c3ffdb148a119cc3b288ffee832be7192
SHA512 ca9f92bcd6dfb8c9e673187566cc816d3ab232ed5e1bbd32fa117e679033263bc437d4c72a8f4f2fe2bedab6839018ee2ee5f5f460e0fd632bb6ec01bfb3ebca
SSDEEP 768:ew3zyJJieOZSunUPO4Qp7cPAiSm2eo4w4cciGrTFl5MgMT:ew3urcSuwQpYoimeoR4ccFFHMgMT
TLSH
T1E5F2BFB0A894AE739CF793817A5A7B42BFF451A358C91E48C6E99F0D00877AD070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d9534a78d05f17005e4511ce5b57a3f02508942727b6c68d49bb1406a1542618
MD5 57ba47742b1a62df1602f7d4e3770a7b
SHA1 1ddaafe1a9532c1d8786bf63c0fb26e3f0dded7e
SHA512 c105bde2f5537a5ce209d96a3a1d5e5d11e216b77328a81f7ca28b73fe929d48f522f621c651bdd94f1f549b890c62b43f22cb16a47ab63906af88d2d37f0dab
SSDEEP 768:3xw3UyJJieOZSunUPO4Qp7cPAiSm2eo4w4cciGrTFl5MgMT:3xw3prcSuwQpYoimeoR4ccFFHMgMT
TLSH
T1A2F2BFB0A8E4AE735CF793857A5A7B42BFF451A358C91E48C6E99F0D00876AD030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 6baef7219824e726a4a5d6a09c4b4f528a4a5fefa467d659f68e14002d69b13e
MD5 37a6816893281050f7e69f26d365f1a8
SHA1 989d05f4f75092193a348ca7e40b64332f1abfa0
SHA512 8d4e20a1b06ca859ecf653ed129983baf3168f15187973ace35138d0cc3957f204c43f80d8bbd0057e2910e724fa2e76e97c1f109a62cd18914418caad257273
SSDEEP 768:vFHU3HwgiwehuOZjnnUPO4Qp7cPAiSm2eo4w4cciGrTFl5MgMT:hU3vojnwQpYoimeoR4ccFFHMgMT
TLSH
T17E1317F598D79A76E8AE4783673D6E42AEBCC15374885984F7D45E0CCC822BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 0d6cbefa90bb17c3f31a2340ff9fe7444952c6f5b2add7c4d5e719b41a8abe0b
MD5 f1c5fc4776620e75e24cd9aca955821a
SHA1 f12e676c7554bced31f237092dc917847fff71a0
SHA512 fb41e0eecb95be321748a11b933421cb2e6ee77a66fe644ba0fe13f31820cc7cf7751a8979e602410a6eb8b907d50c2fd2622daae2c6883477b2a9b64f6fc4ce
SSDEEP 768:vFXG3Iwgit6huOZ+nUPO4Qp7cPAiSm2eo4w4cciGrTFlfMl9gyMgMT:ZG3h8+wQpYoimeoR4ccFFVMAyMgMT
TLSH
T19923F4F98CD3993AD8AE6783673D6E159ABCC167B4A45884F7940F0CCC625BFE306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 dc42d682db89bc63cbf8ef37f7fec9e6aa541a371a6de8ac402b10f8819fc311
MD5 bd4beffda41df8f4ad6d99b3e47c7215
SHA1 c0ada15b3cd0ba75dd3006dffa1b26eb47a71a25
SHA512 fe9233bc33a76b71eff7695271075077e99ed29c5ad480f5eab545e7015708f791cddc9718e3eb37f2e67eeb17d0e7e1f4845da7d99dd467460e5a3984c87d45
SSDEEP 768:iFw6wwgoLGHuOZNnUPO4Qp7cPAiSm2eo4w4cciGrTF2/TKgBJsFMgwt:/6RuNwQpYoimeoR4ccFFaTK6JkMgwt
TLSH
T17523D4F89CD3993AD8AE6747673D6E119ABCC173B4A85888F7955B0CCC6217FE306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0a108c590dd81e487d9564172a0e78bc95b98c698a2633b87331548c82679236
MD5 cb061180c710936d04c582aa05e28638
SHA1 20a32fdcefaeecab54ea931bbb95ce098135a249
SHA512 aa2ceb13d41471e65790fcaa35f9b018459fe320bc076e99f903784e5aca7e31bba49275526c54dff428a40ac0de5b2c245575a59a8bf7d2f2b5d7e4ecdfb1da
SSDEEP 3:MsEllllkEthXllkl2zEbI:/M/xT02z
TLSH
T1754404547FC40D05CD043430C011D3D00370DC1407115F4334D10C535CD5F403C14000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1269acc4-cd71-4be7-a0e2-afd9eabac15d.tmp

Path C:\Users\Admin\AppData\Local\Temp\1269acc4-cd71-4be7-a0e2-afd9eabac15d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5028_258730687\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download